Vulnerabilities
Trending
What is heating up right now: vulnerabilities whose exploitation probability jumped this week, the ones newly confirmed as exploited, and fresh public exploit code.
Rising exploit probability
Largest increases of the EPSS score over the last 7 days (scores of Nov 7, 2026). A jump usually means exploit activity or new exploit code — often before the vulnerability is listed as exploited.
-
Critical 10.0
CVE-2026-75650 Exploited Public exploit EPSS 3.9% → 99% Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)
- Critical 9.8
-
Critical 9.3
CVE-2026-102764 Exploited Public exploit EPSS 19% → 78% Improper Origin Validation in Internal Messaging Components of BeyondTrust Remote Support
- Critical 10.0
- Critical 9.4
- Medium 4.6
- High 8.8
-
Critical 10.0
CVE-2026-57827 Public exploit EPSS 2.3% → 17% Joomla Extension - rsjoomla.com - Unauthenticated file upload in RSFiles component < 1.17.12
- Unscored
-
High 8.8
CVE-2026-8451 Public exploit EPSS 0.5% → 14% Insufficient input validation leading to memory overread
- High 8.3
-
Critical 9.8
CVE-2026-76461 Exploited Public exploit EPSS 30% → 40% Cisco Secure Email Gateway SQL Injection Vulnerability
- Medium 4.3
- Critical 9.8
- Critical 9.8
- Medium 4.3
- Critical 9.8
- Medium 4.9
- Unscored
- Unscored
- High 7.1
- Critical 9.4
-
High 7.8
CVE-2025-41244 Exploited Public exploit EPSS 8.6% → 16% VMSA-2025-0015: VMware Aria Operations and VMware Tools updates address multiple vulnerabilities (CVE-2025-41244,CVE-2025-41245, CVE-2025-41246)
- Medium 5.9
- Unscored
- Medium 5.4
- Critical 9.8
- Medium 4.8
- Unscored
- Critical 9.4
Newly exploited
Confirmed as exploited in the wild in the last 14 days (CISA KEV, ENISA). All exploited →
- High 7.5
-
Medium 5.5
CVE-2024-27834 Exploited KEV Nov 4, 2026 The issue was addressed with improved checks. This issue is fixed in Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tv…EPSS 1.5%
-
High 8.1
CVE-2026-119977 Exploited Public exploit KEV Nov 3, 2026 WordPress Core 4.7.0 - 7.1.3 - Unauthenticated Upgrade-Window Staged-Installer Remote Code ExecutionEPSS 1.2%
- High 7.0
- Medium 4.3
- Critical 10.0 EPSS 65%
- High 8.6
-
High 7.8
CVE-2026-46300 Exploited Public exploit KEV Oct 28, 2026 net: skbuff: preserve shared-frag marker during coalescingEPSS 16%
- Low 2.7
-
Critical 9.3
CVE-2026-48356 Exploited Public exploit KEV Oct 27, 2026 Adobe Commerce | Unrestricted Upload of File with Dangerous Type (CWE-434)EPSS 47%
-
Critical 9.2
CVE-2026-111497 Exploited Public exploit KEV Oct 27, 2026 Out-of-Bounds Write in Google Brotli DecoderEPSS 83%
- Critical 9.2 EPSS 100%
- Critical 9.2 EPSS 100%
-
Unscored
CVE-2015-0279 Exploited ENISA Oct 25, 2026 JBoss RichFaces before 4.5.4 allows remote attackers to inject expression language (EL) expressions and execute arbitrary Java code via the do parameter.EPSS 3.9%
New public exploits
Exploit or proof-of-concept code first published in the last 14 days (GitHub, Exploit-DB). All with public exploit →
-
High 8.1
CVE-2026-42016 Exploited Public exploit first exploit Nov 7, 2026 Incorrect authorization validation of user token in JFrog Artifactory allows Privilege EscalationEPSS 8.6%
-
High 7.5
CVE-2026-19868 Exploited Public exploit first exploit Nov 7, 2026 An authentication enforcement vulnerability in SonicOS SSLVPN service may allow a user with valid credentials for an alternate authentication method to bypass …
-
High 8.8
CVE-2023-39780 Exploited Public exploit first exploit Oct 30, 2026 On ASUS RT-AX55 3.0.0.4.386.51598 devices, authenticated attackers can perform OS command injection via the /start_apply.htm qos_bw_rulelist parameter. NOTE: f…EPSS 40%
- Critical 9.9 EPSS 1%
-
Medium 5.5
CVE-2025-43520 Exploited Public exploit first exploit Oct 30, 2026 A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Seq…
- High 8.7
-
High 8.1
CVE-2026-98499 Public exploit first exploit Nov 7, 2026 HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce()
-
Critical 9.3
CVE-2026-39732 Public exploit first exploit Nov 7, 2026 WordPress Transliterator plugin <= 2.5.13 - SQL Injection vulnerability
-
Critical 9.1
CVE-2026-117691 Public exploit first exploit Nov 7, 2026 Keycloak-services: keycloak-services: saml redirect binding signature bypass via percent-encoded parameter names
-
Medium 6.5
CVE-2026-95597 Public exploit first exploit Nov 7, 2026 WordPress 워드프레스 결제 심플페이 plugin <= 5.5.17 - Settings Change vulnerability
-
Medium 6.5
CVE-2026-94074 Public exploit first exploit Nov 7, 2026 WordPress Simply Schedule Appointments plugin <= 1.6.12.29 - Broken Access Control vulnerability
-
High 7.1
CVE-2026-115596 Public exploit first exploit Nov 7, 2026 WordPress eCommerce Product Catalog plugin <= 3.6.4 - Cross Site Scripting (XSS) vulnerability
-
High 7.1
CVE-2026-112869 Public exploit first exploit Nov 7, 2026 WordPress We’re Open! plugin <= 2.6 - Cross Site Scripting (XSS) vulnerability
-
High 7.1
CVE-2026-61989 Public exploit first exploit Nov 7, 2026 WordPress Easy Property Listings plugin <= 3.5.25 - Cross Site Scripting (XSS) vulnerability
-
High 7.1
CVE-2026-94641 Public exploit first exploit Nov 7, 2026 WordPress UsersWP plugin <= 1.2.73 - Cross Site Scripting (XSS) vulnerability
-
Medium 5.4
CVE-2026-112222 Public exploit first exploit Nov 7, 2026 WordPress Surfer plugin <= 1.8.0.744 - Broken Access Control vulnerability
- High 8.8
-
Medium 5.4
CVE-2026-122675 Public exploit first exploit Nov 7, 2026 WordPress Wp Social plugin <= 3.2.3 - Cross Site Request Forgery (CSRF) vulnerability
-
High 7.5
CVE-2019-9513 Public exploit first exploit Nov 6, 2026 Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of serviceEPSS 82%
-
Unscored
CVE-2018-1000810 Public exploit first exploit Nov 6, 2026 The Rust Programming Language Standard Library version 1.29.0, 1.28.0, 1.27.2, 1.27.1, 127.0, 126.2, 126.1, 126.0 contains a CWE-680: Integer Overflow to Buffe…EPSS 3%
-
Unscored
CVE-2021-28879 Public exploit first exploit Nov 6, 2026 In the standard library in Rust before 1.52.0, the Zip implementation can report an incorrect size due to an integer overflow. This bug can lead to a buffer ov…EPSS 2.4%
- Medium 5.3 EPSS 2%
-
High 8.6
CVE-2024-5716 Public exploit first exploit Nov 6, 2026 Logsign Unified SecOps Platform Authentication Bypass VulnerabilityEPSS 1.6%
-
Critical 9.1
CVE-2026-114630 Public exploit first exploit Nov 6, 2026 ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.8 - Unauthenticated Arbitrary File Deletion via 'ticket_attachment_path' ParameterEPSS 1.3%
-
Unscored
CVE-2015-1201 Public exploit first exploit Nov 6, 2026 Privoxy before 3.0.22 allows remote attackers to cause a denial of service (file descriptor consumption) via unspecified vectors. NOTE: the provenance of this …EPSS 1.3%
-
High 8.7
CVE-2026-33871 Public exploit first exploit Nov 6, 2026 Netty HTTP/2 CONTINUATION Frame Flood DoS via Zero-Byte Frame BypassEPSS 1.1%
-
Critical 9.8
CVE-2026-83542 Public exploit first exploit Nov 6, 2026 Apache OFBiz: Unauthenticated RCE via login-page widget injectionEPSS 1.1%
-
Medium 6.0
CVE-2022-24765 Public exploit first exploit Nov 6, 2026 Uncontrolled search for the Git directory in Git for WindowsEPSS 1%
-
High 7.0
CVE-2026-83844 Public exploit first exploit Nov 6, 2026 · 5 GitHub repos Windows Paint Remote Code Execution Vulnerability
- Critical 9.4
-
Critical 10.0
CVE-2026-118423 Public exploit first exploit Nov 6, 2026 · 3 GitHub repos WP Libre Form 1.5.0.1 - Unauthenticated RCE via Arbitrary File Upload
-
Critical 9.8
CVE-2026-120209 Public exploit first exploit Nov 6, 2026 AJ-Report through 1.7.1 Authentication Bypass leading to RCE via Share-Token
-
High 8.1
CVE-2026-6023 Public exploit first exploit Nov 6, 2026 Deserialization of Untrusted Data Vulnerability in Telerik UI for ASP.NET AJAX
-
Critical 9.8
CVE-2026-113615 Public exploit first exploit Nov 6, 2026 GS JWT Authentication <= 1.0.0 - Unauthenticated Privilege Escalation via SQLi
- Critical 9.3
-
Medium 6.6
CVE-2026-0264 Public exploit first exploit Nov 6, 2026 PAN-OS: Heap-Based Buffer Overflow in DNS Proxy and DNS Server Allows Unauthenticated Remote Code Execution
-
Critical 9.1
CVE-2026-116214 Public exploit first exploit Nov 6, 2026 MacCMS v10 before 2026.1000.4054 Account Takeover via Unbound Password Recovery Code
- High 8.8
- High 7.7
-
Critical 9.8
CVE-2026-100109 Public exploit first exploit Nov 6, 2026 Security For WooCommerce 1.0.10 - 1.0.16 - Unauthenticated Privilege Escalation via usfw_create_temporary_user
Updated hourly. EPSS by FIRST; exploitation from CISA KEV and ENISA EUVD; exploit code from PoC-in-GitHub, Metasploit and Exploit-DB.