public radar

Prioritized Vulnerability Signals for Defenders

Track CVE, KEV, EPSS, and vendor-advisory changes in one read-only radar—so teams can see what changed, why it matters, and what to verify next.

indexable public surfaceread-only datasetpublic-safe sourcesexternal execution disabledauto remediation disabled

New CVEs20current public dataset

Critical4canonical CVSS

Known Exploited0KEV observed

High EPSS percentile (≥70)7EPSS percentile observed

Monitored Vendors17from current data

Live Vulnerability Feed READ-ONLY

View all signals →

2026-07-08

defensive priority signal

CRITICALEPSS 0.1366 (96)NEWvmware / aceNVD: Heap-based buffer overflow in the NAT networking components vmnat.exe and vmnet-natd in VMWare Workstation 5.5, GSX Server 3.2, ACE 1… Handoff

2026-07-08

defensive priority signal

CRITICALEPSS 0.0810 (94)NEWzohocorp / manageengine_adselfservice_plusNVD: The custom GINA/CP module in Zoho ManageEngine ADSelfService Plus before 5.5 build 5517 allows remote attackers to execute code and es… Handoff

2026-07-08

defensive priority signal

CRITICALEPSS 0.0303 (86)NEWcrmeb / crmebNVD: A SSRF vulnerability exists in the downloadimage interface of CRMEB 3.0, which can remotely download arbitrary files on the server and… Handoff

2026-07-08

defensive priority signal

CRITICALEPSS 0.0277 (85)NEWdaily_tracker_system_project / daily_tracker_systemNVD: A SQL injection vulnerability in login in Sourcecodetester Daily Tracker System 1.0 allows unauthenticated user to execute authenticat… Handoff

2026-07-08

defensive priority signal

HIGHEPSS 0.0268 (84)NEWanixis / password_reset_clientNVD: The custom GINA/CP module in ANIXIS Password Reset Client before version 3.22 allows remote attackers to execute code and escalate pri… Handoff

2026-07-08

defensive priority signal

HIGHEPSS 0.0060 (44)NEWspiceworks / spiceworksNVD: Spiceworks Version <= 7.5.00107 is affected by CSRF which can lead to privilege escalation via "/settings/v1/users" function. Handoff

2026-07-08

defensive priority signal

HIGHEPSS 0.0063 (46)NEWsimple_library_management_system_project / simple_library_management_systemNVD: Sourcecodester Simple Library Management System 1.0 is affected by Incorrect Access Control via the Login Panel, Handoff

2026-07-08

defensive priority signal

HIGHEPSS 0.0089 (55)NEWilex / international_sign\&goNVD: Ilex International Sign&go Workstation Security Suite 7.1 allows elevation of privileges via a symlink attack on ProgramData\Ilex\S&G\… Handoff

2026-07-08

defensive priority signal

HIGHEPSS 0.0055 (42)NEWphpgurukul / zoo_management_systemNVD: PHPGURUKUL Zoo Management System Using PHP and MySQL version 1.0 is affected by: SQL Injection via zms/animal-detail.php. Handoff

2026-07-08

defensive priority signal

HIGHEPSS 0.0054 (42)NEWsimple_library_management_system_project / simple_library_management_systemNVD: Sourcecodester Simple Library Management System 1.0 is affected by Insecure Permissions via Books > New Book , Handoff

2026-07-08

defensive priority signal

HIGHEPSS 0.0052 (41)NEWdebian / debian_linuxNVD: It was found that the raw midi kernel driver does not protect against concurrent access which leads to a double realloc (double free)… Handoff

2026-07-08

defensive priority signal

HIGHEPSS 0.0201 (79)NEWsnap7_project / snap7NVD: The Snap7 server component in version 1.4.1, when an attacker sends a crafted packet with COTP protocol the last-data-unit flag set to… Handoff

2026-07-08

defensive priority signal

MEDIUMEPSS 0.0100 (58)NEWsagemcom / f\@st_3686_firmwareNVD: Sagemcom F@ST3686 v1.0 HUN 3.97.0 has XSS via RgDiagnostics.asp, RgDdns.asp, RgFirewallEL.asp, RgVpnL2tpPptp.asp. Handoff

2026-07-08

defensive priority signal

MEDIUMEPSS 0.0086 (54)NEWgazie_project / gazieNVD: Gazie 7.29 is affected by: Cross Site Scripting (XSS) via An attacker can inject JavaScript code, and the webapplication stores the in… Handoff

2026-07-08

defensive priority signal

MEDIUMEPSS 0.0086 (54)NEWrukovoditel / rukovoditelNVD: Rukovoditel Project Management app 2.6 is affected by: Cross Site Scripting (XSS). NVD: An attacker can add JavaScript code to the fil… Handoff

2026-07-08

defensive priority signal

MEDIUMEPSS 0.0083 (53)NEWdaily_tracker_system_project / daily_tracker_systemNVD: A Cross-site scripting (XSS) vulnerability in 'user-profile.php' in SourceCodester Daily Tracker System v1.0 allows remote attackers t… Handoff

2026-07-08

defensive priority signal

MEDIUMEPSS 0.0033 (25)NEWmicroweber / microweberNVD: Microweber v1.1.18 is affected by no session expiry after log-out. Handoff

2026-07-08

defensive priority signal

MEDIUMEPSS 0.0078 (52)NEWspiceworks / spiceworksNVD: Spiceworks Version <= 7.5.00107 is affected by XSS. NVD: Any name typed on Custom Groups function is vulnerable to stored XSS as they… Handoff

2026-07-08

defensive priority signal

MEDIUMEPSS 0.0075 (51)NEWyourls / yourlsNVD: Multiple Stored Cross Site Scripting (XSS) vulnerabilities exist in the YOURLS Admin Panel, Versions 1.5 - 1.7.10. Handoff

2026-07-08

defensive priority signal

MEDIUMEPSS 0.0146 (70)NEWverint / workforce_optimizationNVD: Verint Workforce Optimization suite 15.1 (15.1.0.37634) has Unauthenticated Information Disclosure via API Handoff

Public-safe defensive signals

CVE-2005-4459 CRITICAL CVSS 10.0 vmware / ace
NVD: Heap-based buffer overflow in the NAT networking components vmnat.exe and vmnet-natd in VMWare Workstation 5.5, GSX Server 3.2, ACE 1.0.1, and Player 1.0 allows remote authenticated attackers, including guests, to execute arbitrary code via crafted (1) EPRT...
An attacker may be able to run code or commands on affected systems; CVSS 10.0 (CRITICAL); EPSS percentile 96; affected product context: vmware / ace; sources: NVD, Vendor Advisory.
CVE-2018-5353 CRITICAL CVSS 9.8 zohocorp / manageengine_adselfservice_plus
NVD: The custom GINA/CP module in Zoho ManageEngine ADSelfService Plus before 5.5 build 5517 allows remote attackers to execute code and escalate privileges via spoofing. NVD: It does not authenticate the intended server before opening a browser window. NVD: An unauthenticated attacker capable of conducting a spoofing attack can redirect the browser to gain execution in the context of the WinLogon.exe process.
This critical severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for remote exposure · authenticated boundary; CVSS 9.8 (CRITICAL); EPSS percentile 94; affected product context: zohocorp /...
CVE-2020-25466 CRITICAL CVSS 9.8 crmeb / crmeb
NVD: A SSRF vulnerability exists in the downloadimage interface of CRMEB 3.0, which can remotely download arbitrary files on the server and remotely execute arbitrary code. OSV: A SSRF vulnerability exists in the downloadimage interface of CRMEB 3.0, which can remotely download arbitrary files on the server and remotely execute arbitrary code.
An attacker may be able to run code or commands on affected systems; CVSS 9.8 (CRITICAL); EPSS percentile 86; affected product context: crmeb / crmeb; sources: NVD, OSV, Vendor Advisory.
CVE-2020-24193 CRITICAL CVSS 9.8 daily_tracker_system_project / daily_tracker_system
NVD: A SQL injection vulnerability in login in Sourcecodetester Daily Tracker System 1.0 allows unauthenticated user to execute authentication bypass with SQL injection via the email parameter.
An attacker may be able to read or change database-backed application data; CVSS 9.8 (CRITICAL); EPSS percentile 85; affected product context: daily_tracker_system_project / daily_tracker_system; sources: NVD.
CVE-2018-5354 HIGH CVSS 8.8 anixis / password_reset_client
NVD: The custom GINA/CP module in ANIXIS Password Reset Client before version 3.22 allows remote attackers to execute code and escalate privileges via spoofing. NVD: When the client is configured to use HTTP, it does not authenticate the intended server before opening a browser window. NVD: An unauthenticated attacker capable of conducting a spoofing attack can redirect the browser to gain execution in the context of the WinLogon.exe process.
This high severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for remote exposure · authenticated boundary; CVSS 8.8 (HIGH); EPSS percentile 84; affected product context: anixis / password_reset_client; sources: NVD...
CVE-2020-23451 HIGH CVSS 8.8 spiceworks / spiceworks
NVD: Spiceworks Version <= 7.5.00107 is affected by CSRF which can lead to privilege escalation via "/settings/v1/users" function.
An attacker may cross a privilege boundary and gain more access than intended; CVSS 8.8 (HIGH); EPSS percentile 44; affected product context: spiceworks / spiceworks; sources: NVD.
CVE-2020-25514 HIGH CVSS 8.4 simple_library_management_system_project / simple_library_management_system
NVD: Sourcecodester Simple Library Management System 1.0 is affected by Incorrect Access Control via the Login Panel,
This high severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for high severity review; CVSS 8.4 (HIGH); EPSS percentile 46; affected product context: simple_library_management_system_project /...
CVE-2020-23968 HIGH CVSS 7.8 ilex / international_sign\&go
NVD: Ilex International Sign&go Workstation Security Suite 7.1 allows elevation of privileges via a symlink attack on ProgramData\Ilex\S&G\Logs\000-sngWSService1.log.
An attacker may cross a privilege boundary and gain more access than intended; CVSS 7.8 (HIGH); EPSS percentile 55; affected product context: ilex / international_sign\&go; sources: NVD, Vendor Advisory.
CVE-2020-25487 HIGH CVSS 7.8 phpgurukul / zoo_management_system
NVD: PHPGURUKUL Zoo Management System Using PHP and MySQL version 1.0 is affected by: SQL Injection via zms/animal-detail.php.
An attacker may be able to read or change database-backed application data; CVSS 7.8 (HIGH); EPSS percentile 42; affected product context: phpgurukul / zoo_management_system; sources: NVD.
CVE-2020-25515 HIGH CVSS 7.8 simple_library_management_system_project / simple_library_management_system
NVD: Sourcecodester Simple Library Management System 1.0 is affected by Insecure Permissions via Books > New Book ,
This high severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for high severity review; CVSS 7.8 (HIGH); EPSS percentile 42; affected product context: simple_library_management_system_project /...
CVE-2018-10902 HIGH CVSS 7.8 debian / debian_linux
NVD: It was found that the raw midi kernel driver does not protect against concurrent access which leads to a double realloc (double free) in snd_rawmidi_input_params() and snd_rawmidi_output_status() which are part of snd_rawmidi_ioctl() handler in rawmidi.c file. NVD: A malicious local attacker could possibly use this for privilege escalation. OSV: It was found that the raw midi kernel driver does not protect against concurrent access which leads to a double realloc (double free) in snd_rawmidi_input_params() and snd_rawmidi_output_status() which are part of snd_rawmidi_ioctl() handler in rawmidi.c file.
A local user may cross a privilege boundary and gain more access than intended; CVSS 7.8 (HIGH); EPSS percentile 41; affected product context: debian / debian_linux; sources: NVD, OSV, Vendor Advisory.
CVE-2020-22552 HIGH CVSS 7.5 snap7_project / snap7
NVD: The Snap7 server component in version 1.4.1, when an attacker sends a crafted packet with COTP protocol the last-data-unit flag set to No and S7 writes a var function, the Snap7 server will be crashed.
This high severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for high severity review; CVSS 7.5 (HIGH); EPSS percentile 79; affected product context: snap7_project / snap7; sources: NVD.
CVE-2020-21733 MEDIUM CVSS 6.1 sagemcom / f\@st_3686_firmware
NVD: Sagemcom F@ST3686 v1.0 HUN 3.97.0 has XSS via RgDiagnostics.asp, RgDdns.asp, RgFirewallEL.asp, RgVpnL2tpPptp.asp.
This medium severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for XSS risk; CVSS 6.1 (MEDIUM); EPSS percentile 58; affected product context: sagemcom / f\@st_3686_firmware; sources: NVD, Vendor Advisory.
CVE-2020-21731 MEDIUM CVSS 6.1 gazie_project / gazie
NVD: Gazie 7.29 is affected by: Cross Site Scripting (XSS) via An attacker can inject JavaScript code, and the webapplication stores the injected code.
This medium severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for defensive exposure review; CVSS 6.1 (MEDIUM); EPSS percentile 54; affected product context: gazie_project / gazie; sources: NVD, Vendor Advisory.
CVE-2020-21732 MEDIUM CVSS 6.1 rukovoditel / rukovoditel
NVD: Rukovoditel Project Management app 2.6 is affected by: Cross Site Scripting (XSS). NVD: An attacker can add JavaScript code to the filename.
This medium severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for XSS risk; CVSS 6.1 (MEDIUM); EPSS percentile 54; affected product context: rukovoditel / rukovoditel; sources: NVD, Vendor Advisory.
CVE-2020-24194 MEDIUM CVSS 6.1 daily_tracker_system_project / daily_tracker_system
NVD: A Cross-site scripting (XSS) vulnerability in 'user-profile.php' in SourceCodester Daily Tracker System v1.0 allows remote attackers to inject arbitrary web script or HTML via the 'fullname' parameter.
This medium severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for XSS risk · remote exposure; CVSS 6.1 (MEDIUM); EPSS percentile 53; affected product context: daily_tracker_system_project / daily_tracker_system...
CVE-2020-23136 MEDIUM CVSS 5.5 microweber / microweber
NVD: Microweber v1.1.18 is affected by no session expiry after log-out.
This medium severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for defensive exposure review; CVSS 5.5 (MEDIUM); EPSS percentile 25; affected product context: microweber / microweber; sources: NVD.
CVE-2020-23450 MEDIUM CVSS 5.4 spiceworks / spiceworks
NVD: Spiceworks Version <= 7.5.00107 is affected by XSS. NVD: Any name typed on Custom Groups function is vulnerable to stored XSS as they displayed on without output sanitization.
This medium severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for defensive exposure review; CVSS 5.4 (MEDIUM); EPSS percentile 52; affected product context: spiceworks / spiceworks; sources: NVD, Vendor Advisory.
CVE-2020-27388 MEDIUM CVSS 5.4 yourls / yourls
NVD: Multiple Stored Cross Site Scripting (XSS) vulnerabilities exist in the YOURLS Admin Panel, Versions 1.5 - 1.7.10.
This medium severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for defensive exposure review; CVSS 5.4 (MEDIUM); EPSS percentile 51; affected product context: yourls / yourls; sources: NVD.
CVE-2020-23446 MEDIUM CVSS 5.3 verint / workforce_optimization
NVD: Verint Workforce Optimization suite 15.1 (15.1.0.37634) has Unauthenticated Information Disclosure via API
An attacker may be able to access information that should not be exposed; CVSS 5.3 (MEDIUM); EPSS percentile 70; affected product context: verint / workforce_optimization; sources: NVD, Vendor Advisory.

Critical High Medium Low KEVKnown Exploited NEWNewly Observed

Agent Access Agent Data Surface

Read-only static JSON for humans and AI agents. This is a data contract, not an execution surface.

Human Archive Priority Queue JSON Latest Diff Feed Knowledge Graph Trust Layer Proof Metadata Canonical Policy Canonical Envelope Envelope Index EAS Typed Payload Attestation Ledger Signal Item JSON Remediation Handoff Agent Manifest Static Manifest Schema

Knowledge Graph / JSON-LDlinks CVE signals, sources, affected products, and provenanceLocal-first Vaultbrowser-only personal review context; import/export/clear supportedRirastaFab Trust Layerhash-only integrity metadata, canonical envelopes, and proof endpointsCanonical Envelopeattestation-ready preflight metadata without onchain submission

Agents should start with /agent.json, validate the signal item schema, use the JSON-LD graph for provenance, and treat the Local Vault as private browser state that is never uploaded.

WebMCP read-only toolsEnabledRuntime server endpointsNoneStatic agent JSONEnabled

Allowedsearch / list / get / summarize / prioritize

Disabledscan / patch / exploit / external execution / auto remediation

Last generated: 2026-07-08 03:43 UTC / 2026-07-08 12:43 JST. Observed dates are per-source signal timestamps.

Latest Changes Diff Feed

previous successful latestpublic snapshot comparison

No material public-safe changes since the previous successful snapshot.

Added0

Changed0

Removed0

Previous snapshot2026-07-07 22:34 UTC / 2026-07-08 07:34 JST

Items compared20 -> 20

Feed generated2026-07-08 03:43 UTC / 2026-07-08 12:43 JST

Open latest diff feed

Enrichment Coverage partial

Coverage is shown from the current public dataset. CPE, PURL, and canonical vendor/product are partial and may be unknown.

NVD20

Vendor Advisory20

OSV2

CISA KEV0

Affected products53partial

CPE53partial

PURL0partial

Canonical vendor/product53partial

Observed Buckets (current snapshot)

Current snapshot only. Historical trend appears after multiple generated runs.

2026-07-0820

Severity Distribution

CRITICAL 4
HIGH 8
MEDIUM 8
LOW 0
NONE 0
UNKNOWN 0

Source Distribution (current snapshot)

NVD20

Vendor Advisory20

OSV2

Monitored Vendors

View all vendors →

Vendor distribution from the current public snapshot. Neutral badges are not official vendor logos.

Local-first Personal Data Vault

A browser-only vault for human review context. It stores vendor / product / package / CPE prefix / saved signals / muted signals / preferences in localStorage, supports import/export/clear, validates shape on import, and never uploads data.

Import Vault JSON

No watched signals yet. Use the heart control on a signal row to add one.

Saved Views

Save and reapply local filter sets. Nothing is uploaded.

No saved views. Enter a name and save the current filters.

Read-only Triage Report Preview

Generated from the current filters. Defensive checklist only; no exploit or scanning detail.

Filtered signals20

Top priority candidateCVE-2005-4459

Critical / High4 / 8

Safety moderead-only, public indexable, public-safe

Raw JSON details

{
  "count": 20,
  "defensive_checklist": [
    "Confirm affected products",
    "Review official source references",
    "Prioritize KEV, critical CVSS, and high EPSS percentile items",
    "Record human confirmation"
  ],
  "mode": "read_only_public_beta_dashboard",
  "safety": {
    "procedural_detail": false,
    "public_launch": true,
    "scanner_execution": false
  },
  "severity_distribution": {
    "CRITICAL": 4,
    "HIGH": 8,
    "LOW": 0,
    "MEDIUM": 8,
    "NONE": 0,
    "UNKNOWN": 0
  },
  "top_risk": "CVE-2005-4459"
}

Source Status

NVD20 signalsLast observed: 2026-07-08Status: healthy

EPSS20 signalsLast observed: 2026-07-08Status: healthy

OSV2 signalsLast observed: 2026-07-08Status: healthy

CISA KEV0 signalsLast observed: 2026-07-08Status: not observed

Vendor Advisory20 signalsLast observed: 2026-07-08Status: observed

Safety Guardrails

Public indexingEnabled

Read-only surfaceEnabled

Deploy controlsCodex managed deploy only

External notificationDisabled

Auto remediationDisabled

Runtime server endpointsNone

WebMCP read-only toolsEnabled

Static agent JSONEnabled