Trending Vulnerabilities Right Now.
Which CVEs researchers, defenders and attackers are talking about on public sources such as GitHub, Reddit and X, scored for buzz and danger. It shows attention and exploitation evidence, not whether you are affected.
- Hot now
- 41with talk in the last 24 h
- Act now
- 5buzz and danger both high
- Public PoC
- 48exploit code is public
- Updated
- 22:4023 Oct 2026 · UTC
Hottest By Window
The single most talked-about vulnerability over each period.
Ranked Now
Every vulnerability with live public discussion. Open one to see where the talk is and what has been posted.
- 1#1Act nowCVE-2026-109618
RCE via OOM corruption
- CVSS 9.2
- CIRCL KEV
- VulnCheck KEV
- Public PoC
Act nowAction89Buzz100Danger7514 days - 2#2Act nowCVE-2026-109619
RCE via stale global state
- CVSS 9.2
- CIRCL KEV
- VulnCheck KEV
- Public PoC
Act nowAction88Buzz100Danger7314 days - 3#3Act nowCVE-2026-114625
VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may…
- CVSS 9.4
- CIRCL KEV
- CISA KEV
- CISA SSVC: active
- ENISA KEV
- +2
Act nowAction79Buzz79Danger8014 days - 4#4Act nowCVE-2026-99999
ipv4: validate checksum_start before completing checksum
- CVSS 8.8
- VulnCheck KEV
- Public PoC
Act nowAction74Buzz78Danger6914 days - 5#5EmergingCVE-2026-111497
Out-of-Bounds Write in Google Brotli Decoder
- CVSS 9.2
- Public PoC
EmergingAction72Buzz99Danger3914 days - 6#6EmergingCVE-2026-110264
An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and…
- CVSS 10.0
- Public PoC
EmergingAction64Buzz83Danger4114 days - 7EmergingAction63Buzz99Danger2014 days
- 8#8Act nowCVE-2026-0257
CVE-2026-0257
- CVSS 7.8
- CIRCL KEV
- CISA KEV
- CISA SSVC: active
- ENISA KEV
- +2
Act nowAction62Buzz42Danger8614 days - 9#9EmergingCVE-2026-91403
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u…
- CVSS 6.8
- Public PoC
EmergingAction59Buzz78Danger3514 days - 10#10Known-badCVE-2026-104935
Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior.
- CVSS 8.6
- CIRCL KEV
- CISA KEV
- CISA SSVC: active
- ENISA KEV
- +2
Known-badAction51Buzz22Danger8714 days - 11#11Known-badCVE-2025-64446
CVE-2025-64446
- CVSS 9.8
- CIRCL KEV
- CISA KEV
- CISA SSVC: active
- ENISA KEV
- +3
Known-badAction51Buzz20Danger8914 days - 12#12Known-badCVE-2026-106173
A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSIEM 7.5.0 may allow attacker to execute unauthorized code or commands via specially cr…
- CVSS 9.4
- VulnCheck KEV
- Public PoC
Known-badAction50Buzz34Danger7014 days - 13#13Known-badCVE-2025-55182
React Server Components are Vulnerable to RCE
- CVSS 10.0
- CIRCL KEV
- CISA KEV
- CISA SSVC: active
- ENISA KEV
- +3
Known-badAction50Buzz17Danger9014 days - 14#14Known-badCVE-2024-4577
In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" b…
- CVSS 9.8
- CIRCL KEV
- CISA KEV
- CISA SSVC: active
- ENISA KEV
- +3
Known-badAction49Buzz15Danger9014 days - 15#15Known-badCVE-2026-63030
WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), cou…
- CVSS 7.5
- CIRCL KEV
- CISA KEV
- CISA SSVC: active
- ENISA KEV
- +3
Known-badAction47Buzz27Danger7214 days - 16#16Known-badCVE-2026-110447
Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerabi…
- CVSS 9.2
- CIRCL KEV
- CISA KEV
- CISA SSVC: active
- VulnCheck KEV
- +1
Known-badAction47Buzz20Danger8014 days - 17#17Known-badCVE-2026-102764
Improper Origin Validation in Internal Messaging Components of BeyondTrust Remote Support
- CVSS 9.3
- CIRCL KEV
- CISA KEV
- CISA SSVC: active
- ENISA KEV
- +2
Known-badAction45Buzz16Danger8114 days - 18#18EmergingCVE-2026-111943
golang: crypto/x509: Go: crypto/x509: mitigation for security concerns with a specific Certificate Authority
- CVSS 6.8
- Public PoC
EmergingAction44Buzz52Danger3514 days - 19#19Known-badCVE-2026-31431
Linux kernel (Intel IoTG Real-time) vulnerabilities
- CVSS 7.8
- CIRCL KEV
- CISA KEV
- CISA SSVC: active
- ENISA KEV
- +3
Known-badAction44Buzz23Danger7014 days - 20#20Known-badCVE-2026-110936
A vulnerability has been identified in Siemens Software Center (All versions). The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. This could allow an authe…
- CVSS 8.4
- CIRCL KEV
- CISA KEV
- CISA SSVC: active
- ENISA KEV
- +2
Known-badAction43Buzz15Danger7814 days - 21#21Known-badCVE-2026-96951
Improper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.
- CVSS 8.8
- CIRCL KEV
- CISA KEV
- CISA SSVC: active
- ENISA KEV
- +3
Known-badAction43Buzz13Danger8014 days - 22#22Known-badCVE-2026-60137
WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme pa…
- CVSS 9.1
- CIRCL KEV
- CISA KEV
- CISA SSVC: active
- ENISA KEV
- +3
Known-badAction41Buzz14Danger7314 days - 23#23Known-badCVE-2026-88771
A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands
- CVSS 9.5
- CIRCL KEV
- CISA KEV
- CISA SSVC: active
- ENISA KEV
- +3
Known-badAction41Buzz14Danger7314 days - 24#24Known-badCVE-2026-96654
Plex Media Server URL injection
- CVSS 6.9
- CIRCL KEV
- CISA KEV
- CISA SSVC: active
- ENISA KEV
- +2
Known-badAction41Buzz14Danger7514 days - 25#25Known-badCVE-2025-61624
An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions…
- CVSS 6.5
- CIRCL KEV
- CISA KEV
- CISA SSVC: active
- ENISA KEV
- +2
Known-badAction39Buzz10Danger7514 days - 26#26Known-badCVE-2026-76504
Cisco Catalyst SD-WAN Manager System Account Authorization Bypass Vulnerability
- CVSS 9.8
- CIRCL KEV
- CISA KEV
- CISA SSVC: active
- ENISA KEV
- +2
Known-badAction38Buzz10Danger7314 days - 27#27Known-badCVE-2025-7771
ThrottleStop.sys, a legitimate driver, exposes two IOCTL interfaces that allow arbitrary read and write access to physical memory via the MmMapIoSpace function. This insecure implementation can be ex…
- CVSS 8.7
- VulnCheck KEV
- Public PoC
Known-badAction37Buzz16Danger6314 days - 28#28Known-badCVE-2026-81963
Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate privileges locally.
- CVSS 7.8
- CIRCL KEV
- CISA KEV
- CISA SSVC: active
- ENISA KEV
- +3
Known-badAction37Buzz13Danger6714 days - 29#29Known-badCVE-2026-86950
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.1 and iPadOS 26.7.1, macOS Sequoia 15.8.1, macOS Tahoe 26.7.1. Processing a maliciously craft…
- CVSS 8.8
- CIRCL KEV
- CISA KEV
- CISA SSVC: active
- ENISA KEV
- +2
Known-badAction37Buzz10Danger7014 days - 30#30LowCVE-2026-112900
Pillow is a Python imaging library. From 2.6.0 until 13.0.0, Pillow is vulnerable to argument injection when invoking Ghostscript for EPS input. EpsImagePlugin.Ghostscript passes a caller-controlled…
- CVSS 9.2
- Public PoC
LowAction34Buzz30Danger3914 days - 31#31LowCVE-2026-43499
kernel: rtmutex: Use waiter::task instead of current in remove_waiter()
- CVSS 8.5
- Public PoC
LowAction31Buzz25Danger3914 days - 32#32LowCVE-2026-86478
In JetBrains YouTrack before 2025.3.161254, 2026.1.14042 improper authentication in YouTrack Helpdesk allowed unauthenticated account takeover via a self-asserted email address
- CVSS 9.8
- Public PoC
LowAction31Buzz22Danger4214 days - 33#33LowCVE-2026-94300
Replaying GSS-TSIG signed UDP messages can result in memory corruption in "`named`". An attacker who can capture a previously signed UDP message can replay it while the negotiated TSIG key is still v…
- CVSS 8.1
- Public PoC
LowAction30Buzz23Danger3814 days - 34#34LowCVE-2026-98260
exec: Cleanup POSIX timers right after de_thread()
- CVSS 7.8
- Public PoC
LowAction29Buzz23Danger3714 days - 35#35LowCVE-2026-108551
openapi-typescript-codegen through 0.31.0 Code Injection via Handlebars Templates
- CVSS 9.3
- Public PoC
LowAction28Buzz18Danger4014 days - 36LowAction26Buzz16Danger3914 days
- 37#37LowCVE-2026-76268
Missing Authentication for Critical Function in the Patroni REST API in Splunk Enterprise
- CVSS 9.8
- Public PoC
LowAction26Buzz12Danger4314 days - 38#38LowCVE-2026-109715
Incorrect boundary conditions in the JavaScript Engine component
- CVSS 8.1
- Public PoC
LowAction24Buzz13Danger3714 days - 39#39LowCVE-2026-112403
Pillow is a Python imaging library. Prior to 13.0.0, Pillow's JPEG decoder can write a full-width scanline into a buffer sized for a requested draft scale. ImagingJpegDecode does not verify libjpeg's…
- CVSS 9.2
- Public PoC
LowAction24Buzz12Danger3914 days - 40#40LowCVE-2026-113380
In the RingRTC library before 2.72.0 for Signal, a peer that saturates a call's FSM queue can interfere with the ability of a local hangup to tear the call (with its audio and perhaps also video trac…
- CVSS 9.3
LowAction23Buzz25Danger2014 days - 41#41LowCVE-2026-19630
In a BIND resolver, inbound DNS protocol messages with a particular structure will result in additional processing, with no limit imposed by BIND. A DNS message with a maliciously large number of suc…
- CVSS 7.5
LowAction13Buzz11Danger1614 days
- GitHub
- X
- Dark web (count only)
- CVE-2026-109618926
- CVE-2026-109619686
- CVE-2026-11462540
- CVE-2026-99999170
- CVE-2026-11149775
- CVE-2026-11026433
- CVE-2026-11556078
- CVE-2026-025717
How To Read The Scores
- Buzz
- How many distinct people and outlets discuss the vulnerability now, weighted toward recent posts. 40 or more means it is being talked about. A storm saturates near 100, so compare voices when two rows both read 100.
- Danger
- How exploitable it looks: CISA KEV or other exploitation catalogues, weaponised exploits, public proof-of-concept code, EPSS and CVSS. 60 or more is dangerous.
- Action
- The default order: 55% buzz and 45% danger. A high action score means it is worth a look today, not that you are affected.
- Act now
- Much discussed and dangerous: the talk is backed by exploitation evidence or a weaponised exploit.
- Emerging
- Talk is running ahead of exploitation evidence. Not the same list as Emerging threats in Vulnerability Intelligence, which is about exploit probability.
- Known-bad
- Exploitable, but little current talk. Often already known.
- Low
- Little discussion and no strong danger signal.
Scores measure public attention and exploitation evidence, not whether your systems are exposed. The ranking refreshes hourly from public sources. Dark-web activity is counted but never quoted.
Stay Ahead
Get the trending brief in your inbox.
- A daily brief every morning (06:00 UTC) with the ten vulnerabilities trending most.
- An instant alert only when a critical (CVSS 9+) vulnerability starts trending, up to three a day.
- Work email only. Free webmail addresses are not accepted.
- We send a confirm link first. Nothing arrives until you click it.