CVE Tracker: vulnerabilities by vendor, severity and exploitation status

CVE Tracker

21,446 records

Every published CVE from the last 120 days with CVSS score, vendor and product, cross-referenced against CISA's Known Exploited Vulnerabilities catalog. 5 added to KEV in the last 7 days.

SeverityAll critical high medium lowExploitedIn CISA KEV

CVE	CVSS	EPSS	KEV sources	Patch window	Vendor / product	Summary	Published
CVE-2026-60330	8.5	—	—	—	oracle / identity manager	Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI).	82d ago
CVE-2026-60295	8.5	—	—	—	oracle / coherence	Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core).	82d ago
CVE-2026-60193	8.5	—	—	—	oracle / mysql connector\/net	Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Net).	82d ago
CVE-2026-47033	8.5	—	—	—	oracle / e-business suite	Vulnerability in the Oracle Contracts Integration product of Oracle E-Business Suite (component: Internal Operatio	82d ago
CVE-2026-47198	8.5	—	—	—	—	Paymenter is a free and open-source webshop solution for management of hosting services.	83d ago
CVE-2024-58366	8.5	—	—	—	delskayn / rquickjs	SurrealDB before 1.1.1 contains a format string vulnerability in the rquickjs Exception::throw_type function when	85d ago
CVE-2026-62226	8.5	—	—	—	openclaw / openclaw	OpenClaw 2026.3.28 before 2026.5.19 contain an authorization bypass vulnerability in the browser act route that fa	87d ago
CVE-2026-55234	8.5	—	—	—	—	Wekan is open source kanban built with Meteor.	88d ago
CVE-2026-61430	8.5	—	—	—	—	PraisonAI before 1.6.78 contains a server-side request forgery vulnerability in the web_crawl tool that validates	88d ago
CVE-2026-48320	8.5	—	—	—	adobe / coldfusion	ColdFusion is affected by a reflected Cross-Site Scripting (XSS) vulnerability.	89d ago
CVE-2026-15738	8.5	—	—	—	—	Incorrect behavior order in the Gateway API listener-rule generation in Amazon AWS Load Balancer Controller before	89d ago
CVE-2026-50340	8.5	—	—	—	microsoft / windows 11 24h2	Use after free in Windows Runtime allows an authorized attacker to elevate privileges over a network.	89d ago
CVE-2026-62197	8.5	—	—	—	openclaw / openclaw	OpenClaw before 2026.6.6 contains a policy bypass vulnerability in browser CDP discovery that accepts blocked WebS	90d ago
CVE-2026-57810	8.5	—	—	—	—	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Saad Iqbal A	91d ago
CVE-2026-57787	8.5	—	—	—	—	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CreativeWS C	91d ago
CVE-2026-57772	8.5	—	—	—	—	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Inventory	91d ago
CVE-2026-57771	8.5	—	—	—	—	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Milan Petrov	91d ago
CVE-2026-57385	8.5	—	—	—	—	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in appsbd Vitep	91d ago
CVE-2026-61429	8.5	—	—	—	—	PraisonAI versions before 1.6.78 contain a server-side request forgery vulnerability in the Crawl4AI/Chromium back	92d ago
CVE-2026-55789	8.5	—	—	—	—	Logto is the modern, open-source auth infrastructure for SaaS and AI apps.	93d ago
CVE-2026-54329	8.5	—	—	—	snipeitapp / snipe-it	Snipe-IT is an IT asset/license management system.	93d ago
CVE-2026-56690	8.5	—	—	—	dell / powerflex manager	Dell PowerFlex Manager, Version prior to 5.1.0.1, contain(s) an Improper Neutralization of Special Elements used i	93d ago
CVE-2026-56003	8.5	—	—	—	x / libxfont	A heap buffer overflow due to missing size checking in the property buffer when parsing PCF files in libXfont2 Com	96d ago
CVE-2026-56002	8.5	—	—	—	x / libxfont	A heap bufferflow in pcfReadFont() due to missing glyph bounds checking in libXfont2 before 2.0.8 allows attackers	96d ago
CVE-2026-56001	8.5	—	—	—	x / libxfont	A heap buffer overflow in BitmapScaleBitmaps in libXfont2 before 2.0.8 due to an overflowing 32bit size could be u	96d ago
CVE-2026-55999	8.5	—	—	—	x.org / x server	Local attackers with a X connection able to provide PCX fonts to the X server xorg-server before 21.2.24 and xwayl	96d ago
CVE-2026-54765	8.5	—	—	—	traefik / traefik	Traefik is an open source HTTP reverse proxy and load balancer.	97d ago
CVE-2025-53828	8.5	—	—	—	—	SharePoint for ownCloud is an application for using SharePoint with the file storage, synchronization, and sharing	97d ago
CVE-2026-26231	8.5	—	—	—	—	Gitea versions up to and including 1.26.1 allow the Allow edits from maintainers permission path to authorize comm	100d ago
CVE-2026-10055	8.5	—	—	—	—	In Eclipse Theia since version 1.26.0, the backend /services/request-service RPC accepts an attacker-controlled UR	100d ago
CVE-2026-57765	8.5	—	—	—	—	Contributor SQL Injection in WP EasyCart <= 5.9.0 versions.	101d ago
CVE-2026-57756	8.5	—	—	—	—	Contributor SQL Injection in nicen-localize-image <= 1.4.9 versions.	101d ago
CVE-2026-57752	8.5	—	—	—	—	Contributor SQL Injection in iNET Webkit 1.2.4 versions.	101d ago
CVE-2026-57687	8.5	—	—	—	—	Contributor SQL Injection in Custom Field Template <= 2.7.8 versions.	101d ago
CVE-2025-69094	8.5	—	—	—	—	Subscriber SQL Injection in Unicamp <= 2.2.2 versions.	101d ago
CVE-2026-24260	8.5	—	—	—	—	NVIDIA Container Toolkit for Linux contains a vulnerability where an attacker could cause a time-of-check time-of-	102d ago
CVE-2026-11594	8.5	—	—	—	ibm / websphere application server	IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site scripting vulnerability in the administr	103d ago
CVE-2026-11714	8.5	—	—	—	ibm / websphere application server	IBM WebSphere Application Server Liberty is affected by a server-side request forgery vulnerability with the apiDi	103d ago
CVE-2026-10129	8.5	—	—	—	langflow / langflow	IBM Langflow OSS 1.0.0 through 1.9.3 contains a Server-Side Request Forgery (SSRF) protection bypass vulnerability	103d ago
CVE-2026-57955	8.5	—	—	—	—	SigNoz through 0.130.1 contains a SQL injection vulnerability that allows authenticated attackers to execute arbit	104d ago
CVE-2026-57947	8.5	—	—	—	—	Pinpoint through 3.1.0 contains a server-side request forgery vulnerability in the webhook registration endpoint t	104d ago
CVE-2026-54353	8.5	—	—	—	budibase / budibase	Budibase is an open-source low-code platform.	107d ago
CVE-2026-56663	8.5	—	—	—	—	AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence	107d ago
CVE-2026-57667	8.5	—	—	—	—	Sales Representative SQL Injection in Groundhogg <= 4.5 versions.	107d ago
CVE-2026-57663	8.5	—	—	—	—	Contributor SQL Injection in Recipe Maker For Your Food Blog from Zip Recipes <= 8.2.7 versions.	107d ago
CVE-2026-57662	8.5	—	—	—	—	Contributor SQL Injection in Contest Gallery <= 30.0.0 versions.	107d ago
CVE-2026-57653	8.5	—	—	—	—	Contributor SQL Injection in WP Job Portal <= 2.5.2 versions.	107d ago
CVE-2026-57644	8.5	—	—	—	—	Contributor SQL Injection in Restaurant Menu by MotoPress <= 2.4.10 versions.	107d ago
CVE-2026-57643	8.5	—	—	—	—	Contributor SQL Injection in WP Post Author <= 3.9.1 versions.	107d ago
CVE-2026-57642	8.5	—	—	—	—	Contributor SQL Injection in Gallery <= 4.7.8 versions.	107d ago
CVE-2026-57636	8.5	—	—	—	—	Contributor SQL Injection in wpForo Forum <= 3.0.9 versions.	107d ago
CVE-2026-57315	8.5	—	—	—	—	Contributor Remote Code Execution (RCE) in Blocksy Companion Pro <= 2.1.45 versions.	107d ago
CVE-2026-56064	8.5	—	—	—	—	Subscriber SQL Injection in Tourfic <= 2.22.5 versions.	107d ago
CVE-2026-12975	8.5	—	—	—	redhat / build of apicurio registry	A flaw was found in Apicurio Registry.	108d ago
CVE-2026-56771	8.5	—	—	—	—	NewsBlur before version 14.5.0 contains a server-side request forgery vulnerability in the add_url endpoint that a	108d ago
CVE-2026-56769	8.5	—	—	—	—	Huly Platform through 0.7.423, fixed in commit 68cbf8a contains an authenticated server-side request forgery vulne	108d ago
CVE-2026-56049	8.5	—	—	—	—	Contributor Remote Code Execution (RCE) in Post Snippets <= 4.0.19 versions.	108d ago
CVE-2026-54838	8.5	—	—	—	—	Subscriber SQL Injection in WC Vendors Marketplace <= 2.6.8 versions.	108d ago
CVE-2026-54822	8.5	—	—	—	—	Subscriber SQL Injection in SALESmanago & Leadoo <= 3.11.2 versions.	108d ago
CVE-2026-52797	8.5	—	—	—	—	Gogs is an open source self-hosted Git service.	109d ago

Sources: NIST National Vulnerability Database (descriptions, CVSS, CPE); CISA KEV, ENISA EUVD, CIRCL and VulnCheck (exploitation status, three catalogues counted; CIRCL shown as an aggregator); FIRST EPSS (exploitation probability). Patch window is the gap between CVE publication and the earliest KEV listing, so a negative value means a catalogue called it exploited before it was disclosed. Data refreshes every five hours.

Loading

CVE Tracker