← Back to feed 2026-11-02
17,991
Total vulnerabilities (30 days)
949
Critical severity
18
Actively exploited (CISA KEV)
2346
High EPSS (>50th %ile)

By severity

CRITICAL
949
HIGH
6,343
MEDIUM
5,584
LOW
629
UNKNOWN
4,484

By source

Microsoft
14,105
NVD
3,570
GitHub
114
OSV
49
Fortinet
47
Arista
39
OSS-Security
32
OpenStack
16
Featured
9
CISA-KEV
6
Ubuntu
3
Red Hat
1

CVSS score distribution

0.0–0.5
2
0.5–1.0
1
1.0–1.5
1
1.5–2.0
60
2.0–2.5
136
2.5–3.0
92
3.0–3.5
198
3.5–4.0
137
4.0–4.5
580
4.5–5.0
449
5.0–5.5
716
5.5–6.0
2,213
6.0–6.5
472
6.5–7.0
1,149
7.0–7.5
1,725
7.5–8.0
2,549
8.0–8.5
613
8.5–9.0
1,440
9.0–9.5
239
9.5–10.0
711

Daily severity heatmap

Low
Critical  
No data

Top affected products / packages

ProductCVEsMax CVSSWorst severity
Windows229859.9CRITICAL
azl31108910.0CRITICAL
Microsoft930910.0CRITICAL
cbl2128810.0CRITICAL
.NET3078.8HIGH
Azure17310.0CRITICAL
Office1128.8HIGH
google/chrome739.6CRITICAL
Visual529.6CRITICAL
apple/macos378.8HIGH
Skype368.8HIGH
ASP.NET359.4CRITICAL
langflow/langflow339.9CRITICAL
Raw329.8CRITICAL
apple/ipados288.8HIGH
apple/iphone_os288.8HIGH
HEVC248.8HIGH
System.Security.Cryptography.Xml197.5HIGH
PowerShell188.8HIGH
Nuance169.8CRITICAL
apple/visionos167.8HIGH
Microsoft.AspNetCore.Components.WebAssem148.8HIGH
Remote148.8HIGH
npm/undici147.5HIGH
jenkins/jenkins138.8HIGH
System.Security.Cryptography.Pkcs127.5HIGH
pip/filelock126.3MEDIUM
azl41010.0CRITICAL
Web98.8HIGH
cm297.5HIGH

Highest EPSS scores (top 20)

CVE IDTitleEPSS %ileCVSSSeverity
CVE-2024-4577Argument Injection in PHP-CGI100.0%9.8CRITICAL
CVE-2026-109618PHP Memory Corruption Vulnerability100.0%—HIGH
CVE-2026-109619PHP Stale Internal Request-State Vulnerability100.0%—HIGH
CVE-2025-32433Erlang/OTP SSH Vulnerable to Pre-Authentication RCE99.9%10.0CRITICAL
CVE-2026-21589Atlassian Data Center products: unauthenticated access to files in the web root99.9%—HIGH
CVE-2026-43284xfrm: esp: avoid in-place decrypt on shared skb frags99.8%7.8HIGH
CVE-2026-43500rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present99.8%7.8HIGH
CVE-2026-111497Google: CVE-2026-111497 Buffer overflow vulnerability in the Brotli decoder99.7%8.1HIGH
CVE-2026-104935Ivanti Connect Secure authentication bypass — exploited zero-day chained to root99.7%—HIGH
CVE-2026-88771Citrix NetScaler: two more exploited flaws (CVE-2026-88771 + CVE-2026-88772)99.7%—HIGH
CVE-2026-41089Windows Netlogon Remote Code Execution Vulnerability99.6%9.8CRITICAL
CVE-2026-45659Microsoft SharePoint Remote Code Execution Vulnerability99.6%8.8HIGH
CVE-2023-50868MITRE: CVE-2023-50868 NSEC3 closest encloser proof can exhaust CPU99.5%7.5HIGH
CVE-2026-55040Microsoft SharePoint Server Security Feature Bypass Vulnerability99.4%9.1CRITICAL
CVE-2026-42897Microsoft Exchange Server Spoofing Vulnerability99.4%8.1HIGH
CVE-2026-42945NGINX ngx_http_rewrite_module vulnerability99.3%8.1HIGH
CVE-2025-29971Web Threat Defense (WTD.sys) Denial of Service Vulnerability99.3%7.5HIGH
CVE-2024-30088Windows Kernel Elevation of Privilege Vulnerability99.3%7.0HIGH
CVE-2025-22037ksmbd: fix null pointer dereference in alloc_preauth_hash()99.3%5.5MEDIUM
CVE-2026-45498Microsoft Defender Denial of Service Vulnerability99.2%4.0MEDIUM