CVE Tracker: vulnerabilities by vendor, severity and exploitation status

CVE Tracker

15,513 records

Every published CVE from the last 120 days with CVSS score, vendor and product, cross-referenced against CISA's Known Exploited Vulnerabilities catalog. 8 added to KEV in the last 7 days.

SeverityAll critical high medium lowExploitedIn CISA KEV

CVE	CVSS	EPSS	KEV sources	Patch window	Vendor / product	Summary	Published
CVE-2026-53256	8	—	—	—	linux / linux kernel	In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: hold listener socket in rfc	125d ago
CVE-2026-10712	8	—	—	—	gitlab / gitlab	GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.10 before 18.11.6, 19.0 before 19.0.	126d ago
CVE-2026-23879	8	—	—	—	—	py7zr is a Python-based library and utility to support 7zip archive compression, decompression, encryption and dec	126d ago
CVE-2026-48719	8	—	—	—	—	Warp is an agentic development environment.	126d ago
CVE-2026-39598	8	—	—	—	—	Unrestricted Upload of File with Dangerous Type vulnerability in Kodezen LLC Academy LMS Pro allows Upload a Web S	133d ago
CVE-2025-48640	8	—	—	—	google / android	In multiple locations, there is a possible 3rd party passkey entry pairing approval due to a missing permission ch	133d ago
CVE-2026-46894	8	—	—	—	oracle / isupplier portal	Vulnerability in the Oracle iSupplier Portal product of Oracle E-Business Suite (component: Home Page).	133d ago
CVE-2026-46796	8	—	—	—	oracle / webcenter sites	Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites).	133d ago
CVE-2026-46787	8	—	—	—	oracle / webcenter content	Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).	133d ago
CVE-2025-68713	8	—	—	—	—	An issue was discovered in Rakuten Send Anywhere (File Transfer) for Android (com.estmob.android.sendanywhere) 23.	135d ago
CVE-2026-12222	8	—	—	—	—	A vulnerability was determined in Yealink SIP-T46U 108.86.0.118.	136d ago
CVE-2026-12221	8	—	—	—	—	A vulnerability was found in Yealink SIP-T46U 108.86.0.118.	136d ago
CVE-2026-12220	8	—	—	—	—	A vulnerability has been found in Yealink SIP-T46U 108.86.0.118.	136d ago
CVE-2026-12218	8	—	—	—	—	A vulnerability was detected in Yealink SIP-T46U 108.87.50.1.	136d ago
CVE-2026-53829	8	—	—	—	openclaw / openclaw	OpenClaw before 2026.5.18 contains an approval display truncation vulnerability allowing authenticated users to hi	138d ago
CVE-2026-48165	8	—	—	—	mariadb / mariadb	MariaDB server is a community developed fork of MySQL server.	138d ago
CVE-2026-48163	8	—	—	—	mariadb / mariadb	MariaDB server is a community developed fork of MySQL server.	138d ago
CVE-2026-44168	8	—	—	—	mariadb / mariadb	MariaDB server is a community developed fork of MySQL server.	138d ago
CVE-2026-48612	8	—	—	—	—	Improper state verification in the OAuth implementation could allow an attacker to manipulate the authentication f	139d ago
CVE-2026-34693	8	—	—	—	adobe / experience manager	Adobe Experience Manager Forms JEE versions LTS SP1, 6.5.24.0 and earlier are affected by a reflected Cross-Site S	141d ago
CVE-2026-9212	8	—	—	—	netgear / lbr1020 firmware	Insufficient authentication and input validation in the listed NETGEAR models allow users connected to the local ne	141d ago
CVE-2026-47298	8	—	—	—	microsoft / sharepoint server	Improper authorization in Microsoft Office SharePoint allows an authorized attacker to execute code over a network	141d ago
CVE-2026-45644	8	—	—	—	microsoft / live share canvas	Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Live Share Canva	141d ago
CVE-2026-0419	8	—	—	—	netgear / jr6150 firmware	Insufficient input validation in NETGEAR JR6150 (AC750 WiFi Router 802.11ac Dual Band Gigabit released in 2014) all	141d ago
CVE-2026-0411	8	—	—	—	netgear / rbe970 firmware	An information disclosure vulnerability in the NETGEAR Orbi satellites (RBR/RBE/RBS Series) could allow a user conn	141d ago
CVE-2026-46332	8	—	—	—	linux / linux kernel	In the Linux kernel, the following vulnerability has been resolved: greybus: gb-beagleplay: bound bootloader recei	141d ago
CVE-2026-41724	8	—	—	—	vmware / aria operations	VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor	142d ago
CVE-2026-41723	8	—	—	—	vmware / aria operations	VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor	142d ago
CVE-2026-41722	8	—	—	—	vmware / aria operations	VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor	142d ago
CVE-2026-11401	8	—	—	—	—	An untrusted search path issue in the GlobalDatabasePlugin in the AWS Advanced Go Wrapper for Amazon Aurora Postgr	145d ago
CVE-2026-11400	8	—	—	—	—	An untrusted search path issue in the GlobalDatabasePlugin in the AWS Advanced JDBC Wrapper for Amazon Aurora Post	145d ago
CVE-2026-45745	8	—	—	—	termix / termix	Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities.	145d ago
CVE-2026-11241	8	—	—	—	google / chrome	Insufficient validation of untrusted input in Cast in Google Chrome prior to 149.0.7827.53 allowed an attacker on	146d ago
CVE-2025-14773	8	—	—	—	abb / t-mac plus	Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in ABB T-MAC Pl	147d ago
CVE-2026-35482	8	—	—	—	alf / alf	alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups.	148d ago
CVE-2026-33245	8	—	—	—	shopify / react-router	React Router is a router for React.	148d ago
CVE-2026-0097	8	—	—	—	google / android	In multiple locations, there is a possible way to bypass user interaction when pairing an LE device due to a logic	149d ago
CVE-2026-0095	8	—	—	—	google / android	In l2c_fcr_clone_buf of l2c_fcr.cc, there is a possible way to trigger controlled heap corruption within the privil	149d ago
CVE-2026-0059	8	—	—	—	google / android	In multiple functions of sdp_discovery.cc, there is a possible way to achieve code execution due to a heap buffer o	149d ago
CVE-2026-47294	8	—	—	—	microsoft / sharepoint server	Improper neutralization of special elements used in an os command ('os command injection') in Microsoft Office Sha	149d ago
CVE-2026-20452	8	—	—	—	mediatek / mt6890 firmware	In wlan AP driver, there is a possible memory corruption due to a heap buffer overflow.	150d ago
CVE-2026-49367	8	—	—	—	jetbrains / intellij idea	In JetBrains IntelliJ IDEA before 2026.1.1 command execution was possible via the guest user account	152d ago
CVE-2026-35630	8	—	—	—	openclaw / openclaw	OpenClaw before 2026.5.18 contains an authorization bypass vulnerability in QQBot native approval buttons that fai	152d ago
CVE-2026-37266	8	—	—	—	—	An issue in Responsive File Manager Responsive FileManager Version 9.14.0 allows a remote attacker to execute arbi	153d ago
CVE-2026-6957	8	—	—	—	mattermost / legal hold	Mattermost Plugins versions <=1.1.5 fail to sanitize filenames received from federated peers before using them to c	154d ago
CVE-2026-3012	8	—	—	—	redhat / openshift container platform	A flaw was found in Samba’s certificate auto-enrollment Group Policy handling.	154d ago
CVE-2026-8834	8	—	—	—	ibm / http server	IBM HTTP Server 8.5, and 9.0 contains a buffer overflow vulnerability.	155d ago
CVE-2026-4858	8	—	—	—	mattermost / mattermost server	Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to check integra	160d ago
CVE-2025-11954	8	—	—	—	—	Cross-Site request forgery (CSRF) vulnerability in Sitemio Information Technologies Trade Ltd.	161d ago
CVE-2026-24214	8	—	—	—	nvidia / triton inference server	NVIDIA Triton Inference Server contains a vulnerability in the DALI backend where an attacker could cause an integ	162d ago
CVE-2026-24213	8	—	—	—	nvidia / triton inference server	NVIDIA Triton Inference Server contains a vulnerability in the DALI backend where an attacker could cause an out-o	162d ago
CVE-2026-45671	8	—	—	—	openwebui / open webui	Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline.	166d ago
CVE-2026-44184	8	—	—	—	—	Cleanuparr is a tool for automating the cleanup of unwanted or blocked files in Sonarr, Radarr, and supported down	169d ago
CVE-2026-40368	8	—	—	—	microsoft / sharepoint server	Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code ove	169d ago
CVE-2026-34332	8	—	—	—	microsoft / windows server 2025	Use after free in Windows Kernel-Mode Drivers allows an authorized attacker to execute code over a network.	169d ago
CVE-2023-27753	8	—	—	—	—	An arbitrary file upload vulnerability in MK-Auth 23.01K4.9 allows attackers to execute arbitrary code via uploadi	169d ago
CVE-2026-43639	8	—	—	—	bitwarden / server	Bitwarden Server prior to v2026.4.0 contains a missing authorization vulnerability that allows a provider service	170d ago
CVE-2026-41431	8	—	—	—	—	Zen is a firefox-based browser.	170d ago
CVE-2026-4802	8	—	—	—	—	A flaw was found in Cockpit.	170d ago
CVE-2026-32658	8	—	—	—	dell / automation platform	Dell Automation Platform versions prior to 2.0.0.0, contains a missing authorization vulnerability.	170d ago

Sources: NIST National Vulnerability Database (descriptions, CVSS, CPE); CISA KEV, ENISA EUVD, CIRCL and VulnCheck (exploitation status, three catalogues counted; CIRCL shown as an aggregator); FIRST EPSS (exploitation probability). Patch window is the gap between CVE publication and the earliest KEV listing, so a negative value means a catalogue called it exploited before it was disclosed. Data refreshes every five hours.

Loading

CVE Tracker