CVE Tracker: vulnerabilities by vendor, severity and exploitation status

CVE Tracker

15,513 records

Every published CVE from the last 120 days with CVSS score, vendor and product, cross-referenced against CISA's Known Exploited Vulnerabilities catalog. 8 added to KEV in the last 7 days.

SeverityAll critical high medium lowExploitedIn CISA KEV

CVE	CVSS	EPSS	KEV sources	Patch window	Vendor / product	Summary	Published
CVE-2026-2603	8.1	—	—	—	redhat / build of keycloak	A flaw was found in Keycloak.	225d ago
CVE-2026-32841	8.1	—	—	—	edimax / gs-5008pl firmware	Edimax GS-5008PL firmware versions 1.00.54 and prior contain an authentication bypass vulnerability that allows un	225d ago
CVE-2026-30707	8.1	—	—	—	—	An issue was discovered in SpeedExam Online Examination System (SaaS) after v.FEV2026.	225d ago
CVE-2026-24901	8.1	—	—	—	getoutline / outline	Outline is a service that allows for collaborative documentation.	225d ago
CVE-2026-30911	8.1	—	—	—	apache / airflow	Apache Airflow versions 3.1.0 through 3.1.7 missing authorization vulnerability in the Execution API's Human-in-th	225d ago
CVE-2026-3559	8.1	—	—	—	philips / hue bridge v2 firmware	Philips Hue Bridge HomeKit Accessory Protocol Static Nonce Authentication Bypass Vulnerability.	226d ago
CVE-2026-3558	8.1	—	—	—	philips / hue bridge v2 firmware	Philips Hue Bridge HomeKit Accessory Protocol Transient Pairing Mode Authentication Bypass Vulnerability.	226d ago
CVE-2026-32729	8.1	—	—	—	runtipi / runtipi	Runtipi is a personal homeserver orchestrator.	226d ago
CVE-2026-20990	8.1	—	—	—	samsung / android	Improper export of android application components in Secure Folder prior to SMR Mar-2026 Release 1 allows local at	226d ago
CVE-2026-32302	8.1	—	—	—	openclaw / openclaw	OpenClaw is a personal AI assistant.	229d ago
CVE-2026-30914	8.1	—	—	—	sftpgo project / sftpgo	SFTPGo is an open source, event-driven file transfer solution.	229d ago
CVE-2026-22202	8.1	—	—	—	gvectors / wpdiscuz	wpDiscuz before 7.6.47 contains a cross-site request forgery vulnerability that allows attackers to delete all com	229d ago
CVE-2026-22193	8.1	—	—	—	gvectors / wpdiscuz	wpDiscuz before 7.6.47 contains an SQL injection vulnerability in the getAllSubscriptions() function where string	229d ago
CVE-2026-32260	8.1	—	—	—	deno / deno	Deno is a JavaScript, TypeScript, and WebAssembly runtime.	230d ago
CVE-2026-32247	8.1	—	—	—	getzep / graphiti	Graphiti is a framework for building and querying temporal context graphs for AI agents.	230d ago
CVE-2026-32116	8.1	—	—	—	magic-wormhole project / magic wormhole	Magic Wormhole makes it possible to get arbitrary-sized files and directories from one computer to another.	230d ago
CVE-2026-25529	8.1	—	—	—	postalserver / postal	Postal is an open source SMTP server.	230d ago
CVE-2026-31892	8.1	—	—	—	argoproj / argo workflows	Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes.	231d ago
CVE-2026-86185	8	—	—	—	—	Bilibili Desktop through 1.18.0 disables TLS certificate verification process-wide and executes unsigned remote Ja	53d ago
CVE-2026-86140	8	—	—	—	—	In libxml2 before 2.15.4, xmlSnprintfElements in valid.c has a strcat stack-based buffer overflow.	54d ago
CVE-2026-53932	8	—	—	—	—	laravel-backup-restore restores database backups made with spatie/laravel-backup.	54d ago
CVE-2026-85012	8	—	—	—	—	Improper neutralization of special elements used in an OS command (CWE-78) in the blueprint resynthesis framework	55d ago
CVE-2026-80747	8	—	—	—	—	In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Add bounds check for CRAT subtype	55d ago
CVE-2026-49832	8	—	—	—	—	DSpace open source software is a repository application which provides durable access to digital resources.	56d ago
CVE-2026-79755	8	—	—	—	—	Nuclio is a "Serverless" framework for Real-Time Events and Data Processing.	56d ago
CVE-2026-52833	8	—	—	—	—	Nuclio is a "Serverless" framework for Real-Time Events and Data Processing.	56d ago
CVE-2026-52831	8	—	—	—	—	Nuclio is a "Serverless" framework for Real-Time Events and Data Processing.	56d ago
CVE-2026-84665	8	—	—	—	—	Jenkins SonarQube Scanner Plugin 2.18.3 and earlier does not limit URL schemes for the dashboard links it creates	56d ago
CVE-2026-59680	8	—	—	—	—	An OS command injection vulnerability was found in yast2-users.	57d ago
CVE-2026-82282	8	—	—	—	—	Atlantis through 0.47.1 fails to authenticate the /github-app/setup endpoint, allowing unauthenticated attackers t	61d ago
CVE-2026-77586	8	—	—	—	—	In MongoDB Connector for BI, MongoDB object names such as collection, field, and index names are placed into the q	61d ago
CVE-2026-75486	8	—	—	—	—	Synk Sweater Comb before 3.8.8 contains a command injection vulnerability that allows an attacker who controls the	61d ago
CVE-2026-59307	8	—	—	—	vmware / spring integration	An operator who calls JdbcMessageStore.addAllowedPatterns(...) to restrict deserialization receives no protection	62d ago
CVE-2026-24169	8	—	—	—	—	NVIDIA UFM Enterprise contains a vulnerability in the plugin management API, where an authenticated user with low	64d ago
CVE-2026-79662	8	—	—	—	—	Ech0 through 4.5.6 contains an OAuth redirect URI validation vulnerability in parseAndValidateClientRedirect (inte	64d ago
CVE-2026-78414	8	—	—	—	—	Cross-site scripting in the Web Administration interface of Network Optix Nx Witness VMS before version 6.1.3 on L	65d ago
CVE-2026-31880	8	—	—	—	—	Combodo iTop is a web based IT service management tool.	68d ago
CVE-2026-31803	8	—	—	—	—	Combodo iTop is a web based IT service management tool.	68d ago
CVE-2026-30890	8	—	—	—	—	Combodo iTop is a web based IT service management tool.	68d ago
CVE-2026-30826	8	—	—	—	—	Combodo iTop is a web based IT service management tool.	68d ago
CVE-2026-18282	8	—	—	—	—	Sony XAV-9500ES AVRCP_Br_Response_Parser Heap-based Buffer Overflow Remote Code Execution Vulnerability.	69d ago
CVE-2026-18281	8	—	—	—	—	Sony XAV-9500ES l2_reassemble_sdu Heap-based Buffer Overflow Remote Code Execution Vulnerability.	69d ago
CVE-2026-14951	8	—	—	—	—	An low privileged remote attacker can cause authenticated users to perform unintended actions in the FDS Web inter	69d ago
CVE-2026-76139	8	—	—	—	—	A flaw was found in acm-operator-bundle.	70d ago
CVE-2026-71122	8	—	—	—	oracle / business intelligence	Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Platf	71d ago
CVE-2026-70802	8	—	—	—	oracle / public sector human resources	Vulnerability in the Oracle Public Sector Human Resources product of Oracle E-Business Suite (component: Regressio	71d ago
CVE-2026-70690	8	—	—	—	oracle / human resources management system	Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: US Payroll - General).	71d ago
CVE-2026-62602	8	—	—	—	oracle / hyperion calculation manager	Vulnerability in the Oracle Hyperion Calculation Manager product of Oracle Hyperion (component: Security).	71d ago
CVE-2026-60998	8	—	—	—	oracle / identity manager connector	Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Microsoft A	71d ago
CVE-2026-60961	8	—	—	—	oracle / webcenter content	Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).	71d ago
CVE-2026-45790	8	—	—	—	—	Dokploy is a free, self-hostable Platform as a Service (PaaS).	72d ago
CVE-2026-16138	8	—	—	—	progress / sharefile storage zones controller	In Progress ShareFile Storage Zones Controller v5.12.5 and below versions, unsafe deserialization of untrusted fil	72d ago
CVE-2026-74539	8	—	—	—	—	In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: lock sk in iso_sock_getname Ac	74d ago
CVE-2026-74528	8	—	—	—	—	In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: hold conn in hci_past_syn	74d ago
CVE-2026-70454	8	—	—	—	—	rsync 3.2.0 through 3.2.3 (openssl mode) and rsync-ssl through 3.4.4 (stunnel mode) contain a TLS certificate vali	76d ago
CVE-2026-72809	8	—	—	—	—	SiYuan versions <= v3.7.2 (patched in v3.7.4) contain an authentication bypass vulnerability in the kernel's Check	77d ago
CVE-2026-72807	8	—	—	—	—	SiYuan versions before v3.7.4 contain a second-order SQL injection vulnerability in attribute-view template column	77d ago
CVE-2026-65937	8	—	—	—	progress / whatsup gold	In WhatsUp Gold versions released before 2026.0.2, an authenticated attacker can bypass frontend controls and inje	77d ago
CVE-2026-62911	8	—	—	—	microsoft / exchange server	Authentication bypass by capture-replay in Microsoft Exchange Server allows an authorized attacker to elevate priv	78d ago
CVE-2026-57105	8	—	—	—	microsoft / sharepoint server	Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoin	78d ago

Sources: NIST National Vulnerability Database (descriptions, CVSS, CPE); CISA KEV, ENISA EUVD, CIRCL and VulnCheck (exploitation status, three catalogues counted; CIRCL shown as an aggregator); FIRST EPSS (exploitation probability). Patch window is the gap between CVE publication and the earliest KEV listing, so a negative value means a catalogue called it exploited before it was disclosed. Data refreshes every five hours.

Loading

CVE Tracker