public radar

Prioritized Vulnerability Signals for Defenders

Track CVE, KEV, EPSS, and vendor-advisory changes in one read-only radar—so teams can see what changed, why it matters, and what to verify next.

LIVE SIGNAL MAPDEFENSIVE PRIORITY CIRCUITLATEST STATIC SNAPSHOT

PRIORITY ORDER · NOT AN ATTACK PATH

indexable public surfaceread-only datasetpublic-safe sourcesexternal execution disabledauto remediation disabled

Tracked CVEs2020 new in 7d

Critical2canonical CVSS

Known Exploited0KEV observed

High EPSS percentile (≥70)0EPSS percentile observed

Monitored Vendors1from current data

VULNERABILITY TREEMAP

DEFENSIVE PRIORITY SURFACE

Stable CVE grouping for defensive triage. Area changes by display mode; severity remains encoded by color.

LATEST STATIC SNAPSHOT2026-09-24 19:15 UTC / 2026-09-25 04:15 JST

DISPLAY MODEDEFENSIVE PRIORITY

Live Vulnerability Feed READ-ONLY

20 signalsView all signals →

2026-09-24

defensive priority signal

CRITICALEPSS 0.0109 (64)NEW-NVD: GravitLauncher is an open-source Minecraft launcher based on sashok724's v3. NVD: Prior to 5.7.12, an unauthenticated remote actor can… Handoff

2026-09-24

defensive priority signal

CRITICALEPSS 0.0070 (51)NEW-NVD: Anyquery is an SQL query engine built on top of SQLite. NVD: Prior to 0.4.5, authenticated users with INSERT or UPDATE access to affec… Handoff

2026-09-24

defensive priority signal

HIGHEPSS 0.0057 (45)NEW-NVD: MCP Documentation Server is a local-first document management and semantic search server for AI coding agents. NVD: From 1.13.0 until… Handoff

2026-09-24

defensive priority signal

HIGHEPSS 0.0032 (23)NEW-NVD: Faust.js is a headless WordPress toolkit. NVD: Prior to 1.8.11, the FaustWP WordPress plugin authenticates only the ciphertext in its… Handoff

2026-09-24

defensive priority signal

HIGHEPSS 0.0052 (42)NEW-NVD: ESPAsyncWebServer is an asynchronous HTTP and WebSocket server library for ESP32, ESP8266, RP2040 and RP2350. NVD: Prior to 3.11.1, th… Handoff

2026-09-24

defensive priority signal

HIGHEPSS 0.0013 (2)NEW-NVD: There is stack-based buffer overflow vulnerability recently discovered in MCC Universal Library for Linux (uldaq). NVD: This may resul… Handoff

2026-09-24

defensive priority signal

HIGHEPSS 0.0019 (8)NEW-NVD: uniget is a universal installer and updater for (container) tools. NVD: Prior to 0.27.6, the hooks edit command in cmd/uniget/hooks.go… Handoff

2026-09-24

defensive priority signal

HIGHEPSS 0.0052 (42)NEW-NVD: Elixir protobuf is a pure Elixir implementation of Google Protobuf. NVD: From 0.8.0 until 0.16.1, services that decode attacker-contro… Handoff

2026-09-24

defensive priority signal

HIGHEPSS 0.0028 (18)NEW-NVD: TS3 Manager is modern web interface for maintaining Teamspeak3 servers. NVD: Prior to 2.2.6, the /api/download handler in packages/ser… Handoff

2026-09-24

defensive priority signal

HIGHEPSS 0.0049 (39)NEW-NVD: Apache Karaf's XmlUtils cached XML parser/transformer factories in static ThreadLocal fields on long-lived container threads. NVD: Bec… Handoff

2026-09-24

defensive priority signal

HIGHEPSS 0.0040 (31)NEW-NVD: A flaw was found in Keycloak. NVD: When deployed in stateless mode with MySQL or MariaDB, a mismatch in row-count semantics between th… Handoff

2026-09-24

defensive priority signal

HIGHEPSS 0.0059 (46)NEW-NVD: lxc-ci contains continuous integration and image-build scripts for LXC. NVD: Prior to the 2026-05-28 Arch Linux image publication, ima… Handoff

2026-09-24

defensive priority signal

HIGHEPSS 0.0048 (39)NEW-NVD: Frappe HR is an open-source human resources management solution (HRMS). NVD: Prior to 16.7.0, an authenticated user with the HR User r… Handoff

2026-09-24

defensive priority signal

HIGHEPSS 0.0039 (30)NEW-NVD: Traccar is an open source GPS tracking system. NVD: Prior to 6.14.0, an authenticated, non-readonly user with access to an object usab… Handoff

2026-09-24

defensive priority signal

HIGHEPSS 0.0014 (3)NEW-NVD: Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. NVD: Prior to 1.6.6 and from 1.7.0 until 1.7.3, SAML.getSessio… Handoff

2026-09-24

defensive priority signal

MEDIUMEPSS 0.0053 (42)NEW-NVD: Traccar is an open source GPS tracking system. NVD: Prior to 6.14.0, an authenticated user with permission to manage groups and reques… Handoff

2026-09-24

defensive priority signal

LOWEPSS 0.0084 (56)NEW-NVD: punchin-email is a Cloudflare Email Worker that provides two-way role aliases while relaying mail to a private inbox. NVD: Prior to 1… Handoff

2026-09-24

defensive priority signal

LOWEPSS 0.0039 (31)NEW-NVD: A security vulnerability has been detected in Dromara mayfly-go up to 1.11.5. NVD: The affected element is an unknown function of the… Handoff

2026-09-24

defensive priority signal

LOWEPSS 0.0015 (4)NEW-NVD: uniget is a universal installer and updater for (container) tools. NVD: Prior to 0.27.6, the hooks edit command in cmd/uniget/hooks.go… Handoff

2026-09-24

defensive priority signal

NONEEPSS 0.0044 (35)NEW-NVD: Kiwi TCMS is an open source test management system. NVD: Prior to 16.0, the unauthenticated /init-db/ page handled by InitDBView in tc… Handoff

Public-safe defensive signals

CVE-2026-54617 CRITICAL CVSS 9.8 -
NVD: GravitLauncher is an open-source Minecraft launcher based on sashok724's v3. NVD: Prior to 5.7.12, an unauthenticated remote actor can send a raw HTTP request target without a leading slash to the default LaunchServer file server on port 9274. NVD: FileServerHandler.channelRead0 in components/launchserver/src/main/java/pro/gravit/launchserver/socket/handlers/fileserver/FileServerHandler.java strips the first request-target character and resolves the remaining path against updatesDir without...
An attacker may be able to reach files outside the intended application path; CVSS 9.8 (CRITICAL); EPSS percentile 64; sources: NVD, OSV.
CVE-2026-47252 CRITICAL CVSS 9.0 -
NVD: Anyquery is an SQL query engine built on top of SQLite. NVD: Prior to 0.4.5, authenticated users with INSERT or UPDATE access to affected macOS virtual tables can execute operating-system commands because the Chrome plugin and equivalent Brave, Edge, and Safari variants interpolate a SQL-controlled URL into AppleScript... NVD: In plugins/chrome/tabs.go, tabsTable.Insert() passes the URL through fmt.Sprintf(newTabScript, url), and tabsTable.Update() uses fmt.Sprintf(setURLScript, pk, url).
An attacker may be able to run code or commands on affected systems; CVSS 9.0 (CRITICAL); EPSS percentile 51; sources: NVD, OSV.
CVE-2026-54504 HIGH CVSS 8.8 -
NVD: MCP Documentation Server is a local-first document management and semantic search server for AI coding agents. NVD: From 1.13.0 until 1.13.1, the automatically started Web UI in src/server.ts calls startWebServer in src/web-server.ts with START_WEB_UI enabled by default and WEB_PORT set to 3080. NVD: startWebServer uses app.listen(PORT) without a host, which binds the unauthenticated document-management API to all interfaces rather than localhost.
An attacker may be able to run code or commands on affected systems; CVSS 8.8 (HIGH); EPSS percentile 45; sources: NVD, OSV.
CVE-2026-54239 HIGH CVSS 8.8 -
NVD: Faust.js is a headless WordPress toolkit. NVD: Prior to 1.8.11, the FaustWP WordPress plugin authenticates only the ciphertext in its token envelope and excludes the 16-byte initialization vector from the HMAC in WPE\FaustWP\Auth\encrypt() and WPE\FaustWP\Auth\decrypt() in... NVD: A logged-in non-administrator who obtains an authorization code from GET /generate can modify the unauthenticated initialization vector so that CBC decryption changes the token type and user identifier while the HMAC remains valid.
An attacker may be able to run code or commands on affected systems; CVSS 8.8 (HIGH); EPSS percentile 23; sources: NVD, OSV.
CVE-2026-54571 HIGH CVSS 8.7 -
NVD: ESPAsyncWebServer is an asynchronous HTTP and WebSocket server library for ESP32, ESP8266, RP2040 and RP2350. NVD: Prior to 3.11.1, the multipart/form-data parser in src/WebRequest.cpp stores _boundaryPosition as an 8-bit value while _parseMultipartPostByte processes the boundary. NVD: A remote request containing an exactly 256-byte multipart boundary wraps _boundaryPosition from 255 to zero, prevents the boundary parsing loop from terminating, consumes excessive CPU, and triggers a FreeRTOS watchdog reset on affected ESP32 or ESP8266...
The affected service may become unavailable or unreliable; CVSS 8.7 (HIGH); EPSS percentile 42; sources: NVD, OSV.
CVE-2026-19477 HIGH CVSS 8.6 -
NVD: There is stack-based buffer overflow vulnerability recently discovered in MCC Universal Library for Linux (uldaq). NVD: This may result in information disclosure or arbitrary code execution. NVD: This vulnerability affects MCC Universal Library for Linux (uldaq) v1.2.1 and prior versions.
An attacker may be able to access information that should not be exposed; CVSS 8.6 (HIGH); EPSS percentile 2; sources: NVD.
CVE-2026-55062 HIGH CVSS 8.4 -
NVD: uniget is a universal installer and updater for (container) tools. NVD: Prior to 0.27.6, the hooks edit command in cmd/uniget/hooks.go concatenates an unvalidated hook filename with the selected hooks directory, allowing parent-directory components to escape that directory. NVD: The resulting path is passed to the configured editor, which can access or modify files outside the hooks directory with the privileges of the uniget process account.
An attacker may be able to reach files outside the intended application path; CVSS 8.4 (HIGH); EPSS percentile 8; sources: NVD, OSV.
CVE-2026-54451 HIGH CVSS 8.2 -
NVD: Elixir protobuf is a pure Elixir implementation of Google Protobuf. NVD: From 0.8.0 until 0.16.1, services that decode attacker-controlled protobuf bytes with Protobuf.Decoder can be taken offline when the schema contains a self-referential or cyclic message type. NVD: In lib/protobuf/decoder.ex, Protobuf.Decoder.value_for_field/3 handles an embedded?: true field by recursively entering the decode / build_message / handle_value / value_for_field call chain without enforcing a nesting-depth limit.
This high severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for high severity review; CVSS 8.2 (HIGH); EPSS percentile 42; sources: NVD, OSV.
CVE-2026-54253 HIGH CVSS 8.2 -
NVD: TS3 Manager is modern web interface for maintaining Teamspeak3 servers. NVD: Prior to 2.2.6, the /api/download handler in packages/server/routes/api.js passes the attacker-controlled port query parameter to socket.connect(port, host) and returns the resulting error.message through res.status(400).send(error.message) as text/html... NVD: When a logged-in operator follows a crafted top-level link, the reflected value executes in the manager origin.
This high severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for XSS risk · user interaction required; CVSS 8.2 (HIGH); EPSS percentile 18; sources: NVD, OSV.
CVE-2026-92230 HIGH CVSS 7.5 -
NVD: Apache Karaf's XmlUtils cached XML parser/transformer factories in static ThreadLocal fields on long-lived container threads. NVD: Because a ThreadLocal value outlives the OSGi bundle that created it, repeated bundle or feature install, update, or refresh operations can leave successive bundle ClassLoader's pinned in memory and unreachable for garbage collection, leading to unbounded...
The affected service may become unavailable or unreliable; CVSS 7.5 (HIGH); EPSS percentile 39; sources: NVD.
CVE-2026-90997 HIGH CVSS 7.4 -
NVD: A flaw was found in Keycloak. NVD: When deployed in stateless mode with MySQL or MariaDB, a mismatch in row-count semantics between the database driver and Keycloak's application logic allows an attacker to bypass replay protection. NVD: This vulnerability enables an attacker who intercepts single-use security artifacts, such as JWT client assertions, DPoP proofs, or one-time password (TOTP) codes, to replay them.
An attacker may access resources that should require stronger authorization; CVSS 7.4 (HIGH); EPSS percentile 31; sources: NVD.
CVE-2026-52727 HIGH CVSS 7.2 -
NVD: lxc-ci contains continuous integration and image-build scripts for LXC. NVD: Prior to the 2026-05-28 Arch Linux image publication, images built from images/archlinux.yaml retain the same pacman local-signing private key in /etc/pacman.d/gnupg and redistribute it to every container or virtual machine created from that image. NVD: An attacker who controls an HTTP package mirror or can intercept mirror traffic can use the shared pacman signing private key to sign modified packages that affected clients accept as trusted.
An attacker may gain root or administrative-level privileges on affected systems; CVSS 7.2 (HIGH); EPSS percentile 46; sources: NVD, OSV.
CVE-2026-54524 HIGH CVSS 7.1 -
NVD: Frappe HR is an open-source human resources management solution (HRMS). NVD: Prior to 16.7.0, an authenticated user with the HR User role can inject SQL through filters in the Salary Payments Based on Payment Mode report. NVD: In hrms/payroll/report/salary_payments_based_on_payment_mode/salary_payments_based_on_payment_mode.py, get_conditions constructs filter clauses from user-controlled values and get_data incorporates those clauses into a string-formatted SQL query, allowing...
An attacker may be able to read or change database-backed application data; CVSS 7.1 (HIGH); EPSS percentile 39; sources: NVD, OSV.
CVE-2026-52851 HIGH CVSS 7.1 -
NVD: Traccar is an open source GPS tracking system. NVD: Prior to 6.14.0, an authenticated, non-readonly user with access to an object usable in a permission pair can submit DELETE /api/permissions with an extra attacker-controlled JSON key. NVD: Permission(LinkedHashMap<String, Long>) in src/main/java/org/traccar/model/Permission.java validates only the first two keys, but DatabaseStorage.removePermission() in src/main/java/org/traccar/storage/DatabaseStorage.java concatenates every map key into the...
An attacker may be able to read or change database-backed application data; CVSS 7.1 (HIGH); EPSS percentile 30; sources: NVD, OSV.
CVE-2026-45720 HIGH CVSS 7.0 -
NVD: Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. NVD: Prior to 1.6.6 and from 1.7.0 until 1.7.3, SAML.getSession in internal/pkg/auth/interceptor/saml.go checks SAMLAssertion.Used and marks it used in separate state operations. NVD: Concurrent requests carrying the same captured saml-session token can each observe the assertion as unused and obtain authentication as the victim before either update is visible.
This high severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for high severity review; CVSS 7.0 (HIGH); EPSS percentile 3; sources: NVD, OSV.
CVE-2026-52852 MEDIUM CVSS 6.5 -
NVD: Traccar is an open source GPS tracking system. NVD: Prior to 6.14.0, an authenticated user with permission to manage groups and request reports can create a cyclic group-parent hierarchy and request a trips or stops report for a device in that hierarchy. NVD: org.traccar.api.resource.GroupResource permits the parent cycle, while org.traccar.helper.model.AttributeUtil.lookup follows group parents without cycle detection, a visited set, or a depth limit.
The affected service may become unavailable or unreliable; CVSS 6.5 (MEDIUM); EPSS percentile 42; sources: NVD, OSV.
CVE-2026-54649 LOW CVSS 2.1 -
NVD: punchin-email is a Cloudflare Email Worker that provides two-way role aliases while relaying mail to a private inbox. NVD: Prior to 1.5.0, handleInbound delivers inbound alias mail with message.forward(), which silently drops the added Reply-To header intended to route responses through the relay. NVD: When a correspondent sends mail to an alias and the operator replies, the mail client can send directly to the correspondent from the private FORWARD_TO inbox address, exposing that address.
This low severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for authentication boundary review; CVSS 2.1 (LOW); EPSS percentile 56; sources: NVD, OSV.
CVE-2026-92992 LOW CVSS 2.1 -
NVD: A security vulnerability has been detected in Dromara mayfly-go up to 1.11.5. NVD: The affected element is an unknown function of the file server/internal/ai/api/ai.go of the component AI Assistant. NVD: The manipulation leads to missing authorization.
This low severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for defensive exposure review; CVSS 2.1 (LOW); EPSS percentile 31; sources: NVD, OSV.
CVE-2026-55061 LOW CVSS 1.0 -
NVD: uniget is a universal installer and updater for (container) tools. NVD: Prior to 0.27.6, the hooks edit command in cmd/uniget/hooks.go parses UNIGET_EDITOR or EDITOR with strings.Split(editor, " ") and passes every space-delimited suffix as an argument to the selected editor executable. NVD: An attacker who can influence the editor environment and cause hook editing can supply unexpected editor arguments, potentially causing unintended actions with the privileges of the uniget process account.
An attacker may be able to run unintended system commands through the affected component; CVSS 1.0 (LOW); EPSS percentile 4; sources: NVD, OSV.
CVE-2026-49292 NONE CVSS 0.0 -
NVD: Kiwi TCMS is an open source test management system. NVD: Prior to 16.0, the unauthenticated /init-db/ page handled by InitDBView in tcms/core/views.py remains reachable after initial setup and proxies repeated requests to Kiwi/manage.py migrate. NVD: The migration command is reentrant, so repeated access reports that no migrations are available and does not cause data loss, alter application state, reveal confidential information, or produce a documented availability impact.
This none severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for defensive exposure review; CVSS 0.0 (NONE); EPSS percentile 35; sources: NVD, OSV.

Critical High Medium Low KEVKnown Exploited NEWNewly ObservedJ / K Move · ↑ / ↓ Move · Enter Open · Esc Close

Agent Access Agent Data Surface

Read-only static JSON for humans and AI agents. This is a data contract, not an execution surface.

Human Archive Priority Queue JSON Latest Diff Feed Knowledge Graph Trust Layer Proof Metadata Canonical Policy Canonical Envelope Envelope Index EAS Typed Payload Attestation Ledger Signal Item JSON Remediation Handoff Agent Manifest Static Manifest Schema

Knowledge Graph / JSON-LDlinks CVE signals, sources, affected products, and provenanceLocal-first Vaultbrowser-only personal review context; import/export/clear supportedRirastaFab Trust Layerhash-only integrity metadata, canonical envelopes, and proof endpointsCanonical Envelopeattestation-ready preflight metadata without onchain submission

Agents should start with /agent.json, validate the signal item schema, use the JSON-LD graph for provenance, and treat the Local Vault as private browser state that is never uploaded.

WebMCP read-only toolsEnabledRuntime server endpointsNoneStatic agent JSONEnabled

Allowedsearch / list / get / summarize / prioritize

Disabledscan / patch / exploit / external execution / auto remediation

Last generated: 2026-09-24 19:15 UTC / 2026-09-25 04:15 JST. Observed dates are per-source signal timestamps.

Latest Changes Diff Feed

previous successful latestpublic snapshot comparison

40 public-safe changes since the previous successful snapshot.

Added20

Changed0

Removed20

What changed

CVE-2026-19477: newly added to the public-safe set.
CVE-2026-45720: newly added to the public-safe set.
CVE-2026-47252: newly added to the public-safe set.
37 more public-safe changes in the JSON feed.

Previous snapshot2026-09-24 14:17 UTC / 2026-09-24 23:17 JST

Items compared20 -> 20

Feed generated2026-09-24 19:15 UTC / 2026-09-25 04:15 JST

Open latest diff feed

Enrichment Coverage partial

Coverage is shown from the current public dataset. CPE, PURL, and canonical vendor/product are partial and may be unknown.

NVD20

Vendor Advisory20

OSV17

Affected products0partial

CPE0partial

PURL0partial

Canonical vendor/product0partial

Observed Buckets (current snapshot)

Current snapshot only. Historical trend appears after multiple generated runs.

2026-09-2420

Severity Distribution

CRITICAL 2
HIGH 13
MEDIUM 1
LOW 3
NONE 1
UNKNOWN 0

Source Distribution (current snapshot)

NVD20

Vendor Advisory20

OSV17

Monitored Vendors

View all vendors →

Vendor distribution from the current public snapshot. Neutral badges are not official vendor logos.

Local-first Personal Data Vault

A browser-only vault for human review context. It stores vendor / product / package / CPE prefix / saved signals / muted signals / preferences in localStorage, supports import/export/clear, validates shape on import, and never uploads data.

Import Vault JSON

No watched signals yet. Use the heart control on a signal row to add one.

Saved Views

Save and reapply local filter sets. Nothing is uploaded.

No saved views. Enter a name and save the current filters.

Read-only Triage Report Preview

Generated from the current filters. Defensive checklist only; no exploit or scanning detail.

Filtered signals20

Top priority candidateCVE-2026-54617

Critical / High2 / 13

Safety moderead-only, public indexable, public-safe

Raw JSON details

{
  "count": 20,
  "defensive_checklist": [
    "Confirm affected products",
    "Review official source references",
    "Prioritize KEV, critical CVSS, and high EPSS percentile items",
    "Record human confirmation"
  ],
  "mode": "read_only_public_beta_dashboard",
  "safety": {
    "procedural_detail": false,
    "public_launch": true,
    "scanner_execution": false
  },
  "severity_distribution": {
    "CRITICAL": 2,
    "HIGH": 13,
    "LOW": 3,
    "MEDIUM": 1,
    "NONE": 1,
    "UNKNOWN": 0
  },
  "top_risk": "CVE-2026-54617"
}

Source Status

NVD20 signalsLast observed: 2026-09-24Status: healthy

EPSS20 signalsLast observed: 2026-09-24Status: healthy

OSV17 signalsLast observed: 2026-09-24Status: healthy

Vendor Advisory20 signalsLast observed: 2026-09-24Status: observed

Safety Guardrails

Public indexingEnabled

Read-only surfaceEnabled

Deploy controlsCodex managed deploy only

External notificationDisabled

Auto remediationDisabled

Runtime server endpointsNone

WebMCP read-only toolsEnabled

Static agent JSONEnabled