CVE Tracker: vulnerabilities by vendor, severity and exploitation status

CVE Tracker

21,446 records

Every published CVE from the last 120 days with CVSS score, vendor and product, cross-referenced against CISA's Known Exploited Vulnerabilities catalog. 5 added to KEV in the last 7 days.

SeverityAll critical high medium lowExploitedIn CISA KEV

CVE	CVSS	EPSS	KEV sources	Patch window	Vendor / product	Summary	Published
CVE-2026-73654	8.5	—	—	—	—	Trigger.dev is a platform for building and deploying fully managed AI agents and workflows.	59d ago
CVE-2026-16967	8.5	—	—	—	ibm / i	IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to gain unauthorized access to system obj	59d ago
CVE-2026-16908	8.5	—	—	—	ibm / i	IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to gain unauthorized access to arbitrary	59d ago
CVE-2026-57894	8.5	—	—	—	—	Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository	59d ago
CVE-2026-66658	8.5	—	—	—	—	Subscriber SQL Injection in Reviewer <= 3.14.2 versions.	59d ago
CVE-2026-66430	8.5	—	—	—	—	Subscriber SQL Injection in Visitor Traffic Real Time Statistics Pro <= 11.10 versions.	59d ago
CVE-2026-28168	8.5	—	—	—	—	Subscriber SQL Injection in CubeWP <= 1.1.30 versions.	59d ago
CVE-2026-28156	8.5	—	—	—	—	Subscriber SQL Injection in Do Lasso <= 358 versions.	59d ago
CVE-2026-28002	8.5	—	—	—	—	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arraytics Bo	59d ago
CVE-2026-73629	8.5	—	—	—	—	Serendipity before 2.6.0 contains a server-side request forgery vulnerability in the serendipity_url_allowed() fil	59d ago
CVE-2026-71473	8.5	—	—	—	—	A flaw was found in the `search-v2-operator` component.	60d ago
CVE-2026-16033	8.5	—	—	—	—	A path traversal vulnerability in LXD allows an attacker to achieve arbitrary host file read or unconstrained file	60d ago
CVE-2026-19228	8.5	—	—	—	gitlab / gitlab	GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.4 and 19.2 before 19.2.2	60d ago
CVE-2026-17418	8.5	—	—	—	ibm / i	IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to cause a denial of service due to improp	60d ago
CVE-2026-15423	8.5	—	—	—	gitlab / gitlab	GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.0 before 19.0.6, 19.1 before 19.1.4,	60d ago
CVE-2026-73079	8.5	—	—	—	—	Sub2API is an AI API gateway platform designed to distribute and manage API quotas from AI product subscriptions.	61d ago
CVE-2026-51583	8.5	—	—	—	—	An issue in usememos through v0.30.0 allows a remote authenticated attacker to perform Server-Side Request Forgery	61d ago
CVE-2026-16053	8.5	—	—	—	—	Zohocorp ManageEngine M365 Manager Plus and M365 Security Plus versions below 4820 are affected to Authenticated P	62d ago
CVE-2026-18947	8.5	—	—	—	—	A flaw was found in Feast.	62d ago
CVE-2026-71576	8.5	—	—	—	—	A flaw was found in multicluster-global-hub.	62d ago
CVE-2026-45414	8.5	—	—	—	—	Decidim is a participatory democracy framework.	66d ago
CVE-2026-18359	8.5	—	—	—	escriptorium / escriptorium	Server-side request forgery in the METS and IIIF import URI handling in Scripta eScriptorium through 26.04.1 allow	66d ago
CVE-2026-65569	8.5	—	—	—	—	Subscriber SQL Injection in WP Job Portal <= 2.5.6 versions.	66d ago
CVE-2026-65547	8.5	—	—	—	—	Subscriber SQL Injection in Creative Mail <= 1.6.9 versions.	66d ago
CVE-2026-18597	8.5	—	—	—	—	The PDF creation feature of Foxit PDF Services API supports referencing external files.	67d ago
CVE-2026-17633	8.5	—	—	—	langflow / langflow	IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary code due to	67d ago
CVE-2026-17624	8.5	—	—	—	langflow / langflow	IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 thr	67d ago
CVE-2026-9077	8.5	—	—	—	langflow / langflow	IBM Langflow OSS 1.0.0 through 1.10.3 Langflow allows remote authenticated attackers to bypass localhost-only restr	67d ago
CVE-2026-17617	8.5	—	—	—	ibm / application gateway operator	IBM Application Gateway Operator 22.2 through 26.06 is vulnerable to Server-Side Request Forgery (SSRF) due to ins	67d ago
CVE-2026-9203	8.5	—	—	—	progress / marklogic server	A server-side request forgery vulnerability in Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authent	67d ago
CVE-2026-71280	8.5	—	—	—	—	go-shiori's DownloadBookmark (internal/core/download.go) fetches a caller-supplied bookmark URL using a plain http	67d ago
CVE-2026-71274	8.5	—	—	—	—	OpenBK7231T's CHANNEL_SetLabel (src/cmnds/cmd_channels.c) stores channel labels received via the MQTT SetChannelLa	67d ago
CVE-2026-71272	8.5	—	—	—	—	Memos' webhook dispatch function safeDialContext (internal/webhook/webhook.go) resolves the target hostname via ne	67d ago
CVE-2026-71271	8.5	—	—	—	—	Memos' webhook URL validation, isReservedIP (internal/webhook/validate.go), checks a candidate IP against a reserv	67d ago
CVE-2026-10079	8.5	—	—	—	—	A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS).	72d ago
CVE-2026-62246	8.5	—	—	—	—	Kamaji is the Hosted Control Plane Manager for Kubernetes.	73d ago
CVE-2026-11536	8.5	—	—	—	ibm / websphere application server	IBM WebSphere Application Server 9.0, and 8.5 is affected by a remote code execution vulnerability in the SOAP/JMX	73d ago
CVE-2026-66415	8.5	—	—	—	—	Leantime 3.6.2 contains a server-side request forgery and local file inclusion vulnerability that allows authentic	73d ago
CVE-2026-57862	8.5	—	—	—	—	Kanboard 1.2.52 and prior contains a server-side request forgery vulnerability that allows authenticated users to	73d ago
CVE-2026-6267	8.5	—	—	—	gitlab / gitlab	GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1.0 before 19.0.5, 19.1 before 19.1.3	74d ago
CVE-2026-67428	8.5	—	—	—	—	Flyto2 Core is an execution kernel for automation and AI-agent workflows.	74d ago
CVE-2026-67424	8.5	—	—	—	—	Flyto2 Core is an execution kernel for automation and AI-agent workflows.	74d ago
CVE-2026-49332	8.5	—	—	—	—	A flaw was found in openshift/oauth-proxy.	75d ago
CVE-2026-17192	8.5	—	—	—	—	A VCO feature does not sufficiently validate caller-supplied input, allowing requests to be made on behalf of auth	76d ago
CVE-2026-59551	8.5	—	—	—	—	Subscriber SQL Injection in rtMedia for WordPress, BuddyPress and bbPress <= 4.7.10 versions.	76d ago
CVE-2026-17107	8.5	—	—	—	—	A flaw was found in the cluster-proxy service-proxy component used in Red Hat Advanced Cluster Management for Kube	79d ago
CVE-2026-56167	8.5	—	—	—	microsoft / azure ai search	Server-side request forgery (ssrf) in Azure AI Search allows an authorized attacker to elevate privileges over a n	80d ago
CVE-2026-65895	8.5	—	—	—	—	Grav API Plugin versions before 1.0.10 fail to restrict write access to security-critical plugin configuration sco	80d ago
CVE-2026-65526	8.5	—	—	—	—	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeisle Vi	80d ago
CVE-2026-65454	8.5	—	—	—	—	Contributor SQL Injection in Quiz And Survey Master <= 11.2.0 versions.	80d ago
CVE-2026-65451	8.5	—	—	—	—	Contributor SQL Injection in MapSVG <= 8.14.0 versions.	80d ago
CVE-2026-65450	8.5	—	—	—	—	Contributor SQL Injection in MapSVG <= 8.14.0 versions.	80d ago
CVE-2026-25405	8.5	—	—	—	—	Contributor SQL Injection in eRoom <= 1.7.1 versions.	80d ago
CVE-2026-24552	8.5	—	—	—	—	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in John-Michael	80d ago
CVE-2026-62513	8.5	—	—	—	oracle / e-business suite	Vulnerability in the Oracle Process Manufacturing Regulatory Management product of Oracle E-Business Suite (compon	82d ago
CVE-2026-61312	8.5	—	—	—	oracle / product hub	Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations).	82d ago
CVE-2026-60452	8.5	—	—	—	oracle / webcenter content	Vulnerability in the WebCenter Content: Imaging product of Oracle Fusion Middleware (component: Core).	82d ago
CVE-2026-60444	8.5	—	—	—	oracle / webcenter content	Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).	82d ago
CVE-2026-60426	8.5	—	—	—	oracle / unified directory	Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD Core).	82d ago
CVE-2026-60420	8.5	—	—	—	oracle / unified directory	Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD Core).	82d ago

Sources: NIST National Vulnerability Database (descriptions, CVSS, CPE); CISA KEV, ENISA EUVD, CIRCL and VulnCheck (exploitation status, three catalogues counted; CIRCL shown as an aggregator); FIRST EPSS (exploitation probability). Patch window is the gap between CVE publication and the earliest KEV listing, so a negative value means a catalogue called it exploited before it was disclosed. Data refreshes every five hours.

Loading

CVE Tracker