Vulnerability Intelligence · All CVEs
Every Published CVE, Searchable.
Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status.
Synced hourly · figures as of Oct 20, 2026
126,401 vulnerabilities · newest first
- CVE-2026-73260High 7.5Prior to 7.23, the built-in TLS certificate parser selected by MG_TLS_BUILTIN fails to verify that a long-form DER element length fits within the remaining certificate buffer.Published Oct 14, 2026
- CVE-2026-73252High 7.5Prior to 7.23, the built-in TLS stack selected by MG_TLS_BUILTIN in src/tls_builtin.c accepts a TLS 1.3 record whose decrypted size is exactly the 16-byte authentication tag with no…Published Oct 14, 2026
- CVE-2026-63626High 8.8Prior to 7.23, ppp_handle_ipv6cp() in src/l2_ppp.c trusts the 16-bit IPv6CP len field without checking it against the received payload size.Published Oct 14, 2026
- CVE-2026-54525High 8.8Prior to 0.8.28, Markdown Preview Enhanced preview-link handling passes a decoded, Markdown-controlled link target to a Windows file-opening helper that…Published Oct 14, 2026
- CVE-2026-110775High 7.1Nexent through 2.7.0 contains a missing authorization vulnerability in check_file_access that allows authenticated users to read other tenants' knowledge-base files by skipping tenant comparison for knowledge_base/ reads.Published Oct 14, 2026
- CVE-2026-110769High 8.3holaOS through 2026.822.1 contains a missing authorization vulnerability in channel-gateway connectors that allows any messaging-platform user to submit agent tasks because the #isAllowed check accepts all senders when the default…Published Oct 14, 2026
- CVE-2026-110767High 8.7Gitingest through 0.3.1 contains a symlink following vulnerability in ingest_query single-file blob ingestion that allows unauthenticated attackers to read server files by submitting symlink blob URLs.Published Oct 14, 2026
- CVE-2026-110765High 8.2FlexPrice through 2.1.38 contains an authentication bypass vulnerability in HandleQuickBooksWebhook that skips signature verification when the intuit-signature header is omitted.Published Oct 14, 2026
- CVE-2026-110761High 8.7ILIAS before 9.24, 10.12, and 11.5 contains a PHP object injection vulnerability that allows authenticated users with Test creation or import permission to deserialize arbitrary objects via crafted Test archives.Published Oct 14, 2026
- CVE-2026-104143High 8.7Prior to 2.10.26, authenticated users can store a crafted custom dateFormat for a dataset field.Published Oct 14, 2026
- CVE-2026-104142High 8.7Prior to 2.10.26, authenticated users can store crafted FieldGroupDTO.min, FieldGroupDTO.max, FieldGroupDTO.startTime, or FieldGroupDTO.endTime values in dataset group-field…Published Oct 14, 2026
- CVE-2026-104141High 8.7Authenticated users with datasource access can supply crafted schema names, connection usernames, table names, or database names to datasource metadata operations, including…Published Oct 14, 2026
- CVE-2026-102944High 7.5Prior to 0.51.0, create_redirect_client() removes Host, Proxy-Authorization, and Authorization headers when following a cross-origin 301, 302, 307, or 308 redirect but leaves Cookie…Published Oct 14, 2026
- CVE-2026-102899High 7.6From 26.5.0 until 26.7.2, the SAML SSO identity-linking flow allows an attacker who controls a SAML identity provider to socially engineer an authenticated user into opening…Published Oct 14, 2026
- CVE-2026-102479High 8.7In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x HTTP/1.x decoder uses a canonicalization for well known HTTP headers, the canonicalization process interprets well crafted headers as headers of this…Published Oct 14, 2026
- CVE-2026-102460High 8.6In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], a scope bypass vulnerability exists in Eclipse Vert.x Web's ChainAuthHandler when used with scope-requiring authentication handlers such as…Published Oct 14, 2026
- CVE-2026-100406High 8.2dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications.Published Oct 14, 2026
- CVE-2026-54702High 7.3Prior to 0.8.30, the webview message handler in src/preview-provider.ts accepts an attacker-controlled command value and attacker-controlled args,…Published Oct 14, 2026
- CVE-2026-54566High 8.5Prior to 0.8.29, Markdown Preview Enhanced evaluates repository-controlled .crossnote/config.js and .crossnote/parser.js files with vm.runInNewContext,…Published Oct 14, 2026
- CVE-2026-92158High 7.2Prior to 4.2.0, Svc::FpySequencer STORE directive stack write validation the bounds check adds…Published Oct 14, 2026
- CVE-2026-92155High 7.5Prior to 4.2.0, Fw::FilePacket deserialization used by Svc::FileUplink is vulnerable because Header…Published Oct 14, 2026
- CVE-2026-92154High 8.1Prior to 4.2.0, Svc::FileUplink handleDataPacket offset and size validation is vulnerable because the component…Published Oct 14, 2026
- CVE-2026-92150High 7.5Prior to 4.2.0, Svc::GenericHub fromBufferDriver_handler deserialization is vulnerable because the receive…Published Oct 14, 2026
- CVE-2026-86848High 8.8The indirect-descriptor snapshot double-fetches a guest descriptor next index, allowing a malicious guest to cause an out-of-bounds access in the host backend.Published Oct 14, 2026
- CVE-2026-86567High 8.8The VDUSE handler fails to invalidate vring pointers when the IOTLB is invalidated, leading to use-after-unmap.Published Oct 14, 2026
- CVE-2026-79957High 8.1ServiceNext contains an insecure direct object reference (IDOR) in the /api/Usuario/GetUsuarios endpoint, which accepts a user-controlled numeric ID in the request body without verifying that the authenticated token belongs to the…Published Oct 14, 2026
- CVE-2026-54554High 7.5Prior to 1.5.10.1870, the management adInfo() endpoint in packages/web/lib/fog/fogpage.class.php was reported to return the FOG_AD_DEFAULT_PASSWORD value…Published Oct 14, 2026
- CVE-2026-42093High 8.7From versions after 8.0.0 until 26.9.0, the Query Results query runner in redash/query_runner/query_results.py accepts param_query_N_{key=value} parameters and passed…Published Oct 14, 2026
- CVE-2026-109527High 7.5In mcp versions before 1.29.1 and from 2.0.0a1 through 2.0.1, the Streamable HTTP session manager, SSE message endpoint, and…Published Oct 14, 2026
- CVE-2026-108484High 7.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPManageNinja Best Payments Plugin for WP wp-payment-form allows Stored XSS.This issue affects Best Payments Plugin for WP: from n/a…Published Oct 14, 2026
- CVE-2026-108483High 7.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hippooo Hippoo Mobile App for WooCommerce hippoo allows Reflected XSS.This issue affects Hippoo Mobile App for WooCommerce: from n/a…Published Oct 14, 2026
- CVE-2026-108480High 8.2Missing Authorization vulnerability in Skydropx Skydropx skydropx allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Skydropx: from n/a through 2.1.4.Published Oct 14, 2026
- CVE-2026-108395High 7.5From version 0.8.0 through 0.12.0 in the io.modelcontextprotocol.sdk:mcp artifact, from 0.13.0 through 0.18.3 and 1.0.0 through…Published Oct 14, 2026
- CVE-2026-107350High 8.8Improper authentication in PgBouncer 1.17.0 through 1.26.0 allows a remote attacker who knows the password of a user listed in auth_file to log in as any other user that authenticates using SCRAM, including PgBouncer admin users and…Published Oct 14, 2026
- CVE-2026-107349High 7.5An infinite loop in PgBouncer 1.20.0 through 1.26.0 allows an unauthenticated remote attacker to cause a denial of service.Published Oct 14, 2026
- CVE-2026-106465High 8.7The NetX Secure DTLS server sends a HelloVerifyRequest carrying a freshly generated cookie, but never checks the cookie a client returns.Published Oct 14, 2026
- CVE-2026-106464High 8.7_nx_secure_x509_parse_signature_data computes the certificate signature's length as tlv_length - 1 without first checking that tlv_length is non-zero.Published Oct 14, 2026
- CVE-2026-105066High 7.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SimplyRETS SimplyRETS Real Estate IDX simply-rets allows Reflected XSS.This issue affects SimplyRETS Real Estate IDX: from n/a through…Published Oct 14, 2026
- CVE-2026-104103High 8.1Prior to 0.17.8, ludwig.datasets.archives.extract_archive() validated tar member names before calling TarFile.extractall() but did not validate…Published Oct 14, 2026
- CVE-2026-103414High 8.4The GUIX binary resource (theme) loader sizes its arena and populates it in two separate passes that traverse the resource file with independent cursor arithmetic.Published Oct 14, 2026
- CVE-2026-103081High 7.5Improper Control of Generation of Code ('Code Injection') vulnerability in VillaTheme Salevo woo-boost-sales allows Code Injection.This issue affects Salevo: from n/a through 1.3.0.Published Oct 14, 2026
- CVE-2026-102077High 8.7An Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on MX Series with SPC3 allows an unauthenticated, network-based attacker to cause a Denial-of-Service…Published Oct 14, 2026
- CVE-2026-101981High 8.7A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent LDP peer to cause an rpd crash or execute arbitrary code via a malformed…Published Oct 14, 2026
- CVE-2026-101979High 8.7A Stack-based Buffer Overflow vulnerability in the authd Juniper Networks Junos OS and Junos OS Evolved allows a network attacker with SNMP read access to execute code with root privileges or cause a denial of service via a specific SNMP…Published Oct 14, 2026
- CVE-2026-101976High 8.7An Out-of-bounds Write vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an eBGP peer which has not negotiated four-octet-AS capability sending a specifically malformed BGP update…Published Oct 14, 2026
- CVE-2026-101975High 7.1A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent OSPF peer to cause a denial of service via OSPF traffic processed while OSPF Source Packet…Published Oct 14, 2026
- CVE-2026-101972High 7.1An Integer Overflow or Wraparound vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of service via specific OSPFv2 packets…Published Oct 14, 2026
- CVE-2026-101964High 7.1A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to cause an rpd crash via a crafted LDP packet received over an established LDP session.Published Oct 14, 2026
- CVE-2026-101963High 8.7An Incorrect Calculation vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos EVO allows a remote BGP EVPN neighbor to cause an rpd crash when SRv6 EVPN multihoming is configured.Published Oct 14, 2026
- CVE-2026-101962High 8.7An Improper Handling of Length Parameter Inconsistency vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker sending a specifically malformed BGP EVPN multicast update…Published Oct 14, 2026
| CVE | Title | Severity | Published |
|---|---|---|---|
| CVE-2026-73260 | Prior to 7.23, the built-in TLS certificate parser selected by MG_TLS_BUILTIN fails to verify that a long-form DER element length fits within the remaining certificate buffer. | High 7.5 | |
| CVE-2026-73252 | Prior to 7.23, the built-in TLS stack selected by MG_TLS_BUILTIN in src/tls_builtin.c accepts a TLS 1.3 record whose decrypted size is exactly the 16-byte authentication tag with no… | High 7.5 | |
| CVE-2026-63626 | Prior to 7.23, ppp_handle_ipv6cp() in src/l2_ppp.c trusts the 16-bit IPv6CP len field without checking it against the received payload size. | High 8.8 | |
| CVE-2026-54525 | Prior to 0.8.28, Markdown Preview Enhanced preview-link handling passes a decoded, Markdown-controlled link target to a Windows file-opening helper that… | High 8.8 | |
| CVE-2026-110775 | Nexent through 2.7.0 contains a missing authorization vulnerability in check_file_access that allows authenticated users to read other tenants' knowledge-base files by skipping tenant comparison for knowledge_base/ reads. | High 7.1 | |
| CVE-2026-110769 | holaOS through 2026.822.1 contains a missing authorization vulnerability in channel-gateway connectors that allows any messaging-platform user to submit agent tasks because the #isAllowed check accepts all senders when the default… | High 8.3 | |
| CVE-2026-110767 | Gitingest through 0.3.1 contains a symlink following vulnerability in ingest_query single-file blob ingestion that allows unauthenticated attackers to read server files by submitting symlink blob URLs. | High 8.7 | |
| CVE-2026-110765 | FlexPrice through 2.1.38 contains an authentication bypass vulnerability in HandleQuickBooksWebhook that skips signature verification when the intuit-signature header is omitted. | High 8.2 | |
| CVE-2026-110761 | ILIAS before 9.24, 10.12, and 11.5 contains a PHP object injection vulnerability that allows authenticated users with Test creation or import permission to deserialize arbitrary objects via crafted Test archives. | High 8.7 | |
| CVE-2026-104143 | Prior to 2.10.26, authenticated users can store a crafted custom dateFormat for a dataset field. | High 8.7 | |
| CVE-2026-104142 | Prior to 2.10.26, authenticated users can store crafted FieldGroupDTO.min, FieldGroupDTO.max, FieldGroupDTO.startTime, or FieldGroupDTO.endTime values in dataset group-field… | High 8.7 | |
| CVE-2026-104141 | Authenticated users with datasource access can supply crafted schema names, connection usernames, table names, or database names to datasource metadata operations, including… | High 8.7 | |
| CVE-2026-102944 | Prior to 0.51.0, create_redirect_client() removes Host, Proxy-Authorization, and Authorization headers when following a cross-origin 301, 302, 307, or 308 redirect but leaves Cookie… | High 7.5 | |
| CVE-2026-102899 | From 26.5.0 until 26.7.2, the SAML SSO identity-linking flow allows an attacker who controls a SAML identity provider to socially engineer an authenticated user into opening… | High 7.6 | |
| CVE-2026-102479 | In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x HTTP/1.x decoder uses a canonicalization for well known HTTP headers, the canonicalization process interprets well crafted headers as headers of this… | High 8.7 | |
| CVE-2026-102460 | In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], a scope bypass vulnerability exists in Eclipse Vert.x Web's ChainAuthHandler when used with scope-requiring authentication handlers such as… | High 8.6 | |
| CVE-2026-100406 | dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. | High 8.2 | |
| CVE-2026-54702 | Prior to 0.8.30, the webview message handler in src/preview-provider.ts accepts an attacker-controlled command value and attacker-controlled args,… | High 7.3 | |
| CVE-2026-54566 | Prior to 0.8.29, Markdown Preview Enhanced evaluates repository-controlled .crossnote/config.js and .crossnote/parser.js files with vm.runInNewContext,… | High 8.5 | |
| CVE-2026-92158 | Prior to 4.2.0, Svc::FpySequencer STORE directive stack write validation the bounds check adds… | High 7.2 | |
| CVE-2026-92155 | Prior to 4.2.0, Fw::FilePacket deserialization used by Svc::FileUplink is vulnerable because Header… | High 7.5 | |
| CVE-2026-92154 | Prior to 4.2.0, Svc::FileUplink handleDataPacket offset and size validation is vulnerable because the component… | High 8.1 | |
| CVE-2026-92150 | Prior to 4.2.0, Svc::GenericHub fromBufferDriver_handler deserialization is vulnerable because the receive… | High 7.5 | |
| CVE-2026-86848 | The indirect-descriptor snapshot double-fetches a guest descriptor next index, allowing a malicious guest to cause an out-of-bounds access in the host backend. | High 8.8 | |
| CVE-2026-86567 | The VDUSE handler fails to invalidate vring pointers when the IOTLB is invalidated, leading to use-after-unmap. | High 8.8 | |
| CVE-2026-79957 | ServiceNext contains an insecure direct object reference (IDOR) in the /api/Usuario/GetUsuarios endpoint, which accepts a user-controlled numeric ID in the request body without verifying that the authenticated token belongs to the… | High 8.1 | |
| CVE-2026-54554 | Prior to 1.5.10.1870, the management adInfo() endpoint in packages/web/lib/fog/fogpage.class.php was reported to return the FOG_AD_DEFAULT_PASSWORD value… | High 7.5 | |
| CVE-2026-42093 | From versions after 8.0.0 until 26.9.0, the Query Results query runner in redash/query_runner/query_results.py accepts param_query_N_{key=value} parameters and passed… | High 8.7 | |
| CVE-2026-109527 | In mcp versions before 1.29.1 and from 2.0.0a1 through 2.0.1, the Streamable HTTP session manager, SSE message endpoint, and… | High 7.5 | |
| CVE-2026-108484 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPManageNinja Best Payments Plugin for WP wp-payment-form allows Stored XSS.This issue affects Best Payments Plugin for WP: from n/a… | High 7.1 | |
| CVE-2026-108483 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hippooo Hippoo Mobile App for WooCommerce hippoo allows Reflected XSS.This issue affects Hippoo Mobile App for WooCommerce: from n/a… | High 7.1 | |
| CVE-2026-108480 | Missing Authorization vulnerability in Skydropx Skydropx skydropx allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Skydropx: from n/a through 2.1.4. | High 8.2 | |
| CVE-2026-108395 | From version 0.8.0 through 0.12.0 in the io.modelcontextprotocol.sdk:mcp artifact, from 0.13.0 through 0.18.3 and 1.0.0 through… | High 7.5 | |
| CVE-2026-107350 | Improper authentication in PgBouncer 1.17.0 through 1.26.0 allows a remote attacker who knows the password of a user listed in auth_file to log in as any other user that authenticates using SCRAM, including PgBouncer admin users and… | High 8.8 | |
| CVE-2026-107349 | An infinite loop in PgBouncer 1.20.0 through 1.26.0 allows an unauthenticated remote attacker to cause a denial of service. | High 7.5 | |
| CVE-2026-106465 | The NetX Secure DTLS server sends a HelloVerifyRequest carrying a freshly generated cookie, but never checks the cookie a client returns. | High 8.7 | |
| CVE-2026-106464 | _nx_secure_x509_parse_signature_data computes the certificate signature's length as tlv_length - 1 without first checking that tlv_length is non-zero. | High 8.7 | |
| CVE-2026-105066 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SimplyRETS SimplyRETS Real Estate IDX simply-rets allows Reflected XSS.This issue affects SimplyRETS Real Estate IDX: from n/a through… | High 7.1 | |
| CVE-2026-104103 | Prior to 0.17.8, ludwig.datasets.archives.extract_archive() validated tar member names before calling TarFile.extractall() but did not validate… | High 8.1 | |
| CVE-2026-103414 | The GUIX binary resource (theme) loader sizes its arena and populates it in two separate passes that traverse the resource file with independent cursor arithmetic. | High 8.4 | |
| CVE-2026-103081 | Improper Control of Generation of Code ('Code Injection') vulnerability in VillaTheme Salevo woo-boost-sales allows Code Injection.This issue affects Salevo: from n/a through 1.3.0. | High 7.5 | |
| CVE-2026-102077 | An Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on MX Series with SPC3 allows an unauthenticated, network-based attacker to cause a Denial-of-Service… | High 8.7 | |
| CVE-2026-101981 | A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent LDP peer to cause an rpd crash or execute arbitrary code via a malformed… | High 8.7 | |
| CVE-2026-101979 | A Stack-based Buffer Overflow vulnerability in the authd Juniper Networks Junos OS and Junos OS Evolved allows a network attacker with SNMP read access to execute code with root privileges or cause a denial of service via a specific SNMP… | High 8.7 | |
| CVE-2026-101976 | An Out-of-bounds Write vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an eBGP peer which has not negotiated four-octet-AS capability sending a specifically malformed BGP update… | High 8.7 | |
| CVE-2026-101975 | A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent OSPF peer to cause a denial of service via OSPF traffic processed while OSPF Source Packet… | High 7.1 | |
| CVE-2026-101972 | An Integer Overflow or Wraparound vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a denial of service via specific OSPFv2 packets… | High 7.1 | |
| CVE-2026-101964 | A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to cause an rpd crash via a crafted LDP packet received over an established LDP session. | High 7.1 | |
| CVE-2026-101963 | An Incorrect Calculation vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos EVO allows a remote BGP EVPN neighbor to cause an rpd crash when SRv6 EVPN multihoming is configured. | High 8.7 | |
| CVE-2026-101962 | An Improper Handling of Length Parameter Inconsistency vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker sending a specifically malformed BGP EVPN multicast update… | High 8.7 |
Showing 651–700 of 126,401. Narrow the filters to see the rest.
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status. Filter by severity and year here; the other filters work on the curated lists.