CVE Tracker: vulnerabilities by vendor, severity and exploitation status

CVE Tracker

51 records

Every published CVE from the last 120 days with CVSS score, vendor and product, cross-referenced against CISA's Known Exploited Vulnerabilities catalog. 9 added to KEV in the last 7 days.

SeverityAll critical high medium lowExploitedIn CISA KEV

CVE	CVSS	EPSS	KEV sources	Patch window	Vendor / product	Summary	Published
CVE-2026-48282exploited	10	42.4%	3/3	+2d	adobe / coldfusion	ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of a Pathname to a Restrict	112d ago
CVE-2026-49869exploited	10	2.1%	3/3	+61d	kestra / kestra	Kestra is an open-source, event-driven orchestration platform.	116d ago
CVE-2026-48558exploited	10	5.7%	3/3	+17d	simple-help / simplehelp	SimpleHelp versions 5.5.15 and prior and 6.0 pre-release versions contain an authentication bypass vulnerability i	130d ago
CVE-2026-10520exploited	10	99.9%	3/3	+1d	ivanti / standalone sentry	An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a r	133d ago
CVE-2026-34910exploited	10	45.8%	3/3	+18d	ui / unifi os server	A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in Uni	152d ago
CVE-2026-34909exploited	10	1.8%	3/3	+18d	ui / unifi os server	A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi OS device	152d ago
CVE-2026-34908exploited	10	15.2%	3/3	+18d	ui / unifi os server	A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi	152d ago
CVE-2026-20182zero day	10	91.8%	3/3	same day	cisco / catalyst sd-wan manager	May 2026: This security advisory provides the details and fix information for a vulnerability that was discovered	159d ago
CVE-2026-8452exploited	9.8	1.0%	3/3	+48d	citrix / netscaler application delivery controller	Memory overflow vulnerability NetScaler ADC and NetScaler Gateway leading to unpredictable or erroneous behavior an	113d ago
CVE-2026-56290zero day	9.8	30.9%	3/3	2d before	joomlack / page builder ck	Joomla Extension - joomlack.fr - Unauthenticated file upload in Page Builder CK extension < 3.6.0 - The Joomla ext	113d ago
CVE-2026-48939exploited	9.8	20.1%	3/3	+20d	joomlic / icagenda	A vulnerability in the iCagenda extension for Joomla allows the upload of arbitrary files in the file attachment f	123d ago
CVE-2026-48908zero day	9.8	88.5%	3/3	5d before	ollyo / sp page builder	A vulnerability in SP Page Builder for Joomla allows unauthenticated users to upload arbitrary files, ultimately r	123d ago
CVE-2026-12569exploited	9.8	46.0%	3/3	+7d	ptc / flexplm	A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill PDMlink and PTC FlexPLM.	125d ago
CVE-2026-35273zero day	9.8	96.7%	3/3	same day	oracle / peoplesoft enterprise peopletools	Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environmen	132d ago
CVE-2026-20253exploited	9.8	96.9%	3/3	+5d	splunk / splunk	In Splunk Enterprise 10.2 versions below 10.2.4 and 10 versions below 10.0.7, an unauthenticated user could create	132d ago
CVE-2026-25089exploited	9.8	76.1%	3/3	+6d	fortinet / fortisandbox	A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fort	133d ago
CVE-2026-48907exploited	9.8	16.2%	3/3	+7d	widgetfactorylimited / jce	A vulnerability in the JCE editor extension for Joomla allows the creation of new editor profiles for unauthentica	138d ago
CVE-2026-46817exploited	9.8	0.81%	3/3	+32d	oracle / e-business suite	Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission).	145d ago
CVE-2026-48027zero day	9.8	1.3%	3/3	same day	nx / nx console	Nx Console is the user interface for Nx & Lerna.	146d ago
CVE-2026-45247exploited	9.8	2.1%	3/3	+3d	mirasvit / full page cache warmer	Mirasvit Full Page Cache Warmer for Magento 2 before version 1.11.12 contains a PHP object injection vulnerability	147d ago
CVE-2026-48172zero day	9.8	1.0%	3/3	same day	litespeedtech / litespeed cpanel plugin	LiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (possibly to root), as exploited in the	153d ago
CVE-2026-9082exploited	9.8	15.7%	3/3	+2d	drupal / drupal	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Drupal	153d ago
CVE-2026-8398zero day	9.8	0.96%	3/3	7d before	disc-soft / daemon tools	A supply chain attack compromised the official installation packages of DAEMON Tools Lite (Windows versions 12.5.0.	159d ago
CVE-2026-3055exploited	9.8	4.0%	3/3	+6d	citrix / netscaler application delivery controller	Insufficient input validation in NetScaler ADC and NetScaler Gateway when configured as a SAML IDP leading to memor	211d ago
CVE-2026-33017zero day	9.8	24.8%	3/3	1d before	langflow / langflow	Langflow is a tool for building and deploying AI-powered agents and workflows.	215d ago
CVE-2025-67038exploited	9.8	20.0%	3/3	+104d	lantronix / eds5032 firmware	An issue was discovered in Lantronix EDS5000 2.1.0.0R3.	223d ago
CVE-2026-8037exploited	9.6	77.4%	3/3	+27d	progress / connection manager for objectscale	OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated	139d ago
CVE-2026-45321exploited	9.6	1.1%	3/3	+15d	tanstack / tanstack\/arktype-adapter	On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages wer	162d ago
CVE-2026-50751zero day	9.3	85.3%	3/3	same day	checkpoint / gaia os	A logic flow weakness in Remote Access and Mobile Access certificate validation in deprecated IKEv1 key exchange a	135d ago
CVE-2026-0257exploited	9.1	96.9%	3/3	+16d	paloaltonetworks / pan-os	Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® softwar	160d ago
CVE-2026-53266exploited	8.8	0.83%	3/3	+85d	linux / linux kernel	In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: make ebt_snat ARP rewrite w	118d ago
CVE-2026-7273exploited	8.8	2.5%	3/3	+97d	—	A stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versions through 2.9	127d ago
CVE-2026-11645zero day	8.8	2.4%	3/3	1d before	google / chrome	Out of bounds read and write in V8 in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute a	134d ago
CVE-2026-45659exploited	8.8	2.7%	3/3	+40d	microsoft / sharepoint server	Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code ove	151d ago
CVE-2026-33634zero day	8.8	1.7%	3/3	same day	aquasec / setup-trivy	Trivy is a security scanner.	211d ago
CVE-2026-3910zero day	8.8	1.1%	3/3	1d before	google / chrome	Inappropriate implementation in V8 in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to execute arb	221d ago
CVE-2026-3909zero day	8.8	2.3%	3/3	1d before	google / chrome	Out of bounds write in Skia in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to perform out of bou	221d ago
CVE-2026-20230exploited	8.6	88.2%	3/3	+19d	cisco / unified communications manager	A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Sess	139d ago
CVE-2026-54420zero day	8.5	0.81%	3/3	13d before	litespeedtech / litespeed cpanel plugin	LiteSpeed cPanel plugin before 2.4.8 (as distributed in LiteSpeed WHM PlugIn before 5.3.2.0) mishandles symlinks p	129d ago
CVE-2026-55255exploited	8.4	0.89%	3/3	+3d	langflow / langflow	Langflow is a tool for building and deploying AI-powered agents and workflows.	119d ago
CVE-2025-48595zero day	8.4	1.7%	3/3	same day	google / android	In multiple locations, there is a possible way to achieve code execution due to an integer overflow.	141d ago
CVE-2026-42897zero day	8.1	0.52%	3/3	same day	microsoft / exchange server	Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server	159d ago
CVE-2026-53362exploited	7.8	0.71%	3/3	+54d	linux / linux kernel	In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocat	109d ago
CVE-2026-20245exploited	7.8	25.3%	3/3	+1d	cisco / catalyst sd-wan manager	A vulnerability in the CLI of Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Mana	138d ago
CVE-2026-41091zero day	7.8	0.44%	3/3	1d before	microsoft / malware protection engine	Improper link resolution before file access ('link following') in Microsoft Defender allows an authorized attacker	154d ago
CVE-2026-28318exploited	7.5	1.9%	3/3	+1d	solarwinds / serv-u	SolarWinds Serv-U is susceptible to specially crafted POST requests that crash the Serv-U service without authenti	138d ago
CVE-2026-34926zero day	6.7	0.54%	3/3	same day	trendmicro / apex one	A directory traversal vulnerability in the Apex One (on-premise) server could allow a pre-authenticated local atta	153d ago
CVE-2026-20262zero day	6.5	28.2%	3/3	same day	cisco / catalyst sd-wan manager	A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an authentica	127d ago
CVE-2026-48710zero day	6.5	7.1%	3/3	same day	encode / starlette	Starlette is a lightweight ASGI framework/toolkit.	147d ago
CVE-2026-7473zero day	5.8	0.65%	3/3	31d before	arista / eos	On affected platforms running Arista EOS where a tunnel decapsulation configuration—such as VXLAN (Virtual Extensib	137d ago
CVE-2026-45498zero day	4	1.3%	3/3	1d before	microsoft / defender antimalware platform	Microsoft Defender Denial of Service Vulnerability	154d ago

Sources: NIST National Vulnerability Database (descriptions, CVSS, CPE); CISA KEV, ENISA EUVD, CIRCL and VulnCheck (exploitation status, three catalogues counted; CIRCL shown as an aggregator); FIRST EPSS (exploitation probability). Patch window is the gap between CVE publication and the earliest KEV listing, so a negative value means a catalogue called it exploited before it was disclosed. Data refreshes every five hours.

Loading

CVE Tracker