CVE Tracker: vulnerabilities by vendor, severity and exploitation status

CVE Tracker

21,446 records

Every published CVE from the last 120 days with CVSS score, vendor and product, cross-referenced against CISA's Known Exploited Vulnerabilities catalog. 5 added to KEV in the last 7 days.

SeverityAll critical high medium lowExploitedIn CISA KEV

CVE	CVSS	EPSS	KEV sources	Patch window	Vendor / product	Summary	Published
CVE-2026-65818	8.5	—	—	—	—	Server-side request forgery (ssrf) in Power Automate allows an authorized attacker to elevate privileges over a ne	38d ago
CVE-2026-85179	8.5	—	—	—	—	Label Studio through 1.23.0 fails to validate webhook URLs, allowing authenticated users to dispatch requests to i	39d ago
CVE-2026-73707	8.5	—	—	—	arubanetworks / fabric composer	Privilege escalation vulnerabilities exist in the API of HPE Networking Fabric Composer.	40d ago
CVE-2026-81287	8.5	—	—	—	—	Subscriber SQL Injection in Charitable <= 1.8.12.1 versions.	41d ago
CVE-2026-55108	8.5	—	—	—	—	KubeVela is an open source application delivery platform.	44d ago
CVE-2026-82227	8.5	—	—	—	—	Contributor SQL Injection in WPBulky <= 1.2.2 versions.	45d ago
CVE-2026-81277	8.5	—	—	—	—	Contributor SQL Injection in Suggestion Engine for WooCommerce <= 2.0.11 versions.	46d ago
CVE-2026-78285	8.5	—	—	—	—	Subscriber SQL Injection in Like Button Rating <= 2.6.61 versions.	46d ago
CVE-2026-32564	8.5	—	—	—	—	Subscriber SQL Injection in ACPT (Pro) - Custom Post Types Plugin for WordPress <= 2.0.63 versions.	46d ago
CVE-2026-32550	8.5	—	—	—	—	Subscriber SQL Injection in Kadence Shop Kit <= 3.0.6 versions.	46d ago
CVE-2026-81027	8.5	—	—	—	—	one-api gates one of its two channel-pinning paths and not the other.	47d ago
CVE-2026-65092	8.5	—	—	—	nvidia / openshell	NVIDIA OpenShell Sandbox for Linux contains a vulnerability where an attacker could cause a path traversal bypass	47d ago
CVE-2026-70551	8.5	—	—	—	—	A user who can read an existing remote VCS repository can replace its configured origin or supply an absolute VCS	48d ago
CVE-2026-55526	8.5	—	—	—	—	PraisonAI is a multi-agent teams system.	48d ago
CVE-2026-68960	8.5	—	—	—	—	A stack-based buffer overflow vulnerability exists in SKYSEA Client View and SKYMEC IT Manager.	48d ago
CVE-2026-68959	8.5	—	—	—	—	SKYSEA Client View and SKYMEC IT Manager contain a path traversal vulnerability.	48d ago
CVE-2026-68062	8.5	—	—	—	—	SKYSEA Client View and SKYMEC IT Manager contain a path traversal vulnerability.	48d ago
CVE-2026-76838	8.5	—	—	—	—	Hi.Events validates a webhook destination only when it is registered, never when it is used.	48d ago
CVE-2026-32478	8.5	—	—	—	—	Subscriber SQL Injection in WP Project Manager Pro <= 4.0.1 versions.	49d ago
CVE-2026-32471	8.5	—	—	—	—	Subscriber SQL Injection in ProLancer Element <= 1.4.8 versions.	49d ago
CVE-2026-10053	8.5	—	—	—	gitlab / gitlab	GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.8 before 19.0.6, 19.1 before 19.1.4,	50d ago
CVE-2026-22681	8.5	—	—	—	—	OpenViking before 0.3.4 contains a server-side request forgery vulnerability that allows authenticated low-privile	52d ago
CVE-2026-72860	8.5	—	—	—	—	The POST /api/provider-nodes/validate route in 9router takes a caller-supplied baseUrl and issues server-side HTTP	52d ago
CVE-2026-69543	8.5	—	—	—	microsoft / azure virtual machines	Server-side request forgery (ssrf) in Azure Virtual Machines allows an authorized attacker to elevate privileges o	52d ago
CVE-2026-69419	8.5	—	—	—	microsoft / azure data manager for energy	Integer overflow or wraparound in Azure Data Manager for Energy allows an authorized attacker to execute code over	52d ago
CVE-2026-55765	8.5	—	—	—	—	CloudNativePG is a platform designed to manage PostgreSQL databases within Kubernetes environments.	52d ago
CVE-2026-46682	8.5	—	—	—	—	BigBlueButton is an open-source virtual classroom.	52d ago
CVE-2026-17168	8.5	—	—	—	ibm / vios	IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated attacker to execute arbitrary cod	52d ago
CVE-2026-74013	8.5	—	—	—	—	Subscriber SQL Injection in eShipper Commerce <= 2.16.13 versions.	53d ago
CVE-2026-73998	8.5	—	—	—	—	Subscriber SQL Injection in WP w3all phpBB <= 3.0.5 versions.	53d ago
CVE-2026-66594	8.5	—	—	—	—	Subscriber SQL Injection in WordPress Persistent Login <= 3.1.0 versions.	53d ago
CVE-2026-68558	8.5	—	—	—	—	Wekan is open source kanban built with Meteor.	53d ago
CVE-2026-66668	8.5	—	—	—	—	Subscriber SQL Injection in Community by PeepSo <= 9.0.5.2 versions.	54d ago
CVE-2026-32552	8.5	—	—	—	—	Subscriber SQL Injection in YITH WooCommerce Membership Premium <= 2.33.0 versions.	54d ago
CVE-2026-11565	8.5	—	—	—	—	The Advanced File Manager WordPress plugin before 5.4.13 does not perform capability checks in several of its file	54d ago
CVE-2026-71155	8.5	—	—	—	oracle / helidon	Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server).	54d ago
CVE-2026-71062	8.5	—	—	—	oracle / database server	Vulnerability in the RDBMS component of Oracle Database Server.	54d ago
CVE-2026-71057	8.5	—	—	—	oracle / bi publisher	Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Platform Security).	54d ago
CVE-2026-71049	8.5	—	—	—	oracle / product lifecycle analytics	Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply Chain (component: Installation Is	54d ago
CVE-2026-71002	8.5	—	—	—	oracle / commerce experience manager	Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce	54d ago
CVE-2026-70885	8.5	—	—	—	oracle / hyperion data relationship management	Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access an	54d ago
CVE-2026-70859	8.5	—	—	—	oracle / siebel crm	Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: REST).	54d ago
CVE-2026-70807	8.5	—	—	—	oracle / e-business suite	Vulnerability in the Oracle Call Center Technology product of Oracle E-Business Suite (component: Internal Operati	54d ago
CVE-2026-70728	8.5	—	—	—	oracle / autonomous health framework	Vulnerability in Oracle Autonomous Health Framework (component: Trace File Analyzer).	54d ago
CVE-2026-70718	8.5	—	—	—	oracle / bills of material	Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite (component: Internal Operations).	54d ago
CVE-2026-62615	8.5	—	—	—	oracle / reports developer	Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Security and Authent	54d ago
CVE-2026-62596	8.5	—	—	—	oracle / siebel crm	Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: Open Integration).	54d ago
CVE-2026-62590	8.5	—	—	—	oracle / siebel crm	Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: Open Integration).	54d ago
CVE-2026-61326	8.5	—	—	—	oracle / siebel crm	Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager).	54d ago
CVE-2026-61212	8.5	—	—	—	oracle / webcenter portal	Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools).	54d ago
CVE-2026-60849	8.5	—	—	—	oracle / unified directory	Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD Core).	54d ago
CVE-2026-60841	8.5	—	—	—	oracle / unified directory	Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD Core).	54d ago
CVE-2026-60798	8.5	—	—	—	oracle / siebel crm	Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Migration).	54d ago
CVE-2026-60758	8.5	—	—	—	oracle / siebel artificial intelligence	Vulnerability in the Siebel Artificial Intelligence product of Oracle Siebel CRM (component: AI).	54d ago
CVE-2026-75898	8.5	—	—	—	—	RAGFlow before 0.26.3 contains a server-side request forgery vulnerability in the agent workflow "Invoke" componen	55d ago
CVE-2026-32466	8.5	—	—	—	—	Subscriber SQL Injection in Gravity Forms Bookings premium <= 2.1 versions.	55d ago
CVE-2026-73410	8.5	—	—	—	—	Budibase is an open-source low-code platform.	55d ago
CVE-2026-57485	8.5	—	—	—	—	Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files.	55d ago
CVE-2026-17179	8.5	—	—	—	ibm / db2 mirror for i	IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to cause a denial of service du	58d ago
CVE-2026-72855	8.5	—	—	—	—	Budibase before 3.40.0 contains server-side request forgery vulnerabilities in OpenAPI query import and REST query	59d ago

Sources: NIST National Vulnerability Database (descriptions, CVSS, CPE); CISA KEV, ENISA EUVD, CIRCL and VulnCheck (exploitation status, three catalogues counted; CIRCL shown as an aggregator); FIRST EPSS (exploitation probability). Patch window is the gap between CVE publication and the earliest KEV listing, so a negative value means a catalogue called it exploited before it was disclosed. Data refreshes every five hours.

Loading

CVE Tracker