CVE Tracker: vulnerabilities by vendor, severity and exploitation status

CVE Tracker

30 records

Every published CVE from the last 120 days with CVSS score, vendor and product, cross-referenced against CISA's Known Exploited Vulnerabilities catalog. 8 added to KEV in the last 7 days.

SeverityAll critical high medium lowExploitedIn CISA KEV

CVE	CVSS	EPSS	KEV sources	Patch window	Vendor / product	Summary	Published
CVE-2026-48282exploited	10	42.4%	3/3	+2d	adobe / coldfusion	ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of a Pathname to a Restrict	115d ago
CVE-2026-49869exploited	10	2.1%	3/3	+61d	kestra / kestra	Kestra is an open-source, event-driven orchestration platform.	118d ago
CVE-2026-48558exploited	10	5.7%	3/3	+17d	simple-help / simplehelp	SimpleHelp versions 5.5.15 and prior and 6.0 pre-release versions contain an authentication bypass vulnerability i	133d ago
CVE-2026-10520exploited	10	99.9%	3/3	+1d	ivanti / standalone sentry	An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a r	136d ago
CVE-2026-34910exploited	10	45.8%	3/3	+18d	ui / unifi os server	A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in Uni	154d ago
CVE-2026-34909exploited	10	1.8%	3/3	+18d	ui / unifi os server	A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi OS device	154d ago
CVE-2026-34908exploited	10	15.2%	3/3	+18d	ui / unifi os server	A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi	154d ago
CVE-2026-20182zero day	10	91.8%	3/3	same day	cisco / catalyst sd-wan manager	May 2026: This security advisory provides the details and fix information for a vulnerability that was discovered	162d ago
CVE-2026-8452exploited	9.8	1.0%	3/3	+48d	citrix / netscaler application delivery controller	Memory overflow vulnerability NetScaler ADC and NetScaler Gateway leading to unpredictable or erroneous behavior an	115d ago
CVE-2026-56290zero day	9.8	30.9%	3/3	2d before	joomlack / page builder ck	Joomla Extension - joomlack.fr - Unauthenticated file upload in Page Builder CK extension < 3.6.0 - The Joomla ext	116d ago
CVE-2026-48939exploited	9.8	20.1%	3/3	+20d	joomlic / icagenda	A vulnerability in the iCagenda extension for Joomla allows the upload of arbitrary files in the file attachment f	125d ago
CVE-2026-48908zero day	9.8	88.5%	3/3	5d before	ollyo / sp page builder	A vulnerability in SP Page Builder for Joomla allows unauthenticated users to upload arbitrary files, ultimately r	125d ago
CVE-2026-12569exploited	9.8	46.0%	3/3	+7d	ptc / flexplm	A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill PDMlink and PTC FlexPLM.	127d ago
CVE-2026-35273zero day	9.8	96.7%	3/3	same day	oracle / peoplesoft enterprise peopletools	Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environmen	134d ago
CVE-2026-20253exploited	9.8	96.9%	3/3	+5d	splunk / splunk	In Splunk Enterprise 10.2 versions below 10.2.4 and 10 versions below 10.0.7, an unauthenticated user could create	135d ago
CVE-2026-25089exploited	9.8	76.1%	3/3	+6d	fortinet / fortisandbox	A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fort	136d ago
CVE-2026-48907exploited	9.8	16.2%	3/3	+7d	widgetfactorylimited / jce	A vulnerability in the JCE editor extension for Joomla allows the creation of new editor profiles for unauthentica	140d ago
CVE-2026-46817exploited	9.8	0.81%	3/3	+32d	oracle / e-business suite	Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission).	148d ago
CVE-2026-48027zero day	9.8	1.3%	3/3	same day	nx / nx console	Nx Console is the user interface for Nx & Lerna.	149d ago
CVE-2026-45247exploited	9.8	2.1%	3/3	+3d	mirasvit / full page cache warmer	Mirasvit Full Page Cache Warmer for Magento 2 before version 1.11.12 contains a PHP object injection vulnerability	150d ago
CVE-2026-48172zero day	9.8	1.0%	3/3	same day	litespeedtech / litespeed cpanel plugin	LiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (possibly to root), as exploited in the	155d ago
CVE-2026-9082exploited	9.8	15.7%	3/3	+2d	drupal / drupal	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Drupal	156d ago
CVE-2026-8398zero day	9.8	0.96%	3/3	7d before	disc-soft / daemon tools	A supply chain attack compromised the official installation packages of DAEMON Tools Lite (Windows versions 12.5.0.	161d ago
CVE-2026-3055exploited	9.8	4.0%	3/3	+6d	citrix / netscaler application delivery controller	Insufficient input validation in NetScaler ADC and NetScaler Gateway when configured as a SAML IDP leading to memor	214d ago
CVE-2026-33017zero day	9.8	24.8%	3/3	1d before	langflow / langflow	Langflow is a tool for building and deploying AI-powered agents and workflows.	217d ago
CVE-2025-67038exploited	9.8	20.0%	3/3	+104d	lantronix / eds5032 firmware	An issue was discovered in Lantronix EDS5000 2.1.0.0R3.	226d ago
CVE-2026-8037exploited	9.6	77.4%	3/3	+27d	progress / connection manager for objectscale	OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated	141d ago
CVE-2026-45321exploited	9.6	1.1%	3/3	+15d	tanstack / tanstack\/arktype-adapter	On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages wer	164d ago
CVE-2026-50751zero day	9.3	85.3%	3/3	same day	checkpoint / gaia os	A logic flow weakness in Remote Access and Mobile Access certificate validation in deprecated IKEv1 key exchange a	137d ago
CVE-2026-0257exploited	9.1	96.9%	3/3	+16d	paloaltonetworks / pan-os	Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® softwar	163d ago

Sources: NIST National Vulnerability Database (descriptions, CVSS, CPE); CISA KEV, ENISA EUVD, CIRCL and VulnCheck (exploitation status, three catalogues counted; CIRCL shown as an aggregator); FIRST EPSS (exploitation probability). Patch window is the gap between CVE publication and the earliest KEV listing, so a negative value means a catalogue called it exploited before it was disclosed. Data refreshes every five hours.

Loading

CVE Tracker