CVE Tracker: vulnerabilities by vendor, severity and exploitation status

CVE Tracker

15,513 records

Every published CVE from the last 120 days with CVSS score, vendor and product, cross-referenced against CISA's Known Exploited Vulnerabilities catalog. 8 added to KEV in the last 7 days.

SeverityAll critical high medium lowExploitedIn CISA KEV

CVE	CVSS	EPSS	KEV sources	Patch window	Vendor / product	Summary	Published
CVE-2026-15581	8	—	—	—	—	A flaw was found in the TrustyAI Service (TAS) deployment.	79d ago
CVE-2026-68085	8	—	—	—	—	In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_uart: clear HCI_UART_SENDING wh	79d ago
CVE-2026-68772	8	—	—	—	—	ZenML 0.94.6 contains a remote code execution vulnerability in the CloudpickleMaterializer component that allows a	82d ago
CVE-2026-48080	8	—	—	—	—	OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform.	83d ago
CVE-2026-71312	8	—	—	—	—	rclone is a command-line program to sync files and directories to and from different cloud storage providers.	84d ago
CVE-2026-66297	8	—	—	—	livebook / livebook	Improper Neutralization of Special Elements used in an OS Command (OS Command Injection) vulnerability in livebook	84d ago
CVE-2026-71279	8	—	—	—	—	Zigbee2MQTT's ExternalJSExtension.getFilePath (lib/extension/externalJS.ts) joins a parameter received via an MQTT	84d ago
CVE-2026-16623	8	—	—	—	—	The Create Block WordPress plugin before 2.10.0 does not correctly escape user-supplied text before writing it int	86d ago
CVE-2026-18599	8	—	—	—	—	A flaw has been found in GL.iNet GL-MT3000 up to 4.4.5.	86d ago
CVE-2026-9044	8	—	—	—	tp-link / archer axe75 firmware	An OS command injection vulnerability exists in the VPN module of TP-Link AXE75 V1 routers.	89d ago
CVE-2026-47873	8	—	—	—	—	The Boot Dashboard Docker integration in Spring Tools publishes container control ports on all of the host's netwo	91d ago
CVE-2026-47858	8	—	—	—	—	Starting Spring Boot applications in the Spring Tools with the live information mode enabled makes the running app	91d ago
CVE-2026-12703	8	—	—	—	—	TeamViewer Full Client and Host for macOS before version 15.80 contain a business logic error that can allow an au	91d ago
CVE-2026-59690	8	—	—	—	progress / connection manager for objectscale	A Missing Authorization vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connec	93d ago
CVE-2026-59689	8	—	—	—	progress / connection manager for objectscale	An Incorrect Authorization vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Con	93d ago
CVE-2026-64406	8	—	—	—	linux / linux kernel	In the Linux kernel, the following vulnerability has been resolved: Bluetooth: fix UAF in bt_accept_dequeue() bt_a	95d ago
CVE-2026-12736	8	—	—	—	—	The Wpify Woo plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 5.4.16.	97d ago
CVE-2026-35425	8	—	—	—	microsoft / azure api management	Improper access control in Azure API Management (APIM) allows an authorized attacker to execute code over a networ	97d ago
CVE-2026-60371	8	—	—	—	oracle / platform security for java	Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized	98d ago
CVE-2026-63265	8	—	—	—	—	Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in various Regular Labs ext	98d ago
CVE-2026-61224	8	—	—	—	oracle / communications converged application server	Vulnerability in the Oracle Communications Converged Application Server product of Oracle Communications (componen	99d ago
CVE-2026-61067	8	—	—	—	oracle / access manager	Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine).	99d ago
CVE-2026-61009	8	—	—	—	oracle / e-business suite	Vulnerability in the Oracle Process Manufacturing Logistics product of Oracle E-Business Suite (component: Interna	99d ago
CVE-2026-60807	8	—	—	—	oracle / bills of material	Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite (component: Internal Operations).	99d ago
CVE-2026-60790	8	—	—	—	oracle / sales offline	Vulnerability in the Oracle Sales Offline product of Oracle E-Business Suite (component: Internal Operations).	99d ago
CVE-2026-60652	8	—	—	—	oracle / webcenter content	Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Web Content Manageme	99d ago
CVE-2026-60650	8	—	—	—	oracle / webcenter content	Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Web Content Manageme	99d ago
CVE-2026-60648	8	—	—	—	oracle / webcenter content	Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Web Content Manageme	99d ago
CVE-2026-60646	8	—	—	—	oracle / webcenter content	Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Web Content Manageme	99d ago
CVE-2026-60643	8	—	—	—	oracle / webcenter content	Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).	99d ago
CVE-2026-60579	8	—	—	—	oracle / enterprise command center framework	Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite (component: Cor	99d ago
CVE-2026-60533	8	—	—	—	oracle / identity manager connector	Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Generic Uni	99d ago
CVE-2026-60325	8	—	—	—	oracle / access manager	Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine).	99d ago
CVE-2026-46923	8	—	—	—	oracle / public sector financials	Vulnerability in the Oracle Public Sector Financials (International) product of Oracle E-Business Suite (component	99d ago
CVE-2026-47237	8	—	—	—	—	Kubeflow Community Distribution helps users to install Kubeflow Platform in popular Kubernetes clusters.	99d ago
CVE-2026-21575	8	—	—	—	atlassian / sourcetree	This High severity RCE (Remote Code Execution) vulnerability was introduced in version 3.4.11 of Sourcetree for Ma	99d ago
CVE-2026-55626	8	—	—	—	neutrinolabs / xrdp	xrdp is an open source RDP server.	100d ago
CVE-2025-71392	8	—	—	—	surrealdb / surrealdb	SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 fails to properly escape table and field names	102d ago
CVE-2026-45162	8	—	—	—	—	Pimcore is an Open Source Data & Experience Management Platform.	103d ago
CVE-2026-62215	8	—	—	—	openclaw / openclaw	OpenClaw versions before 2026.6.5 contain an authentication bypass vulnerability in HTTP Canvas responses that all	104d ago
CVE-2026-50683	8	—	—	—	microsoft / windows 10 1607	Heap-based buffer overflow in Windows DHCP Server allows an authorized attacker to elevate privileges over an adja	106d ago
CVE-2026-50502	8	—	—	—	microsoft / windows 10 1607	Insufficient granularity of access control in Windows Event Logging Service allows an authorized attacker to execu	106d ago
CVE-2026-50365	8	—	—	—	microsoft / windows 10 1607	Improper authentication in Windows RPC API allows an unauthorized attacker to elevate privileges over an adjacent	106d ago
CVE-2026-58647	8	—	—	—	microsoft / power bi report server	Improper neutralization of input during web page generation ('cross-site scripting') in Power BI allows an authori	106d ago
CVE-2026-49169	8	—	—	—	microsoft / windows server 2025	Use after free in DNS Server allows an authorized attacker to execute code over a network.	106d ago
CVE-2026-42975	8	—	—	—	microsoft / windows 10 1607	Heap-based buffer overflow in Windows Bluetooth Port Driver allows an unauthorized attacker to execute code over a	106d ago
CVE-2026-40400	8	—	—	—	microsoft / windows 10 1607	Relative path traversal in Windows PowerShell allows an authorized attacker to execute code over a network.	106d ago
CVE-2026-15293	8	—	—	—	—	The WP Business Intelligence Lite plugin for WordPress is vulnerable to authorization bypass in all versions up to	111d ago
CVE-2026-59224	8	—	—	—	openwebui / open webui	Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform.	111d ago
CVE-2026-11903	8	—	—	—	progress / moveit transfer	Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOV	112d ago
CVE-2026-14476	8	—	—	—	—	A path traversal flaw was found in SSSD's AD GPO provider.	113d ago
CVE-2026-34171	8	—	—	—	—	Coolify is an open-source and self-hostable tool for managing servers, applications, and databases.	114d ago
CVE-2025-53829	8	—	—	—	—	ownCloud is a file storage, synchronization, and sharing application.	114d ago
CVE-2026-11766	8	—	—	—	—	The Ultimate Member WordPress plugin before 2.12.0 does not properly sanitise and escape the value of custom texta	114d ago
CVE-2026-53357	8	—	—	—	linux / linux kernel	In the Linux kernel, the following vulnerability has been resolved: Bluetooth: fix UAF in l2cap_sock_cleanup_liste	118d ago
CVE-2026-49091	8	—	—	—	elastic / kibana	Improper Output Neutralization for Logs (CWE-117) in Kibana can lead to log injection via Log Injection-Tampering-	119d ago
CVE-2026-10538	8	—	—	—	—	Messaging consumer functionality allows deserialization of user-controlled data without sufficient restriction of	119d ago
CVE-2026-12240	8	—	—	—	—	The Export User Data plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path v	121d ago
CVE-2026-40711	8	—	—	—	—	Dell Dell Container Storage Modules, version(s) csi-powerstore v2.16.0, csi-unity v2.16.0, csi-powerflex v2.16.0,	124d ago
CVE-2026-54030	8	—	—	—	librechat / librechat	LibreChat is an enhanced ChatGPT clone that supports multiple AI providers.	125d ago

Sources: NIST National Vulnerability Database (descriptions, CVSS, CPE); CISA KEV, ENISA EUVD, CIRCL and VulnCheck (exploitation status, three catalogues counted; CIRCL shown as an aggregator); FIRST EPSS (exploitation probability). Patch window is the gap between CVE publication and the earliest KEV listing, so a negative value means a catalogue called it exploited before it was disclosed. Data refreshes every five hours.

Loading

CVE Tracker