Free CVE Lookup · Updated Hourly · No Account Needed
CVE Database 2026 — Search Security Vulnerabilities
Search and track 200,000+ publicly disclosed CVEs (Common Vulnerabilities and Exposures) with CVSS severity scores, EPSS exploit probability scores, and CISA Known Exploited Vulnerabilities (KEV) flags. Find any CVE by ID, vendor, product, or keyword — updated every hour from authoritative sources, free with no sign-up.
New to CVEs? Read our guide to CVE, CVSS & EPSS · Actively exploited only? View CISA KEV list →
200,000+
CVEs indexed
Hourly
Updated
1,200+
CISA KEV tracked
Free
Access
BotSharp through 5.2.0 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to forge bearer tokens using the hard-coded Jwt:Key in WebStarter appsettings.json. Attackers can sign tokens with the committed HMAC secret and fixed botsharp issuer and audience to impersonate any known user, including administrators, on Authorize-protected API routes.
Agnaistic agnai through 1.0.555 contains a hard-coded credentials vulnerability in self-host.docker-compose.yml, which sets a fixed admin password and public JWT secret. Unauthenticated attackers can log in as admin or sign their own JWT with admin: true to impersonate users, reset passwords, and change server configuration.
A vulnerability was found in TOZED X300 up to 6.01.3. This vulnerability affects the function process_ping of the component IPPingDiagnostics Handler. The manipulation of the argument Host results in os command injection. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.
The Insurify WordPress plugin through 1.0 does not have authorisation and nonce checks on one of its AJAX actions, allowing unauthenticated users to create and overwrite arbitrary WordPress options with request data, which can take the site offline and deactivate all of its Insurify WordPress plugin through 1.0.
The Quick quotes WordPress plugin through 1.0.0 does not perform any capability or nonce check on one of its AJAX actions and lets the caller choose which option is written, allowing unauthenticated users to alter arbitrary site settings and to make the site unavailable.
The Insurify WordPress plugin through 1.0 does not have authorisation and nonce checks on one of its AJAX actions, allowing unauthenticated users to delete arbitrary WordPress options, which can take the site offline and strip every user of their role.
The click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3. As a result, unauthenticated attackers could change arbitrary blog options, allowing them to create a new administrator account and take over the site.
The click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4. As a result, unauthenticated attackers could change arbitrary blog options, allowing them to create a new administrator account and take over the site.
The Mindstien Quick Login WordPress plugin through 1.0 does not correctly validate a value supplied in the request against the visitor's own session before authenticating them, allowing unauthenticated attackers to obtain a session as the administrator account the Mindstien Quick Login WordPress plugin through 1.0 is configured with.
The Freeton WP WordPress plugin through 1.0.0 does not correctly validate the activation code when authenticating a user, allowing unauthenticated attackers to log in as any user whose email address they know, including administrators.
The AI Content Generator Marketing WordPress plugin through 1.0.0 does not enforce a nonce or capability check on some of its AJAX actions, allowing unauthenticated users to update and delete arbitrary WordPress options, which can be used to gain administrator access to the site.
The Fundiin cho WooCommerce WordPress plugin through 3.4.0 does not have proper authorisation on several of its REST API routes, relying instead on a credential that is identical on every installation, allowing unauthenticated attackers to disclose the store's payment credentials and customer order data, overwrite the payment gateway configuration so that payments are credited elsewhere, and mark unpaid orders as paid. The same missing authorisation also allows arbitrary script to be stored in a field which is output unescaped on the classic checkout, leading to unauthenticated stored XSS on stores that do not use the block-based checkout.
The click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1. As a result, unauthenticated attackers could change arbitrary blog options, allowing them to create a new administrator account and take over the site.
The click5 CRM add-on to WPForms WordPress plugin through 1.0.3 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to WPForms WordPress plugin through 1.0.3. As a result, unauthenticated attackers could change arbitrary blog options, allowing them to create a new administrator account and take over the site.
Data via Shodan CVEDB. Updated hourly. For context on scoring, read Understanding CVE & CVSS.
CISA KEV TrackerAbout the Pentevo CVE Database
What is this CVE database?
Pentevo's CVE database is a free, real-time vulnerability tracker that indexes every CVE published by MITRE and CVE Numbering Authorities (CNAs). Each entry shows the CVSS v3.1 base score, the EPSS exploit probability, and a live CISA KEV flag indicating whether the vulnerability is actively exploited in the wild. No account or API key required — search directly from this page.
How is it different from NVD?
The NIST National Vulnerability Database (NVD) is the authoritative source for CVE data, but it can lag days or weeks on enrichment. Pentevo pulls directly from Shodan CVEDB and updates hourly, meaning new CVEs typically appear within 60 minutes of public disclosure — faster enrichment for security teams that need to act quickly. EPSS scores and CISA KEV flags update in real time as new data is released.
Who uses CVE databases?
Security operations teams use CVE databases to prioritize patching by correlating CVSS severity with EPSS exploit probability. Penetration testers look up CVEs for specific software versions during reconnaissance. Bug bounty hunters cross-reference CVEs against in-scope targets. Compliance teams track KEV status to meet CISA patch-by deadlines and demonstrate due diligence under frameworks like SOC 2 and ISO 27001.
How to use CVSS + EPSS together
CVSS measures theoretical severity — a score of 9.8 means the vulnerability is critically dangerous if exploited. EPSS measures real-world probability of exploitation in the next 30 days. Prioritize CVEs that are both high-CVSS and high-EPSS, or any CVE on the CISA KEV list regardless of CVSS score. A medium-CVSS CVE with 85% EPSS is more urgent than a Critical with 0.1% EPSS.
CVE Database — Frequently Asked Questions
What is a CVE?
CVE stands for Common Vulnerabilities and Exposures — a standardized identifier for publicly known cybersecurity vulnerabilities. Each CVE entry has a unique ID (e.g. CVE-2026-12345), a description of the security flaw, and references to advisories and patches. CVEs are assigned by MITRE and a global network of CVE Numbering Authorities (CNAs) including major vendors like Microsoft, Google, and Red Hat.
What does the CVSS score mean?
CVSS (Common Vulnerability Scoring System) rates vulnerability severity from 0 to 10. Critical (9.0–10) vulnerabilities are the most dangerous and typically allow remote code execution without authentication. High (7.0–8.9) are serious and should be patched quickly. Medium (4.0–6.9) require specific conditions. Low (0.1–3.9) have minimal impact. Most security teams prioritize Critical and High CVEs first.
What is the CISA KEV list?
The CISA Known Exploited Vulnerabilities (KEV) catalog is a list of CVEs that US cybersecurity agency CISA has confirmed are actively exploited by real attackers in the wild. US federal agencies must patch KEV vulnerabilities within 15–25 days. It's the world's most authoritative list of vulnerabilities being actively weaponized — even private organizations use it to prioritize patching.
What is EPSS and how is it different from CVSS?
EPSS (Exploit Prediction Scoring System) predicts the probability a CVE will be exploited in the next 30 days, ranging from 0% to 100%. CVSS measures theoretical severity; EPSS measures real-world exploit likelihood. A CVE can have a medium CVSS score but very high EPSS — meaning attackers are actively exploiting it despite it not being rated "Critical". Using both together gives a much better picture of which vulnerabilities to patch first.
How often is this CVE database updated?
Pentevo's CVE database is refreshed every hour, pulling the latest disclosures from Shodan CVEDB. CISA KEV flags are also updated as soon as new entries are added to the official KEV catalog. This means you typically see new CVEs within 60 minutes of public disclosure.