CVE Tracker: vulnerabilities by vendor, severity and exploitation status

CVE Tracker

21,446 records

Every published CVE from the last 120 days with CVSS score, vendor and product, cross-referenced against CISA's Known Exploited Vulnerabilities catalog. 5 added to KEV in the last 7 days.

SeverityAll critical high medium lowExploitedIn CISA KEV

CVE	CVSS	EPSS	KEV sources	Patch window	Vendor / product	Summary	Published
CVE-2026-45687	8.5	—	—	—	—	Rocket.Chat is an open-source, secure, fully customizable communications platform.	109d ago
CVE-2026-54008	8.5	—	—	—	openwebui / open webui	Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline.	110d ago
CVE-2026-49444	8.5	—	—	—	n8n / n8n	n8n is an open source workflow automation platform.	110d ago
CVE-2026-54312	8.5	—	—	—	n8n / n8n	n8n is an open source workflow automation platform.	110d ago
CVE-2026-56012	8.5	—	—	—	—	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in David Lingre	115d ago
CVE-2026-54818	8.5	—	—	—	—	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VeronaLabs S	116d ago
CVE-2026-54813	8.5	—	—	—	—	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Brainstorm F	116d ago
CVE-2026-54185	8.5	—	—	—	—	Subscriber SQL Injection in Cornerstone < 7.8.8 versions.	116d ago
CVE-2026-49113	8.5	—	—	—	—	Subscriber Arbitrary Code Execution in Cornerstone < 7.8.8 versions.	116d ago
CVE-2026-49073	8.5	—	—	—	—	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpWax Direct	116d ago
CVE-2026-48967	8.5	—	—	—	—	Subscriber SQL Injection in Geo Mashup <= 1.13.19 versions.	116d ago
CVE-2026-22335	8.5	—	—	—	—	Subscriber SQL Injection in WooCommerce Frontend Manager – Ultimate < 6.7.7 versions.	116d ago
CVE-2025-69135	8.5	—	—	—	—	Subscriber SQL Injection in Events Schedule - WordPress Events Calendar Plugin <= 2.7.2 versions.	116d ago
CVE-2026-46915	8.5	—	—	—	oracle / complex maintenance repair and overhaul	Vulnerability in the Oracle Complex Maintenance, Repair and Overhaul product of Oracle E-Business Suite (component	116d ago
CVE-2026-46870	8.5	—	—	—	oracle / mysql shell	Vulnerability in the MySQL Shell product of Oracle MySQL (component: Shell for VS Code).	116d ago
CVE-2026-39581	8.5	—	—	—	—	Subscriber SQL Injection in WP Sessions Time Monitoring Full Automatic <= 1.1.4 versions.	118d ago
CVE-2026-52700	8.5	—	—	—	—	Subscriber SQL Injection in WCMultiShipping <= 3.0.2 versions.	118d ago
CVE-2026-52697	8.5	—	—	—	—	Subscriber SQL Injection in Taskbuilder <= 5.0.7 versions.	118d ago
CVE-2026-48964	8.5	—	—	—	—	Subscriber SQL Injection in ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.6 versions.	118d ago
CVE-2026-48882	8.5	—	—	—	—	Subscriber SQL Injection in WP Time Slots Booking Form <= 1.2.50 versions.	118d ago
CVE-2026-48874	8.5	—	—	—	—	Subscriber SQL Injection in GamiPress <= 7.8.7 versions.	118d ago
CVE-2026-40766	8.5	—	—	—	—	Subscriber SQL Injection in MasterStudy LMS <= 3.7.25 versions.	118d ago
CVE-2026-24637	8.5	—	—	—	—	Contributor SQL Injection in PowerPress Podcasting <= 11.15.10 versions.	118d ago
CVE-2026-54420zero day	8.5	0.81%	3/3	13d before	litespeedtech / litespeed cpanel plugin	LiteSpeed cPanel plugin before 2.4.8 (as distributed in LiteSpeed WHM PlugIn before 5.3.2.0) mishandles symlinks p	120d ago
CVE-2026-50570	8.5	—	—	—	—	Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and	123d ago
CVE-2026-49824	8.5	—	—	—	—	Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and	123d ago
CVE-2026-45549	8.5	—	—	—	—	Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers.	123d ago
CVE-2026-47201	8.5	—	—	—	goauthentik / authentik	authentik is an open-source identity provider.	131d ago
CVE-2026-49120	8.5	—	—	—	—	Medplum before 5.1.14 contains a server-side request forgery vulnerability in the subscription worker that allows	131d ago
CVE-2026-9330	8.5	—	—	—	ibm / websphere application server	IBM WebSphere Application Server 9.0, and 8.5 is affected by an improper validation of user-supplied data during de	132d ago
CVE-2026-35563	8.5	—	—	—	apache / directory ldap api	It was identified that the LDAP client implementation in version 2.1.7 does not verify if the server certificate m	133d ago
CVE-2026-49489	8.5	—	—	—	—	OpenCATS through 0.9.7.4 contains a sql injection vulnerability in the sortDirection parameter of the DataGrid com	133d ago
CVE-2026-46372	8.5	—	—	—	—	SillyTavern is a locally installed user interface that allows users to interact with text generation large languag	135d ago
CVE-2026-44850	8.5	—	—	—	portainer / portainer	Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be	136d ago
CVE-2026-46820	8.5	—	—	—	oracle / financials common modules	Vulnerability in the Oracle Financials Common Modules product of Oracle E-Business Suite (component: Common Compon	136d ago
CVE-2026-44797	8.5	—	—	—	networktocode / nautobot	Nautobot is a Network Source of Truth and Network Automation Platform.	136d ago
CVE-2026-48153	8.5	—	—	—	—	Budibase is an open-source low-code platform.	137d ago
CVE-2026-49046	8.5	—	—	—	—	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arjun Thakur	137d ago
CVE-2026-42730	8.5	—	—	—	—	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Stylemix Mas	137d ago
CVE-2026-44706	8.5	—	—	—	—	Chatwoot is a customer engagement suite.	138d ago
CVE-2026-48837	8.5	—	—	—	—	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Unlimited El	139d ago
CVE-2026-3515	8.5	—	—	—	—	A vulnerability in the `GitHubRepository` block of the `prefect-github` integration in Prefect version 3.6.18 allow	141d ago
CVE-2026-45401	8.5	—	—	—	openwebui / open webui	Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline.	149d ago
CVE-2026-45400	8.5	—	—	—	openwebui / open webui	Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline.	149d ago
CVE-2026-45331	8.5	—	—	—	openwebui / open webui	Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline.	149d ago
CVE-2026-43998	8.5	—	—	—	vm2 project / vm2	vm2 is an open source vm/sandbox for Node.js.	151d ago
CVE-2026-44015	8.5	—	—	—	nginxui / nginx ui	Nginx UI is a web user interface for the Nginx web server.	152d ago
CVE-2026-43989	8.5	—	—	—	—	JunoClaw is an agentic AI platform built on Juno Network.	152d ago
CVE-2026-45214	8.5	—	—	—	—	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Xpro Xpro El	152d ago
CVE-2026-45211	8.5	—	—	—	—	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Saad Iqbal A	152d ago
CVE-2026-42742	8.5	—	—	—	—	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aman Views f	152d ago
CVE-2026-42741	8.5	—	—	—	—	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aman Ninja F	152d ago
CVE-2026-42860	8.5	—	—	—	openedx / edx-enterprise	The Open edx Enterprise Service app provides enterprise features to the Open edX platform.	153d ago
CVE-2026-42858	8.5	—	—	—	openedx / openedx	Open edX Platform enables the authoring and delivery of online learning at any scale.	153d ago
CVE-2026-42612	8.5	—	—	—	getgrav / grav	Grav is a file-based Web platform.	153d ago
CVE-2026-32710	8.5	—	—	—	mariadb / mariadb	MariaDB server is a community developed fork of MySQL server.	205d ago
CVE-2026-32433	8.5	—	—	—	—	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in codepeople C	212d ago
CVE-2026-32422	8.5	—	—	—	—	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in levelfourdev	212d ago
CVE-2026-32399	8.5	—	—	—	—	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in David Lingre	212d ago
CVE-2026-32368	8.5	—	—	—	—	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in delphiknight	212d ago

Sources: NIST National Vulnerability Database (descriptions, CVSS, CPE); CISA KEV, ENISA EUVD, CIRCL and VulnCheck (exploitation status, three catalogues counted; CIRCL shown as an aggregator); FIRST EPSS (exploitation probability). Patch window is the gap between CVE publication and the earliest KEV listing, so a negative value means a catalogue called it exploited before it was disclosed. Data refreshes every five hours.

Loading

CVE Tracker