public radar

Prioritized Vulnerability Signals for Defenders

Track CVE, KEV, EPSS, and vendor-advisory changes in one read-only radar—so teams can see what changed, why it matters, and what to verify next.

LIVE SIGNAL MAPDEFENSIVE PRIORITY CIRCUITLATEST STATIC SNAPSHOT

PRIORITY ORDER · NOT AN ATTACK PATH

indexable public surfaceread-only datasetpublic-safe sourcesexternal execution disabledauto remediation disabled

Tracked CVEs2020 new in 7d

Critical1canonical CVSS

Known Exploited0KEV observed

High EPSS percentile (≥70)0EPSS percentile observed

Monitored Vendors1from current data

VULNERABILITY TREEMAP

DEFENSIVE PRIORITY SURFACE

Stable CVE grouping for defensive triage. Area changes by display mode; severity remains encoded by color.

LATEST STATIC SNAPSHOT2026-10-10 09:55 UTC / 2026-10-10 18:55 JST

DISPLAY MODEDEFENSIVE PRIORITY

Live Vulnerability Feed READ-ONLY

20 signalsView all signals →

2026-10-10

defensive priority signal

CRITICALEPSS 0.0078 (55)NEW-NVD: CWE-306: Missing Authentication for Critical Function in the ait.core.server telemetry and command broker (ait-server) in NASA-AMMOS A… Handoff

2026-10-10

defensive priority signal

HIGHEPSS 0.0046 (38)NEW-NVD: OpenAM before 16.1.3 contains an unauthenticated arbitrary class instantiation vulnerability in the legacy JAX-RPC SOAP interface that… Handoff

2026-10-10

defensive priority signal

HIGHEPSS 0.0030 (21)NEW-NVD: Authorization Bypass Through User-Controlled Key vulnerability in Ultimate Member Ultimate Member ultimate-member allows Privilege Esc… Handoff

2026-10-10

defensive priority signal

HIGHEPSS 0.0052 (42)NEW-NVD: W (vincent-peugnet/wcms) through 3.18.0 contains a remote code execution vulnerability that allows authenticated editors to write arbi… Handoff

2026-10-10

defensive priority signal

HIGHEPSS 0.0049 (40)NEW-NVD: LaraDashboard before 1.4.8 contains an improper privilege management vulnerability that allows authenticated Admin users to escalate t… Handoff

2026-10-10

defensive priority signal

HIGHEPSS 0.0021 (10)NEW-NVD: Improper Validation of Specified Quantity in Input vulnerability in Themeum Kirki kirki allows Accessing Functionality Not Properly Co… Handoff

2026-10-10

defensive priority signal

HIGHEPSS 0.0020 (9)NEW-NVD: OpenAM before 16.1.3 applies its OAuth2 Provider PKCE enforcement only to authorization requests whose response_type is exactly code… Handoff

2026-10-10

defensive priority signal

HIGHEPSS 0.0020 (9)NEW-NVD: Nezha Dashboard from 1.8.0 before 2.3.13 contains an improper locking vulnerability where a non-deferred mutex unlock leaks on a nil-m… Handoff

2026-10-10

defensive priority signal

HIGHEPSS 0.0015 (3)NEW-NVD: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements Unlimited Ele… Handoff

2026-10-10

defensive priority signal

MEDIUMEPSS 0.0026 (17)NEW-NVD: OpenAM before 16.1.3 contains an authorization bypass vulnerability in the sessions REST endpoint query operation that allows realm ad… Handoff

2026-10-10

defensive priority signal

MEDIUMEPSS 0.0025 (15)NEW-NVD: OpenAM before 16.1.3 contains an improper authorization vulnerability that allows delegated administrators to destroy sessions outside… Handoff

2026-10-10

defensive priority signal

MEDIUMEPSS 0.0031 (22)NEW-NVD: LaraDashboard before 1.4.8 contains a path traversal vulnerability that allows unauthenticated attackers to read JSON files by manipul… Handoff

2026-10-10

defensive priority signal

MEDIUMEPSS 0.0018 (7)NEW-NVD: Nezha from 1.8.0 before 2.3.13 contains a lock-order inversion in UpdateGroup and DeleteGroup that allows authenticated non-admin user… Handoff

2026-10-10

defensive priority signal

MEDIUMEPSS 0.0023 (13)NEW-NVD: OpenAM before 16.1.3 contains a server-side request forgery vulnerability that allows attackers able to register or modify OAuth 2.0 c… Handoff

2026-10-10

defensive priority signal

MEDIUMEPSS 0.0022 (11)NEW-NVD: W (vincent-peugnet/wcms) through 3.18.0 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to… Handoff

2026-10-10

defensive priority signal

MEDIUMEPSS 0.0017 (6)NEW-NVD: OpenAM before 16.1.3 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by… Handoff

2026-10-10

defensive priority signal

MEDIUMEPSS 0.0016 (5)NEW-NVD: OpenAM before 16.1.3 contains an email content injection vulnerability that allows unauthenticated attackers to control notification e… Handoff

2026-10-10

defensive priority signal

MEDIUMEPSS 0.0015 (4)NEW-NVD: OpenAM before 16.1.3 contains a latent cross-site scripting defect that places the SAML message, relay state and target URL unencoded… Handoff

2026-10-10

defensive priority signal

LOWEPSS 0.0010 (1)NEW-NVD: OpenAM before 16.1.3 contains an open redirect vulnerability that allows unauthenticated attackers to redirect users by supplying an u… Handoff

2026-10-10

defensive priority signal

LOWEPSS 0.0043 (35)NEW-NVD: A vulnerability has been found in Linux Mint Xreader up to 4.6.9. NVD: Impacted is the function g_file_get_child of the file shell/ev-… Handoff

Public-safe defensive signals

CVE-2026-105105 CRITICAL CVSS 9.8 -
NVD: CWE-306: Missing Authentication for Critical Function in the ait.core.server telemetry and command broker (ait-server) in NASA-AMMOS AIT-Core through 3.1.1 allows an unauthenticated remote attacker with network access to the ZeroMQ message bus to inject... NVD: The ait-server ZeroMQ broker binds its XSUB and XPUB sockets to all network interfaces by default without authentication or transport security. NVD: An attacker able to reach TCP port 5559 can publish messages onto internal topics, including the __commands__ command topic.
A remote attacker may be able to run unintended system commands through the affected component; CVSS 9.8 (CRITICAL); EPSS percentile 55; sources: NVD, OSV.
CVE-2026-105115 HIGH CVSS 8.8 -
NVD: OpenAM before 16.1.3 contains an unauthenticated arbitrary class instantiation vulnerability in the legacy JAX-RPC SOAP interface that allows remote attackers to load classes without authentication. NVD: Attackers can send SOAP requests to /jaxrpc/* with an unverified session identifier and a chosen class name, crashing the server, probing the classpath, or potentially reaching code execution via gadget chains. OSV: OpenAM before 16.1.3 Unauthenticated Arbitrary Class Instantiation via JAX-RPC Interface
This high severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for remote exposure; CVSS 8.8 (HIGH); EPSS percentile 38; sources: NVD, OSV.
CVE-2026-96451 HIGH CVSS 8.8 -
NVD: Authorization Bypass Through User-Controlled Key vulnerability in Ultimate Member Ultimate Member ultimate-member allows Privilege Escalation.This issue affects Ultimate Member: from n/a through 2.13.1.
An attacker may cross a privilege boundary and gain more access than intended; CVSS 8.8 (HIGH); EPSS percentile 21; sources: NVD.
CVE-2026-105123 HIGH CVSS 8.7 -
NVD: W (vincent-peugnet/wcms) through 3.18.0 contains a remote code execution vulnerability that allows authenticated editors to write arbitrary files by abusing the unvalidated path in POST /api/v0/media/upload/[*:path]. NVD: Attackers can upload .php files executed by the web server, use encoded ../ sequences to write outside the media directory, and delete arbitrary files via DELETE /api/v0/media/[*:path]. OSV: W (wcms) through 3.18.0 RCE and Arbitrary File Write via Media Upload API
An attacker may be able to run code or commands on affected systems; CVSS 8.7 (HIGH); EPSS percentile 42; sources: NVD, OSV.
CVE-2026-105126 HIGH CVSS 8.6 -
NVD: LaraDashboard before 1.4.8 contains an improper privilege management vulnerability that allows authenticated Admin users to escalate to Superadmin by editing or renaming roles. NVD: Attackers with role.edit can rename their role to Superadmin or grant user.login_as permissions to take over accounts and reach core upgrade and module installation functions for code execution. OSV: LaraDashboard before 1.4.8 Privilege Escalation via Superadmin Role Tampering
An attacker may cross a privilege boundary and gain more access than intended; CVSS 8.6 (HIGH); EPSS percentile 40; sources: NVD, OSV.
CVE-2026-103065 HIGH CVSS 8.2 -
NVD: Improper Validation of Specified Quantity in Input vulnerability in Themeum Kirki kirki allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Kirki: from n/a through 6.3.1.
This high severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for high severity review; CVSS 8.2 (HIGH); EPSS percentile 10; sources: NVD.
CVE-2026-105119 HIGH CVSS 7.6 -
NVD: OpenAM before 16.1.3 applies its OAuth2 Provider PKCE enforcement only to authorization requests whose response_type is exactly code, so codes issued through OpenID Connect hybrid flows (code token, code id_token, code token id_token) carry no bound challenge. NVD: An attacker who intercepts such a code can redeem it for a public client's tokens with any non-empty code_verifier. OSV: OpenAM before 16.1.3 PKCE Enforcement Bypass via OAuth 2.0 Hybrid Flows
This high severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for high severity review; CVSS 7.6 (HIGH); EPSS percentile 9; sources: NVD, OSV.
CVE-2026-105113 HIGH CVSS 7.1 -
NVD: Nezha Dashboard from 1.8.0 before 2.3.13 contains an improper locking vulnerability where a non-deferred mutex unlock leaks on a nil-map panic path. NVD: Any authenticated non-admin member can issue four notification API calls to permanently deadlock the alerting subsystem, then exhaust memory with blocking requests. OSV: Nezha 1.8.0 before 2.3.13 Denial of Service via Notification Mutex Deadlock
The affected service may become unavailable or unreliable; CVSS 7.1 (HIGH); EPSS percentile 9; sources: NVD, OSV.
CVE-2026-103342 HIGH CVSS 7.1 -
NVD: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Reflected XSS.This issue...
This high severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for XSS risk; CVSS 7.1 (HIGH); EPSS percentile 3; sources: NVD.
CVE-2026-105120 MEDIUM CVSS 6.9 -
NVD: OpenAM before 16.1.3 contains an authorization bypass vulnerability in the sessions REST endpoint query operation that allows realm administrators to list sessions of every realm. NVD: Attackers holding delegated RealmAdmin privileges can supply a _queryFilter naming another realm to disclose usernames, universal IDs, and session handles across tenant boundaries. OSV: OpenAM before 16.1.3 Cross-Realm Session Disclosure via Sessions REST Endpoint
This medium severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for defensive exposure review; CVSS 6.9 (MEDIUM); EPSS percentile 17; sources: NVD, OSV.
CVE-2026-105121 MEDIUM CVSS 6.9 -
NVD: OpenAM before 16.1.3 contains an improper authorization vulnerability that allows delegated administrators to destroy sessions outside their realms because realm checks use the requester's realm. NVD: Authenticated accounts holding the iplanet-am-session-destroy-sessions attribute can supply a target session identifier or handle to forcibly log out users in any realm. OSV: OpenAM before 16.1.3 Improper Authorization in Delegated Session-Destroy Realm Scoping
This medium severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for defensive exposure review; CVSS 6.9 (MEDIUM); EPSS percentile 15; sources: NVD, OSV.
CVE-2026-105125 MEDIUM CVSS 6.3 -
NVD: LaraDashboard before 1.4.8 contains a path traversal vulnerability that allows unauthenticated attackers to read JSON files by manipulating the {lang} route segment. NVD: On Windows hosts, attackers can send URL-encoded backslash sequences like ..%5C to escape resources/lang and read composer.json or other application JSON files. OSV: LaraDashboard before 1.4.8 Path Traversal via /api/translations/{lang} Endpoint
A remote attacker may be able to reach files outside the intended application path; CVSS 6.3 (MEDIUM); EPSS percentile 22; sources: NVD, OSV.
CVE-2026-105112 MEDIUM CVSS 6.0 -
NVD: Nezha from 1.8.0 before 2.3.13 contains a lock-order inversion in UpdateGroup and DeleteGroup that allows authenticated non-admin users to deadlock the alerting subsystem. NVD: Attackers can concurrently call the notification-group and batch-delete endpoints with oversized id lists to widen the race and close an ABBA cycle, permanently killing alert delivery until restart. OSV: Nezha 1.8.0 before 2.3.13 Deadlock DoS via notification-group endpoints
The affected service may become unavailable or unreliable; CVSS 6.0 (MEDIUM); EPSS percentile 7; sources: NVD, OSV.
CVE-2026-105122 MEDIUM CVSS 5.3 -
NVD: OpenAM before 16.1.3 contains a server-side request forgery vulnerability that allows attackers able to register or modify OAuth 2.0 clients to make OpenAM fetch internal resources via an unvalidated jwks_uri. NVD: Attackers can trigger unauthenticated fetches through client-authentication and ID-token validation to probe internal hosts, metadata endpoints or local files, or exhaust request threads for denial of service. OSV: OpenAM before 16.1.3 SSRF via OpenID Connect Client jwks_uri
The affected service may become unavailable or unreliable; CVSS 5.3 (MEDIUM); EPSS percentile 13; sources: NVD, OSV.
CVE-2026-105124 MEDIUM CVSS 5.3 -
NVD: W (vincent-peugnet/wcms) through 3.18.0 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts via the login user field and visitor comment website field. NVD: Attackers can submit failed logins rendered unescaped in the adminlog.php log viewer, or comment URLs echoed into href attributes in editrightbar.php, executing script with administrator or editor privileges. OSV: W (wcms) through 3.18.0 Unauthenticated Stored XSS via Login Username and Comments
This medium severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for XSS risk · remote exposure · authenticated boundary; CVSS 5.3 (MEDIUM); EPSS percentile 11; sources: NVD, OSV.
CVE-2026-105114 MEDIUM CVSS 5.3 -
NVD: OpenAM before 16.1.3 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying crafted parameters rendered unencoded on the OAuth2 authorization error page. NVD: Attackers can lure victims to a crafted /oauth2/authorize link with repeated parameters to run JavaScript in the OpenAM origin, acting within existing sessions or redirecting to phishing pages. OSV: OpenAM before 16.1.3 Reflected XSS via OAuth2 Authorization Error Page
This medium severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for XSS risk · remote exposure · authenticated boundary; CVSS 5.3 (MEDIUM); EPSS percentile 6; sources: NVD, OSV.
CVE-2026-105117 MEDIUM CVSS 5.3 -
NVD: OpenAM before 16.1.3 contains an email content injection vulnerability that allows unauthenticated attackers to control notification email wording via the forgotPassword and register actions on /json/{realm}/users. NVD: Attackers can supply subject and message fields to send phishing mail from the organisation's configured From address, or abuse register as a relay to arbitrary recipients. OSV: OpenAM before 16.1.3 Email Content Injection via Users REST Self-Service Actions
This medium severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for remote exposure · authenticated boundary; CVSS 5.3 (MEDIUM); EPSS percentile 5; sources: NVD, OSV.
CVE-2026-105116 MEDIUM CVSS 5.1 -
NVD: OpenAM before 16.1.3 contains a latent cross-site scripting defect that places the SAML message, relay state and target URL unencoded into the load-balancer cookie bounce auto-submit page. NVD: If reachable with cookieHashRedirectEnabled set, crafted requests could execute script in the OpenAM origin, though an unrelated HTTP 500 failure prevents exploitation in released versions. OSV: OpenAM before 16.1.3 Latent XSS in SAML Load-Balancer Cookie Bounce Page
This medium severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for XSS risk; CVSS 5.1 (MEDIUM); EPSS percentile 4; sources: NVD, OSV.
CVE-2026-105118 LOW CVSS 2.3 -
NVD: OpenAM before 16.1.3 contains an open redirect vulnerability that allows unauthenticated attackers to redirect users by supplying an unverified id_token_hint to the /oauth2/connect/endSession endpoint. NVD: Attackers can name any realm client in a forged hint to redirect victims to any registered post-logout URI, enabling phishing that borrows the OpenAM host's trust. OSV: OpenAM before 16.1.3 Open Redirect via Unverified id_token_hint in endSession
This low severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for remote exposure · authenticated boundary; CVSS 2.3 (LOW); EPSS percentile 1; sources: NVD, OSV.
CVE-2026-104983 LOW CVSS 2.1 -
NVD: A vulnerability has been found in Linux Mint Xreader up to 4.6.9. NVD: Impacted is the function g_file_get_child of the file shell/ev-window.c of the component PDF Attachment Saving Handler. NVD: Such manipulation of the argument attachment leads to path traversal.
An attacker may be able to reach files outside the intended application path; CVSS 2.1 (LOW); EPSS percentile 35; sources: NVD, OSV.

Critical High Medium Low KEVKnown Exploited NEWNewly ObservedJ / K Move · ↑ / ↓ Move · Enter Open · Esc Close

Agent Access Agent Data Surface

Read-only static JSON for humans and AI agents. This is a data contract, not an execution surface.

Human Archive Priority Queue JSON Latest Diff Feed Knowledge Graph Trust Layer Proof Metadata Canonical Policy Canonical Envelope Envelope Index EAS Typed Payload Attestation Ledger Signal Item JSON Remediation Handoff Agent Manifest Static Manifest Schema

Knowledge Graph / JSON-LDlinks CVE signals, sources, affected products, and provenanceLocal-first Vaultbrowser-only personal review context; import/export/clear supportedRirastaFab Trust Layerhash-only integrity metadata, canonical envelopes, and proof endpointsCanonical Envelopeattestation-ready preflight metadata without onchain submission

Agents should start with /agent.json, validate the signal item schema, use the JSON-LD graph for provenance, and treat the Local Vault as private browser state that is never uploaded.

WebMCP read-only toolsEnabledRuntime server endpointsNoneStatic agent JSONEnabled

Allowedsearch / list / get / summarize / prioritize

Disabledscan / patch / exploit / external execution / auto remediation

Last generated: 2026-10-10 09:55 UTC / 2026-10-10 18:55 JST. Observed dates are per-source signal timestamps.

Latest Changes Diff Feed

previous successful latestpublic snapshot comparison

40 public-safe changes since the previous successful snapshot.

Added20

Changed0

Removed20

What changed

CVE-2026-103065: newly added to the public-safe set.
CVE-2026-103342: newly added to the public-safe set.
CVE-2026-104983: newly added to the public-safe set.
37 more public-safe changes in the JSON feed.

Previous snapshot2026-10-10 00:59 UTC / 2026-10-10 09:59 JST

Items compared20 -> 20

Feed generated2026-10-10 09:55 UTC / 2026-10-10 18:55 JST

Open latest diff feed

Enrichment Coverage partial

Coverage is shown from the current public dataset. CPE, PURL, and canonical vendor/product are partial and may be unknown.

NVD20

Vendor Advisory20

OSV17

Affected products0partial

CPE0partial

PURL0partial

Canonical vendor/product0partial

Observed Buckets (current snapshot)

Current snapshot only. Historical trend appears after multiple generated runs.

2026-10-1020

Severity Distribution

CRITICAL 1
HIGH 8
MEDIUM 9
LOW 2
NONE 0
UNKNOWN 0

Source Distribution (current snapshot)

NVD20

Vendor Advisory20

OSV17

Monitored Vendors

View all vendors →

Vendor distribution from the current public snapshot. Neutral badges are not official vendor logos.

Local-first Personal Data Vault

A browser-only vault for human review context. It stores vendor / product / package / CPE prefix / saved signals / muted signals / preferences in localStorage, supports import/export/clear, validates shape on import, and never uploads data.

Import Vault JSON

No watched signals yet. Use the heart control on a signal row to add one.

Saved Views

Save and reapply local filter sets. Nothing is uploaded.

No saved views. Enter a name and save the current filters.

Read-only Triage Report Preview

Generated from the current filters. Defensive checklist only; no exploit or scanning detail.

Filtered signals20

Top priority candidateCVE-2026-105105

Critical / High1 / 8

Safety moderead-only, public indexable, public-safe

Raw JSON details

{
  "count": 20,
  "defensive_checklist": [
    "Confirm affected products",
    "Review official source references",
    "Prioritize KEV, critical CVSS, and high EPSS percentile items",
    "Record human confirmation"
  ],
  "mode": "read_only_public_beta_dashboard",
  "safety": {
    "procedural_detail": false,
    "public_launch": true,
    "scanner_execution": false
  },
  "severity_distribution": {
    "CRITICAL": 1,
    "HIGH": 8,
    "LOW": 2,
    "MEDIUM": 9,
    "NONE": 0,
    "UNKNOWN": 0
  },
  "top_risk": "CVE-2026-105105"
}

Source Status

NVD20 signalsLast observed: 2026-10-10Status: healthy

EPSS20 signalsLast observed: 2026-10-10Status: healthy

OSV17 signalsLast observed: 2026-10-10Status: healthy

Vendor Advisory20 signalsLast observed: 2026-10-10Status: observed

Safety Guardrails

Public indexingEnabled

Read-only surfaceEnabled

Deploy controlsCodex managed deploy only

External notificationDisabled

Auto remediationDisabled

Runtime server endpointsNone

WebMCP read-only toolsEnabled

Static agent JSONEnabled