Statistics

Top 10 CVEs by exploit probability (EPSS)EPSS (Exploit Prediction Scoring System) from FIRST.org. Estimates the probability a CVE will be exploited in the wild within the next 30 days, based on real-world exploit activity. Source: api.first.org/data/v1/epss

• CVE-2025-3248EPSS 100.0%CVE-2025-3248: Langflow code injection in /api/v1/validate/code endpointCriticalWeaponizedPatched
• CVE-2026-39987EPSS 99.7%CVE-2026-39987: Marimo Remote Code Execution VulnerabilityCriticalActively exploitedPatched
• CVE-2025-68613EPSS 99.0%CVE-2025-68613: n8n Improper Control of Dynamically-Managed Code Resources VulnerabilityCriticalActively exploitedPatched
• CVE-2026-33017EPSS 96.2%GHSA-vwmf-pq79-vjvx: Unauthenticated Remote Code Execution in Langflow via Public Flow Build EndpointCriticalActively exploited
• CVE-2025-34291EPSS 92.8%CVE-2025-34291: Langflow account takeover and remote code execution via CORS and refresh tokenHighActively exploitedPatched
• CVE-2026-42271EPSS 91.4%CVE-2026-42271: LiteLLM command execution through MCP test endpointsCriticalActively exploitedPatched
• CVE-2023-6909EPSS 89.7%CVE-2023-6909: mlflow/mlflow path traversal via crafted \..\filename inputHighPatched
• CVE-2024-37032EPSS 89.6%CVE-2024-37032: Ollama path traversal in digest validation when getting model pathHighPatched
• CVE-2026-42208EPSS 89.4%CVE-2026-42208: LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.81.16 to before…CriticalActively exploitedPatched
• CVE-2025-59528EPSS 86.5%CVE-2025-59528: Flowise remote code execution through CustomMCP node configurationCriticalPatched

This week vs last week

This week runs to day 3 of 7, so its counts are partial.

Classification analytics

LLM-classified attributes across all item types.

Vendor vulnerability breakdownCounts items where this vendor appears in the affected_vendors field AND the item is a vulnerability or incident (not news). Severity comes from the source advisory when it gives one. Otherwise the classifier assigns it from the source text.

Vulnerabilities and incidents only (excludes news and research).

Coverage summary

Monthly trend

All item types combined.