CVE Pulse
Live vulnerability intelligence from EchelonGraph's CVE feed. Search, filter, and explore vulnerabilities affecting cloud infrastructure.
Subscribe via RSS⚡ How fast we get new CVEs, measured against NVD →🛡️ Am I affected? →⚡ Free CVE API — docs →🔌 MCP for Claude & Cursor →
Why is the EG score different from NVD?
The EG score synthesizes multiple sources — NVD/CNA CVSS, CISA KEV, FIRST EPSS and GitHub Security Advisories — rather than relying on CVSS alone. Scores are recomputed on a schedule, and a CVE is queued early when its record changes, CISA KEV-lists it, new exploit code is recorded, or an EPSS move changes the 0–10 score. EchelonGraph's own exploitation model does not move this 0–10 score: it feeds EG Risk (0–100), the priority score every scored CVE also carries, weighted 45% severity, 40% exploitation (the strongest of KEV, that model and EPSS) and 15% automatability; a change in that model's tier queues the CVE early too, for EG Risk. The signals reshape the score in defensible, transparent ways:
| When EG sees… | NVD-only score | EG score | Confidence |
|---|---|---|---|
KEV listed (exploited in the wild)kev_exploitation | 8.0 | 9.0 ▲CRITICAL | HIGH 1.00 |
EPSS climbing (continuous — no cliff)epss_uplift | 6.5 | 7.9 ▲HIGH | HIGH 0.88 |
Record REJECTED by CNA/NVDrejected | 9.8 | NONE ▼ | NONE 0.00 · suppressed |
Only NVD seen, no corroborationnvd_cvss | 9.8 | 9.8 ↻CRITICAL | LOW 0.35 · aggregating |
A GitHub advisory under 30 days old rates it higher, by at most 1.0ghsa_cvss | 7.5 | 8.0 ▲HIGH | HIGH 0.90 |
A GitHub advisory newer than the CVE record's last change rates it lowerghsa_cvss | 8.1 | 7.5 ▼HIGH | MEDIUM 0.60 · capped: GHSA revises NVD down |
We don't claim "more accurate" — that's not defensible. We claim more sources, with every input shown. Every scored CVE's detail page exposes its rule trigger, confidence, and source breakdown. Read the full methodology →
🔔 CVE Pulse alerts
Get notified before the next critical CVE hits production
Subscribe to real-time or digest emails covering NVD CVEs and vendor-disclosed advisories — Microsoft MSRC, Red Hat, GitHub GHSA — including advisories that name no CVE ID.
- ✓Critical + High CVEs in your inbox, no scrolling required
- ✓Vendor advisories, read from each vendor's own feed every 1 to 6 hours (by vendor)
- ✓Choose real-time, daily, weekly, or monthly cadence
Showing published CVEs (default). Rejected/withdrawn CVEs are hidden.
Loading...
Discovered in Last 24 Hours(20)
This high-severity CVE scores 8.7 under a secondary CVSS source (NVD's own analysis pending). EPSS exploit-prediction score not yet available (the EPSS model rescores nightly; freshly-published CVEs typically appear within 48 hours). No GitHub Security Advisory CVSS is on record for this CVE.
Memory overflow in LDAP authentication can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler ADC and Citrix NetScaler Gateway.
This high-severity CVE scores 8.7 under a secondary CVSS source (NVD's own analysis pending). EPSS exploit-prediction score not yet available (the EPSS model rescores nightly; freshly-published CVEs typically appear within 48 hours). No GitHub Security Advisory CVSS is on record for this CVE.
Memory overflow in client-certificate authentication can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler ADC and Citrix NetScaler Gateway.
This high-severity CVE scores 8.7 under a secondary CVSS source (NVD's own analysis pending). EPSS exploit-prediction score not yet available (the EPSS model rescores nightly; freshly-published CVEs typically appear within 48 hours). No GitHub Security Advisory CVSS is on record for this CVE.
Memory overflow in KBA (knowledge-based authentication) can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler ADC and Citrix NetScaler Gateway.
This critical-severity CVE scores 9.3 under a secondary CVSS source (NVD's own analysis pending). EPSS exploit-prediction score not yet available (the EPSS model rescores nightly; freshly-published CVEs typically appear within 48 hours). No GitHub Security Advisory CVSS is on record for this CVE.
Memory overflow in Email OTP authentication can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler ADC and Citrix NetScaler Gateway.
“—” beside the score: it is equal to the CVSS score beside it.
Score 7.3 from GitHub Security Advisory (severity: MODERATE) published 2026-11-13. A secondary CVSS source baseline 7.3; sources differ by 0.0.
A vulnerability was identified in Zackriya-Solutions Meetily up to 0.4.1. Affected is an unknown function of the file backend/app/main.py. The manipulation leads to missing authentication. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The legacy backend was not removed yet. Vulnerable code is still present on main. The vendor explains: "[W]e are moving towards a single unified application using the tauri framework, and we deprecated the client-server architecture of this application."
This high-severity CVE scores 8.7 under a secondary CVSS source (NVD's own analysis pending). EPSS exploit-prediction score not yet available (the EPSS model rescores nightly; freshly-published CVEs typically appear within 48 hours). No GitHub Security Advisory CVSS is on record for this CVE.
Memory overflow in WebAuth authentication can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler ADC and Citrix NetScaler Gateway.
This high-severity CVE scores 8.7 under a secondary CVSS source (NVD's own analysis pending). EPSS exploit-prediction score not yet available (the EPSS model rescores nightly; freshly-published CVEs typically appear within 48 hours). No GitHub Security Advisory CVSS is on record for this CVE.
Memory overflow in SAML authentication can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler ADC and Citrix NetScaler Gateway.
Software installed and run as a non-privileged user may conduct improper GPU system calls to the execution of an error path that triggers an OOB read & write. An error can be triggered which causes the index of the array element to be cleaned up by the error path would be outside of the array bounds.
This critical-severity CVE scores 9.5 under a secondary CVSS source (NVD's own analysis pending). EPSS exploit-prediction score not yet available (the EPSS model rescores nightly; freshly-published CVEs typically appear within 48 hours). No GitHub Security Advisory CVSS is on record for this CVE.
Multiple Memory overflow vulnerabilities can lead to unpredictable or erroneous behavior and Denial of Service in Citrix NetScaler ADC and Citrix NetScaler Gateway.
This high-severity CVE scores 8.7 under a secondary CVSS source (NVD's own analysis pending). EPSS exploit-prediction score not yet available (the EPSS model rescores nightly; freshly-published CVEs typically appear within 48 hours). No GitHub Security Advisory CVSS is on record for this CVE.
Memory overflow in RTSP ALG can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler
Software installed and run as a non-privileged user may conduct GPU system calls to trigger an integer overflow and allow OOB writes to GPU buffers. The integer overflow caused when mapping a GPU buffer >4GB causes corruption of array length, and can lead to kernel panics or out of bounds access.
“—” beside the score: it is equal to the CVSS score beside it.
Score 4.3 from GitHub Security Advisory (severity: LOW) published 2026-11-13. A secondary CVSS source baseline 4.3; sources differ by 0.0.
A flaw has been found in Cairo-dock Glx-Dock 3.4.0. The affected element is an unknown function of the file bg_forum.php of the component href Attribute Handler. This manipulation of the argument f causes cross site scripting. The attack may be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Software installed and run as a non-privileged user may conduct improper GPU system calls through the DDK kernel module interface. Under unsupported use of the interface, a use-after-free condition may occur that can lead to kernel memory corruption, platform instability, or system reboot. The weakness occurs when software references memory after it has been released. Accessing memory after free may result in corruption of valid data structures, unexpected program behaviour, process crashes, or execution of unintended operations.
This critical-severity CVE scores 9.3 under a secondary CVSS source (NVD's own analysis pending). EPSS exploit-prediction score not yet available (the EPSS model rescores nightly; freshly-published CVEs typically appear within 48 hours). No GitHub Security Advisory CVSS is on record for this CVE.
Memory overflow in NetScaler Push can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler
This critical-severity CVE scores 9.3 under a secondary CVSS source (NVD's own analysis pending). EPSS exploit-prediction score not yet available (the EPSS model rescores nightly; freshly-published CVEs typically appear within 48 hours). No GitHub Security Advisory CVSS is on record for this CVE.
Memory corruption in DNS-over-HTTPS (DoH) can lead to unpredictable or erroneous behavior or a Denial of Service in Citrix NetScaler
This critical-severity CVE scores 9.3 under a secondary CVSS source (NVD's own analysis pending). EPSS exploit-prediction score not yet available (the EPSS model rescores nightly; freshly-published CVEs typically appear within 48 hours). No GitHub Security Advisory CVSS is on record for this CVE.
Memory corruption in DNS / DNS-over-HTTPS (DoH) can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler
This critical-severity CVE scores 9.3 under a secondary CVSS source (NVD's own analysis pending). EPSS exploit-prediction score not yet available (the EPSS model rescores nightly; freshly-published CVEs typically appear within 48 hours). No GitHub Security Advisory CVSS is on record for this CVE.
Memory overflow in SMPP traffic can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler
“—” beside the score: it is equal to the CVSS score beside it.
Score 7.3 from GitHub Security Advisory (severity: MODERATE) published 2026-11-13. A secondary CVSS source baseline 7.3; sources differ by 0.0.
A security flaw has been discovered in SourceCodester Food Ordering System 1.0. This affects an unknown part of the file admin/add_category.php of the component Admin Write Handler. Performing a manipulation of the argument title/description/price/current_image/featured/active/id results in sql injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks.
“—” beside the score: it is equal to the CVSS score beside it.
Score 7.3 from GitHub Security Advisory (severity: MODERATE) published 2026-11-13. A secondary CVSS source baseline 7.3; sources differ by 0.0.
A vulnerability was identified in SourceCodester Food Ordering System 1.0. Affected by this issue is some unknown functionality of the file admin/update_food.php of the component Admin Image Handler. Such manipulation of the argument cmd leads to unrestricted upload. The attack may be performed from remote. The exploit is publicly available and might be used.
“—” beside the score: it is equal to the CVSS score beside it.
Score 4.3 from GitHub Security Advisory (severity: LOW) published 2026-11-13. A secondary CVSS source baseline 4.3; sources differ by 0.0.
A vulnerability was determined in SourceCodester Smart Attendance System with QR Code Scanner 1.0. Affected by this vulnerability is an unknown functionality of the file reset_password.php. This manipulation of the argument Username causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.
Top Critical CVEs(12)
This critical-severity CVE scores 9.3 under a secondary CVSS source (NVD's own analysis pending). EPSS exploit-prediction score not yet available (the EPSS model rescores nightly; freshly-published CVEs typically appear within 48 hours). No GitHub Security Advisory CVSS is on record for this CVE.
Memory overflow in Email OTP authentication can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler ADC and Citrix NetScaler Gateway.
This critical-severity CVE scores 9.5 under a secondary CVSS source (NVD's own analysis pending). EPSS exploit-prediction score not yet available (the EPSS model rescores nightly; freshly-published CVEs typically appear within 48 hours). No GitHub Security Advisory CVSS is on record for this CVE.
Multiple Memory overflow vulnerabilities can lead to unpredictable or erroneous behavior and Denial of Service in Citrix NetScaler ADC and Citrix NetScaler Gateway.
This critical-severity CVE scores 9.3 under a secondary CVSS source (NVD's own analysis pending). EPSS exploit-prediction score not yet available (the EPSS model rescores nightly; freshly-published CVEs typically appear within 48 hours). No GitHub Security Advisory CVSS is on record for this CVE.
Memory overflow in NetScaler Push can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler
This critical-severity CVE scores 9.3 under a secondary CVSS source (NVD's own analysis pending). EPSS exploit-prediction score not yet available (the EPSS model rescores nightly; freshly-published CVEs typically appear within 48 hours). No GitHub Security Advisory CVSS is on record for this CVE.
Memory corruption in DNS-over-HTTPS (DoH) can lead to unpredictable or erroneous behavior or a Denial of Service in Citrix NetScaler
This critical-severity CVE scores 9.3 under a secondary CVSS source (NVD's own analysis pending). EPSS exploit-prediction score not yet available (the EPSS model rescores nightly; freshly-published CVEs typically appear within 48 hours). No GitHub Security Advisory CVSS is on record for this CVE.
Memory corruption in DNS / DNS-over-HTTPS (DoH) can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler
This critical-severity CVE scores 9.3 under a secondary CVSS source (NVD's own analysis pending). EPSS exploit-prediction score not yet available (the EPSS model rescores nightly; freshly-published CVEs typically appear within 48 hours). No GitHub Security Advisory CVSS is on record for this CVE.
Memory overflow in SMPP traffic can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler
“—” beside the score: it is equal to the CVSS score beside it.
Score 9.8 from GitHub Security Advisory (severity: CRITICAL) published 2026-11-13. The CNA's CVSS baseline 9.8; sources differ by 0.0.
Rucio: Unauthenticated administrator impersonation through SSH challenge tokens ## Summary SSH challenge tokens are mistakenly accepted as valid credentials during the authentication token validation process. While an SSH challenge token is intended as a short-lived nonce for use in a subsequent SSH key exchange, the function to validate authentication tokens does not differentiate between these and actual authentication tokens. Because challenge tokens are generated based on an account name provided via headers without requiring prior authentication, an unauthenticated attacker can request a valid "challenge" token for any account (including administrative ones) and use it to authenticate against other API endpoints. ## Proof of Concept The vulnerability exists because SSH challenge tokens are stored in the same database table as regular authentication tokens and `validate_auth_token` in `lib/rucio/core/authentication.py` accepts these "challenge" tokens. An attacker can obtain a challenge token for an account such as “root” via the REST API and then present it as a valid authentication bearer token: 1. Request a challenge token for an arbitrary account (e.g., "root"): `curl -i -H "X-Rucio-Account: root" https://rucio/auth/ssh_challenge_token` 2. The server returns a `200 OK` with the header `X-Rucio-SSH-Challenge-Token`. 3. The attacker can then use this specific token within the ten-second challenge lifetime as an authentication credential in subsequent requests to the Rucio API: `curl -H "X-Rucio-Auth-Token: $CHALLENGE_TOKEN" https://rucio/accounts/whoami`
“—” beside the score: it is equal to the CVSS score beside it.
Score 10.0 from GitHub Security Advisory (severity: CRITICAL) published 2026-11-13. A secondary CVSS source baseline 10.0; sources differ by 0.0.
A security flaw has been discovered in Linksys EA8100 1.0.3.216940. The affected element is an unknown function of the file etc/init.d/service_smbd.sh of the component SMB Service. Performing a manipulation of the argument ANON_ACCESS results in improper initialization. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
“—” beside the score: it is equal to the CVSS score beside it.
Score 10.0 from GitHub Security Advisory (severity: CRITICAL) published 2026-11-13. A secondary CVSS source baseline 10.0; sources differ by 0.0.
A vulnerability was determined in Linksys EA8100 1.0.3.216940. This issue affects the function SetRemoteSetting/SetUnsecuredWiFiWarning of the file ui_server.lua of the component JNAP API. This manipulation of the argument isEnabled/enabled causes missing authentication. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
This critical-severity CVE scores 9.3 under a secondary CVSS source (NVD's own analysis pending). EPSS exploit-prediction score not yet available (the EPSS model rescores nightly; freshly-published CVEs typically appear within 48 hours). No GitHub Security Advisory CVSS is on record for this CVE.
Memory overflow in Packet Processing can lead to unpredictable or erroneous behavior or Denial of Service in NetScaler ADC and NetScaler Gateway.
“—” beside the score: it is equal to the CVSS score beside it.
Score 9.1 from GitHub Security Advisory (severity: HIGH) published 2026-11-12. A secondary CVSS source baseline 9.1; sources differ by 0.0.
XWEB EVO 4.3.0 through 5.8.8 contains an unauthenticated arbitrary file write vulnerability that allows remote attackers to modify the system configuration file /etc/xwebconfig.json by sending a crafted POST request to config.lua with action=set, which performs no session validation and writes the raw, unvalidated request body. Attackers can tamper with configuration values such as model and plugin fields or trigger a SYSTEM_NOT_CONFIGURED state via the unauthenticated action=get and action=set operations, resulting in configuration tampering and denial of service. This product line reached it's end of service date in March 2026.
“—” beside the score: it is equal to the CVSS score beside it.
Score 9.6 from GitHub Security Advisory (severity: CRITICAL) published 2026-11-12. A secondary CVSS source baseline 9.6; sources differ by 0.0.
A flaw was found in rubygem-safemode. Compound assignment expressions in sandboxed code are evaluated without mediating method calls through the Jail allow-list. An authenticated attacker who can supply template content can invoke arbitrary no-argument methods on objects exposed to the template renderer without Jail mediation, including destructive operations such as host deletion and disclosure of non-allow-listed object state.
Vendor-Disclosed Advisories — with no CVE ID(3,865 name no CVE ID)
Microsoft, Red Hat, GitHub, and other vendors publish security advisories of their own, and some name no CVE ID, which a feed keyed on CVE IDs cannot list. We track those too — full feed at /pulse/vendor-advisories →
Signal K Server: Buffered logs exposed to unauthenticated WebSocket clients
GitLab Patch Release: 19.5.5, 19.4.7
PAN-SA-2026-0014 Chromium: Monthly Vulnerability Update (November 2026)
Microsoft Security Advisory CVE-2026-105544 - .NET Elevation of Privilege Vulnerability
Team preferences RBAC bypass through the set-home-dash endpoint
Privilege escalation through folder move in the folders API
Path traversal in Git Sync delete and move jobs
Memory exhaustion denial of service in SQL Expressions
Git Sync connections send credentials to unvalidated server URLs
Folder permission bypass in the Git Sync repository files API
Folder authorization bypass in the Git Sync provisioning files API
Cross-instance user impersonation through image renderer JWTs
Tools & resources
Everything in the CVE Pulse, in the form you need it — a quick check, your AI tools, your code, or your inbox.
Check if a product + version has known CVEs — ranked by exploited status.
CVE + Shodan-derived exposure intel inside Claude, Cursor & any MCP client.
Query the feed in code — JSON, NDJSON bulk export, and RSS.
Advisories read from each source's own feed: Microsoft, Red Hat, GitHub & more.
How the EchelonGraph multi-source score is computed.
Per-vendor security activity reports: CVE volume, severity mix, KEV listings and patch velocity.
Every CWE class ranked by live CVE volume — from XSS to memory safety.
10,000+ CVE-affected packages across npm, PyPI, Maven, Go & more.