CVE Tracker: vulnerabilities by vendor, severity and exploitation status

CVE Tracker

15,513 records

Every published CVE from the last 120 days with CVSS score, vendor and product, cross-referenced against CISA's Known Exploited Vulnerabilities catalog. 8 added to KEV in the last 7 days.

SeverityAll critical high medium lowExploitedIn CISA KEV

CVE	CVSS	EPSS	KEV sources	Patch window	Vendor / product	Summary	Published
CVE-2026-18301	7.8	—	—	—	gimp / gimp	GIMP PSD File Parsing Integer Overflow Remote Code Execution Vulnerability.	69d ago
CVE-2026-18300	7.8	—	—	—	gimp / gimp	GIMP HDR File Parsing Integer Overflow Remote Code Execution Vulnerability.	69d ago
CVE-2026-18299	7.8	—	—	—	gstreamer / gstreamer	GStreamer rtpsbcdepay Use-After-Free Remote Code Execution Vulnerability.	69d ago
CVE-2026-18298	7.8	—	—	—	gstreamer / gstreamer	GStreamer PNG File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability.	69d ago
CVE-2026-18297	7.8	—	—	—	gstreamer / gstreamer	GStreamer OGG File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability.	69d ago
CVE-2026-18296	7.8	—	—	—	gstreamer / gstreamer	GStreamer MRF File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability.	69d ago
CVE-2026-18295	7.8	—	—	—	gstreamer / gstreamer	GStreamer MRF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability.	69d ago
CVE-2026-18294	7.8	—	—	—	—	OriginLab Origin Viewer OGW File Parsing Memory Corruption Remote Code Execution Vulnerability.	69d ago
CVE-2026-18293	7.8	—	—	—	—	OriginLab Origin Viewer OPJ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability.	69d ago
CVE-2026-18292	7.8	—	—	—	—	OriginLab OriginPro OGG File Parsing Memory Corruption Remote Code Execution Vulnerability.	69d ago
CVE-2026-18291	7.8	—	—	—	—	OriginLab OriginPro OGW File Parsing Memory Corruption Remote Code Execution Vulnerability.	69d ago
CVE-2026-18290	7.8	—	—	—	—	OriginLab OriginPro OGG File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability.	69d ago
CVE-2026-18289	7.8	—	—	—	—	OriginLab OriginPro OPJ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability.	69d ago
CVE-2026-18288	7.8	—	—	—	—	OriginLab OriginPro OPJU File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability.	69d ago
CVE-2026-18287	7.8	—	—	—	—	Aeon load_time_series_segmentation_benchmark Code Injection Remote Code Execution Vulnerability.	69d ago
CVE-2026-18286	7.8	—	—	—	—	Aeon load_human_activity_segmentation_datasets Code Injection Remote Code Execution Vulnerability.	69d ago
CVE-2026-18285	7.8	—	—	—	—	Aeon load_rehab_pile_dataset Deserialization of Untrusted Data Remote Code Execution Vulnerability.	69d ago
CVE-2026-18284	7.8	—	—	—	—	Sony XAV-9500ES Crash Dump Handler Command Injection Local Privilege Escalation Vulnerability.	69d ago
CVE-2026-18270	7.8	—	—	—	—	Kenwood DNR1007XR udhcpd Incorrect Permission Assignment Local Privilege Escalation Vulnerability.	69d ago
CVE-2026-18263	7.8	—	—	—	—	Parallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation Vulnerability.	69d ago
CVE-2026-18262	7.8	—	—	—	—	Parallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation Vulnerability.	69d ago
CVE-2026-15679	7.8	—	—	—	—	Hugging Face PyTorch Image Models checkpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability	69d ago
CVE-2026-13121	7.8	—	—	—	—	Parallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation Vulnerability.	69d ago
CVE-2026-61898	7.8	—	—	—	—	The Ubuntu-specific language helper scripts (save-to-pam-env, update-langlist) shipped with accountsservice before	69d ago
CVE-2026-61897	7.8	—	—	—	—	An Ubuntu-specific patch to AccountsService before 23.13.9-8ubuntu7 only partially drops privileges before launchi	69d ago
CVE-2026-76833	7.8	—	—	—	—	@cgauge/yaml npm package contains an arbitrary code execution vulnerability that allows attackers to execute arbit	69d ago
CVE-2026-18917	7.8	—	—	—	—	A flaw was found in libvirt.	69d ago
CVE-2026-16875	7.8	—	—	—	ibm / vios	IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary commands due to sh	70d ago
CVE-2026-16874	7.8	—	—	—	ibm / vios	IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to obtain root privileges due to improp	70d ago
CVE-2026-16873	7.8	—	—	—	ibm / vios	IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to achieve local privilege escalation d	70d ago
CVE-2026-16869	7.8	—	—	—	ibm / vios	IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary code due to improp	70d ago
CVE-2026-75144	7.8	—	—	—	—	FFmpeg before commit 1cdeb3c contains a heap buffer overflow vulnerability in the VC-2/Dirac RTP packetizer (libav	70d ago
CVE-2026-75142	7.8	—	—	—	—	FFmpeg before commit 9d786e4 contains a stack buffer overflow in the MPEG-PS muxer (libavformat/mpegenc.c).	70d ago
CVE-2026-75141	7.8	—	—	—	—	FFmpeg before commit acf5d7c contains a heap buffer overflow in the hvcC box writer.	70d ago
CVE-2026-58564	7.8	—	—	—	dell / command update	Dell Command Update (DCU), versions prior to 5.7.1, contain an Incorrect Default Permissions vulnerability.	70d ago
CVE-2026-53477	7.8	—	—	—	dell / command update	Dell Command Update (DCU), versions prior to 5.7.1, contain a Time-of-check Time-of-use (TOCTOU) Race Condition vu	70d ago
CVE-2026-49817	7.8	—	—	—	dell / command update	Dell Command Update (DCU), versions prior to 5.7.1, contain a Deserialization of Untrusted Data vulnerability.	70d ago
CVE-2026-49816	7.8	—	—	—	dell / command update	Dell Command Update (DCU), versions prior to 5.7.1, contain a Deserialization of Untrusted Data vulnerability.	70d ago
CVE-2026-16703	7.8	—	—	—	ibm / vios	IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to gain elevated privileges due to impr	70d ago
CVE-2026-43961	7.8	—	—	—	—	A flaw was found in Vim's netrw plugin.	70d ago
CVE-2026-58087	7.8	—	—	—	freebsd / freebsd	The GETALL and SETALL commands in semctl(2) recorded the number of semaphores in the target set, dropped the lock	71d ago
CVE-2026-49430	7.8	—	—	—	freebsd / freebsd	The ZFS_IOC_RECV_NEW ioctl, in the heal receive path, similarly truncated a 64-bit payload size to a 32-bit intege	71d ago
CVE-2026-49429	7.8	—	—	—	freebsd / freebsd	The ZFS_IOC_USERSPACE_MANY ioctl, used by zfs-userspace(8), truncated a 64-bit output buffer size to a 32-bit inte	71d ago
CVE-2026-71126	7.8	—	—	—	oracle / vm virtualbox	Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).	71d ago
CVE-2026-71111	7.8	—	—	—	oracle / identity manager	Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: Installer).	71d ago
CVE-2026-71101	7.8	—	—	—	oracle / human resources management system	Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: US Payroll Tax Issues).	71d ago
CVE-2026-71097	7.8	—	—	—	oracle / business intelligence	Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Platf	71d ago
CVE-2026-71028	7.8	—	—	—	oracle / commerce experience manager	Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce	71d ago
CVE-2026-71010	7.8	—	—	—	oracle / commerce experience manager	Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce	71d ago
CVE-2026-70879	7.8	—	—	—	oracle / hyperion data relationship management	Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access an	71d ago
CVE-2026-70866	7.8	—	—	—	oracle / application testing suite	Vulnerability in Oracle Application Testing Suite.	71d ago
CVE-2026-70798	7.8	—	—	—	oracle / purchasing	Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: Internal Operations).	71d ago
CVE-2026-70750	7.8	—	—	—	oracle / hyperion financial reporting	Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion (component: Server).	71d ago
CVE-2026-62581	7.8	—	—	—	oracle / hyperion infrastructure technology	Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Installation	71d ago
CVE-2026-62454	7.8	—	—	—	oracle / siebel crm	Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager).	71d ago
CVE-2026-61300	7.8	—	—	—	oracle / enterprise manager base platform	Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Agen	71d ago
CVE-2026-61291	7.8	—	—	—	oracle / webcenter content	Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).	71d ago
CVE-2026-60991	7.8	—	—	—	oracle / identity manager connector	Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core).	71d ago
CVE-2026-60822	7.8	—	—	—	oracle / enterprise manager for systems infrastructure	Vulnerability in the Oracle Enterprise Manager for Systems Infrastructure product of Oracle Enterprise Manager (co	71d ago
CVE-2026-60753	7.8	—	—	—	oracle / siebel crm	Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Installation).	71d ago

Sources: NIST National Vulnerability Database (descriptions, CVSS, CPE); CISA KEV, ENISA EUVD, CIRCL and VulnCheck (exploitation status, three catalogues counted; CIRCL shown as an aggregator); FIRST EPSS (exploitation probability). Patch window is the gap between CVE publication and the earliest KEV listing, so a negative value means a catalogue called it exploited before it was disclosed. Data refreshes every five hours.

Loading

CVE Tracker