Free CVE Exploitation Intelligence with EPSS and KEV
Free CVE exploitation intelligence, updated continuously: EPSS exploitation probability, CISA KEV status, CVSS scores, public exploits and PoCs, nuclei templates and affected products, prioritized by real-world exploitation signals.
Top CVEs by exploitation signals (EPSS, KEV)
Data as of .
- CVE-2026-82901 — themefic Ultra Addons for Contact Form 7, published — CVSS 9.8, EPSS 1.1%, public PoC: The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Arbitrary File Upload due to insufficient file type validation in the 'uacf7_wpcf7_mail_components' function in all versions up to, and including…
- CVE-2026-82592 — D-Link DIR-825M, published — CVSS 9.9, EPSS 0.8%, public PoC: A vulnerability was detected in D-Link DIR-825M 1.1.8. This affects the function sub_46725C of the file /boafrm/formDiskFormat of the component Disk Formatting Handler Endpoint. The manipulation of the argument partition…
- CVE-2026-87886 — Acronis Backup plugin for cPanel & WHM, published — CVSS 7.8, EPSS 0.3%, CISA KEV: Local privilege escalation due to insecure file permissions. The following products are affected: Acronis Backup plugin for cPanel & WHM (Linux) before build 1.9.3.1021, Acronis Backup extension for Plesk (Linux) before…
- CVE-2026-18577 — N-able N-central, published — EPSS 1.5%, CISA KEV: An incomplete patch for CVE-2026-18556 allows for authentication bypass and account takeover in N-central Versions through 2026.3.1
- CVE-2026-66012 — siyuan-note siyuan, published — CVSS 10, EPSS 0.4%, public PoC: SiYuan before v3.7.2 contains a missing authorization vulnerability in the POST /mcp kernel endpoint, which is gated only by a general auth check (model.CheckAuth) with no admin-role or read-only enforcement. This…
- CVE-2026-65321 — laughingman7743 PyAthena, published — CVSS 9.8, EPSS 0.4%, public PoC: PyAthena prior to 3.35.4 contains a sql injection vulnerability that allows unauthenticated attackers to inject arbitrary SQL by exploiting improper quote-escaping in DefaultParameterFormatter.format(), which routes…
- CVE-2026-62292 — strukturag libheif, published — EPSS 0.5%, public PoC: libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.1, a crafted uncompressed HEIF image using generic zlib unci full-item compression can crash an application that decodes an advertised…
- CVE-2026-82971 — QVidium Opera11, published — CVSS 10, EPSS 1.9%: A vulnerability was determined in QVidium Opera11 3.3.2a26-Ax4x-opera11. This affects an unknown part of the file /cgi-bin/net_tr.cgi of the component CGI Script. This manipulation of the argument ipaddr causes command…
- CVE-2026-83524 — RedPort Optimizer wXa-203, published — CVSS 9.9, EPSS 1.7%: A security vulnerability has been detected in RedPort Optimizer wXa-203, Optimizer wXa-213 and Optimizer wXa-223 up to 20260704. This impacts the function exec of the file /xgatev1/system/datetime.php of the component…
- CVE-2026-112370 — H3C Magic NX15, published — CVSS 9.9, EPSS 1.7%: A vulnerability was found in H3C Magic NX15 100R017. This issue affects the function sub_416874 of the file /usr/bin/usrlist. Performing a manipulation results in os command injection. Remote exploitation of the attack…
- CVE-2026-86060 — Mikrotik RouterOS, published — EPSS 0.4%, public PoC: RouterOS contains an argument-handling flaw in the SSH login path involving usernames that begin with a prohibited character, allowing for the trusted RouterOS policy mask to be changed, leading to privilege escalation…
- CVE-2026-67277 — Mikrotik RouterOS, published — EPSS 0.4%, public PoC: RouterOS accepts a "related" btest connection before the corresponding primary session has completed authentication. An unauthenticated client can use this state to start an IPv4 UDP test. With "random-data=false", the…
- CVE-2026-67281 — Mikrotik RouterOS, published — EPSS 0.5%, public PoC: RouterOS WebFig contains an unauthenticated file-read vulnerability in the /jsproxy path where a newly allocated session retains a stale uninitialized principal pointer used for file authorization. An unauthenticated…
- CVE-2026-53995 — mlflow, published — CVSS 8.2, EPSS 0.6%, public PoC: MLflow 3.17.1 and earlier contains a path traversal vulnerability in the FileStore tracking backend that allows unauthenticated attackers to control filesystem paths by submitting a crafted trace ID containing traversal…
- CVE-2026-65694 — microweber, published — CVSS 7.5, EPSS 0.8%, public PoC: Microweber CMS through 2.0.20 contains a path traversal vulnerability in the static file controller that allows unauthenticated remote attackers to read arbitrary files by supplying directory traversal sequences in the…
Each CVE links to a full public page. Bulk/API access via the REST API (every account) and the MCP server (Purple); reads that return report content spend TL Creds.
Platform
How the platform works, on threadlinqs.com: platform overview.
Threadlinqs Intelligence — Real-Time Threat Detection Platform
// threat_feed
$ sort --newest
Showing all threats
Live intelligence console
Threat level
