🔥 Top Trending S1 CVEsCritical Priority
Actively exploited vulnerabilities trending in threat feeds
SonicWall SonicOS SSLVPN contains a use of single-factor authentication vulnerability that may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls. Successful exploitation may also bypass SAML-enforced multi-factor authentication (MFA).
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux.
CVE-2026-119977 is a reserved CVE identifier. While it is referenced in security-related changelogs for the Xwayland package, no public information regarding the nature, impact, or technical details of the vulnerability is currently available.
An access bypass vulnerability in the Drupal Commerce Core module allows remote, unauthenticated attackers to access and modify restricted entity fields and routes, potentially leading to financial impact.
A high-severity out-of-bounds write vulnerability exists in the Brotli decoder bundled with Node.js. An attacker can exploit this flaw by providing malformed Brotli-compressed data, potentially leading to remote code execution within the Node.js process.
A critical SQL injection vulnerability in Arista VeloCloud Orchestrator (VCO) On-Prem deployments allows authenticated attackers with basic privileges to escalate their privileges and potentially compromise the system.
Latest Emerging CVEs
Real-time vulnerability intelligence from multiple sources
Log in to view the latest CVEs
Access real-time vulnerability intelligence and prioritized risk scoring
Recently Updated CVEs
Vulnerabilities with recent updates or new threat intelligence
Log in to view the latest CVEs
Access real-time vulnerability intelligence and prioritized risk scoring
How It Works
From raw data feeds to actionable intelligence in seconds
Why Security Teams Choose CVEScope
Consolidated intelligence from trusted sources, delivered in a format that accelerates your response.
Emerging Detection
Detect new CVE IDs shortly after first public mention across 100+ monitored sources (including NVD, CIRCL, vendor advisories, and curated RSS feeds).
Exploit Awareness
Flag CVEs listed in CISA's Known Exploited Vulnerabilities (KEV) catalogue to highlight known exploited risk.
Operational Severity
An environment-agnostic severity rating that blends CVSS impact, EPSS likelihood, trend momentum, and KEV status to indicate urgency.
References & Freshness
See attributable reference links and 'first seen / last seen' timestamps. Some inputs are grouped as aggregated signals.
Auto Normalisation
Deduplicates and correlates CVEs across overlapping sources so each issue appears once.
Integration Access
Programmatic access is available for approved workflows (bulk CSV export isn't enabled by default).