Complete CVE monitoring — free

Track every vendor and platform without a paywall.

Choose the infrastructure you run, receive source-linked CVE alerts by email, and check published end-of-life dates. Use the Android app when you also want phone notifications.

32 official vendor sources Every supported vendor and platform is included free No payment details required

Set up free email alerts Explore the Android app

Free email delivery

Email alerts

Follow any whole vendor or exact platform. Matching advisories arrive in your verified inbox with severity, affected products, fixes and the official source.

Create email alerts

Email + phone

Android app

Take the same vendor and platform coverage with you. Choose email, phone push notifications, or both for each rule and open the advisory in one tap.

Get the app App details

Source-linked dates

EOL checker

Choose a validated vendor, product and release or model to review published maintenance, security-support and final-support milestones.

Check a product lifecycle

Latest verified advisoryCritical [CVE-2026-66786] ipsec.conf stanza injection via remote-supplied CableName and SubnetsRed Hat·Critical·CVE-2026-66786·CVSS 9.1

Now available on Google Play

Your vendor and platform CVE alerts, now in your pocket.

Track every supported product across 32 official vendor sources and 160+ precise platforms. Choose phone notifications, email, or both—then open the official advisory from the alert. Everything is included free.

Every vendor + platform freeCritical and high alertsEmail + phone delivery

Get it on Google Play Explore the Android app

Phone notificationnow

Critical Cisco Secure Firewall advisory

Matches your Firewalls platform rule. Tap to review affected and fixed releases.

Email receivedInbox

Your VulniPulse watchlist has a new match

Severity, product scope, remediation and the official vendor source—together.

Need a practical monitoring workflow?

Choose the vendors and platforms you run, follow authoritative advisories, prioritise exploitation evidence, and route matching alerts to your inbox.

Read the operator guide

CISA KEV

202

Latest critical & high advisories by vendor

Three risk-prioritised advisories per vendor. Open a vendor to load its complete feed.

Browse all advisories

Cisco63 critical/high

Critical10.0

Critical [CVE-2026-20127] Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability

Track every vendor and platform without a paywall.

Email alerts

Android app

EOL checker

Your vendor and platform CVE alerts, now in your pocket.

Need a practical monitoring workflow?

Latest critical & high advisories by vendor

Critical [CVE-2026-20127] Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability

Critical [CVE-2026-20182] Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability

Critical [CVE-2026-20122 +4] Cisco Catalyst SD-WAN Vulnerabilities

Critical [CVE-2026-25089] Second-Order OS Command Injection via JSON Input on start vnc feature

Critical [CVE-2026-39808] OS Command Injection through API endpoint

Critical [CVE-2026-35616] API authentication and authorization bypass

Critical [CVE-2026-0300] PAN-OS: Unauthenticated user initiated Buffer Overflow Vulnerability in User-ID™ Authentication Portal

Critical [CVE-2024-0012 +1] PAN-OS: Authentication Bypass in the Management Web Interface (PAN-SA-2024-0015)

Critical [CVE-2026-0288] PAN-OS: Buffer Overflow Vulnerabilities in User-ID Terminal Server Agent

Critical [CVE-2026-33784] Use of Default Password vulnerability in the Juniper Networks Support Insights (JSI) Virtual Lightweight Collector (vLWC) allows an unauthenticated, network-based attacker to take full control of the device

Critical [CVE-2026-21902] Junos: Incorrect Permission Assignment for Critical Resource vulnerability in the On-Box Anomaly detection framework of Juniper…

Critical [CVE-2025-21589] Authentication Bypass Using an Alternate Path or Channel vulnerability in Juniper Networks Session Smart Router may

Critical [CVE-2026-63456] Authentication bypass via spoofed HTTP headers Orchestrator REST API

Critical [CVE-2026-23813] vulnerability has been identified in the web-based management interface of AOS-CX switches that could potentially

High [CVE-2026-44879] Authenticated Command Injection allows arbitrary command execution in CLI Interface

Critical [CVE-2020-14040 +33] List of Security Fixes and Improvements in Veeam Kasten for Kubernetes

Critical [CVE-2026-58067 +3] Vulnerabilities Resolved in Veeam Service Provider Console 9.3

Critical [CVE-2026-58074 +5] Vulnerabilities Resolved in Veeam ONE 13.1

Critical [CVE-2026-59310] vCenter: VMware vCenter contains a directory traversal vulnerability in the Syslog server.

Critical [CVE-2026-47876] VMXNET3 out-of-bounds write vulnerability

Critical [CVE-2026-59309] vCenter authentication-bypass vulnerability

Critical [CVE-2026-58644] Microsoft SharePoint Remote Code Execution Vulnerability

Critical [CVE-2026-55040] Microsoft SharePoint Server Security Feature Bypass Vulnerability

Critical [CVE-2026-33824] Windows Internet Key Exchange (IKE) Service Extensions Remote Code Execution Vulnerability

Critical [CVE-2025-34028] Vulnerability in Commvault Command Center Installation

Critical [CVE-2023-46604] Remote Code Execution Vulnerability in Apache ActiveMQ

Critical [CVE-2023-4863] Libwebp Vulnerability

Critical [CVE-2026-11645] Out of bounds memory access in V8

Critical [CVE-2026-42208] Unauthorized data access and modification via SQL injection

Critical [CVE-2026-5281] Use after free in Dawn

Critical [CVE-2026-34884] SSRF via set_skywalking_url Tool and GraphQL expression injection vulnerability in Apache SkyWalking MCP

Critical [CVE-2026-73240] Specifically crafted inputs may lead to git argument injection in Apache Allura

Critical [CVE-2026-71290] Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer

Critical [CVE-2025-7775 +2] Critical security update announced for NetScaler Gateway and NetScaler

Critical [CVE-2023-3519] NetScaler ADC: Unauthenticated remote code execution

Critical [CVE-2026-19490] NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2026-19490

Critical [CVE-2026-10520] OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions

Critical [CVE-2025-0282] stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 allows a remote unauthenticated attacker to achieve remote code execution

Critical [CVE-2023-35078] Endpoint Manager Mobile: authentication bypass vulnerability in Ivanti EPMM allows unauthorized users to access restricted functionality or resources of the application without proper authentication

Critical [CVE-2025-12686] Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in AdminCenter in Synology BeeStation OS before 1.3.2-65648 allows remote attackers to execute arbitrary code via unspecified vectors

High [CVE-2026-4793] incorrect default permissions vulnerability in Synology Assistant before 7.0.7-50095 allows local users to read or write arbitrary files and conduct denial-of-service during installation

High [CVE-2022-49042] inclusion of functionality from untrusted control sphere vulnerability in MinGW DLL component in Synology Hyper Backup…

Critical [CVE-2026-15409 +1] Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface.

Critical [CVE-2026-66145 +5] GMS: unauthenticated remote code execution vulnerability was identified in GMS 9.5.1 (Build 9510.1044) and earlier versions which…

High [CVE-2026-66149 +1] Email Security: Improper Control of Generation of Code ('Code Injection') Vulnerability in the SonicWall Email Security appliance allows an aut…

Critical [CVE-2023-30799] RouterOS: MikroTik RouterOS stable before 6.49.7 and long-term through 6.48.6 are vulnerable to a privilege escalation issue.

High [CVE-2024-27686] Mikrotik RouterOS (x86) 6.40.5 through 6.49.10 (fixed in 7) allows a remote attacker to cause a denial of service (device crash) via crafted packet data to the SMB service on TCP port 445

High [CVE-2025-10948] RouterOS: vulnerability has been found in MikroTik RouterOS 7.

High [CVE-2026-22927] Omnissa Workspace ONE Tunnel for Windows addresses a Local Privilege Escalation Vulnerability.

High [CVE-2026-22926] Omnissa Workspace ONE Assist for macOS contains a Local Privilege Escalation Vulnerability.

High [CVE-2025-25234] UAG: Omnissa UAG contains a Cross-Origin Resource Sharing (CORS) bypass vulnerability.

Critical [CVE-2010-5330] airMAX: On certain Ubiquiti devices, Command Injection exists via a GET request to stainfo.cgi (aka Show AP info)

Critical [CVE-2019-25651] Ubiquiti UniFi Network Controller prior to 5.10.12 (excluding 5.6.42), UAP FW prior to 4.0.6, UAP-AC, UAP-AC v2, and UAP-AC…

Critical [CVE-2024-54750] Ubiquiti U6-LR 6.6.65 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which

Critical [CVE-2025-69691] Netgate pfSense CE 2.8.0 allows code execution in the XMLRPC API via pfsense.exec_php

Critical [CVE-2025-69690] Netgate pfSense CE 2.7.2 allows code execution by using the module installer with a backup file with a serialized PHP object containing the post_reboot_commands property

Critical [CVE-2023-29974] issue discovered in Pfsense CE version 2.6.0 allows attackers to compromise user accounts via weak password requirements

Critical [CVE-2026-25199] Instances deployed via the Proxmox extension allow unauthorized access to instances belonging to other tenants

Critical [CVE-2024-9486] Proxmox: security issue was discovered in the Kubernetes Image Builder versions <= v0.1.37 where default credentials are enabled during…

Critical [CVE-2022-31358] reflected cross-site scripting (XSS) vulnerability in Proxmox Virtual Environment prior to v7.2-3

Critical [CVE-2022-27593] QTS: externally controlled reference to a resource vulnerability has been reported to affect QNAP NAS running Photo Station

Critical [CVE-2018-19949] QTS: If exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands.

Critical [CVE-2019-7195] Photo Station: This external control of file name or path vulnerability allows remote attackers to access or modify system files.

Critical [CVE-2026-40976] Spring Boot Vulnerability in NetApp Products

Critical [CVE-2026-31589] Linux Kernel Vulnerability in NetApp Products

Critical [CVE-2026-64391] Linux Kernel Vulnerability in NetApp Products

Critical [CVE-2025-53521] When a BIG-IP APM access policy is configured on a virtual server, specific malicious traffic can

Critical [CVE-2023-46747] Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the BIG-IP…

Critical [CVE-2022-1388] On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x…

Critical [CVE-2023-1671] pre-auth command injection vulnerability in the warn-proceed handler of Sophos Web Appliance older than version 4.3.10.4

Critical [CVE-2022-3236] Sophos Firewall: code injection vulnerability in the User Portal and Webadmin

Critical [CVE-2022-1040] Sophos Firewall: authentication bypass vulnerability in the User Portal and Webadmin

Critical [CVE-2026-16232] authentication bypass vulnerability in the Check Point SmartConsole login process allows an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges