CVE Tracker: vulnerabilities by vendor, severity and exploitation status

CVE Tracker

21,446 records

Every published CVE from the last 120 days with CVSS score, vendor and product, cross-referenced against CISA's Known Exploited Vulnerabilities catalog. 5 added to KEV in the last 7 days.

SeverityAll critical high medium lowExploitedIn CISA KEV

CVE	CVSS	EPSS	KEV sources	Patch window	Vendor / product	Summary	Published
CVE-2026-32366	8.5	—	—	—	—	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in robfelty Col	212d ago
CVE-2026-32365	8.5	—	—	—	—	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in robfelty Col	212d ago
CVE-2026-31922	8.5	—	—	—	—	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ays Pro Fox	212d ago
CVE-2026-31917	8.5	—	—	—	—	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in weDevs WP ER	212d ago
CVE-2026-32246	8.5	—	—	—	tinyauth / tinyauth	Tinyauth is an authentication and authorization server.	213d ago
CVE-2025-12737	8.4	—	—	—	—	The administrative operations within the Carbon Console do not adequately validate specific user-supplied input.	39d ago
CVE-2026-80753	8.4	—	—	—	—	In the Linux kernel, the following vulnerability has been resolved: ovpn: run deferred work on a module-owned work	39d ago
CVE-2026-80752	8.4	—	—	—	—	In the Linux kernel, the following vulnerability has been resolved: Input: psxpad-spi - set driver data before use	39d ago
CVE-2026-80750	8.4	—	—	—	—	In the Linux kernel, the following vulnerability has been resolved: pmdomain: mediatek: fix remaining %pOF after o	39d ago
CVE-2026-80745	8.4	—	—	—	—	In the Linux kernel, the following vulnerability has been resolved: regulator: fp9931: Fix VPOS/VNEG voltage selec	39d ago
CVE-2026-73781	8.4	—	—	—	hpe / arubaos-cx	A vulnerability in the web-based management interface of AOS-CX could allow an authenticated remote attacker to co	40d ago
CVE-2026-82862	8.4	—	—	—	—	Hulumi versions before v1.3.2 resolve the threat-model helper script from an unsafe root, allowing workspace files	42d ago
CVE-2026-80723	8.4	—	—	—	—	In the Linux kernel, the following vulnerability has been resolved: of: reserved_mem: prevent OOB when too many dy	45d ago
CVE-2026-80713	8.4	—	—	—	—	In the Linux kernel, the following vulnerability has been resolved: io_uring: preserve task restrictions across ex	45d ago
CVE-2026-80712	8.4	—	—	—	—	In the Linux kernel, the following vulnerability has been resolved: spi: spi-qpic-snand: write the feature value b	45d ago
CVE-2026-80678	8.4	—	—	—	—	In the Linux kernel, the following vulnerability has been resolved: i2c: imx: Fix slave registration race and erro	45d ago
CVE-2026-80653	8.4	—	—	—	—	In the Linux kernel, the following vulnerability has been resolved: scsi: hisi_sas: Add slave_destroy interface fo	45d ago
CVE-2026-80596	8.4	—	—	—	—	In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - only expose sysfs attributes	45d ago
CVE-2026-80593	8.4	—	—	—	—	In the Linux kernel, the following vulnerability has been resolved: hwmon: (asus_atk0110) Check package count befo	45d ago
CVE-2026-81683	8.4	—	—	—	jahlives / openssl encrypt	openssl_encrypt (pip package openssl-encrypt) versions 1.4.8 and earlier store an mTLS client private key in clear	46d ago
CVE-2026-81097	8.4	—	—	—	—	The execute_ruby tool is documented as a read-only Ruby sandbox and is enforced by a pattern denylist together wit	46d ago
CVE-2026-80427	8.4	—	—	—	—	bestzip builds the argument list for the system zip utility without separating options from operands.	47d ago
CVE-2026-80584	8.4	—	—	—	—	In the Linux kernel, the following vulnerability has been resolved: s390/qeth: validate user buffer length in SNMP	47d ago
CVE-2026-80574	8.4	—	—	—	—	In the Linux kernel, the following vulnerability has been resolved: Input: focaltech - fix array out-of-bounds in	47d ago
CVE-2026-80536	8.4	—	—	—	—	In the Linux kernel, the following vulnerability has been resolved: xfs: bounds-check buffer log item's dirty bitm	47d ago
CVE-2026-52491	8.4	—	—	—	—	An issue in libtiff 85f2ac8e0b01cb7db2bbecf4a3b891bdbef67938 allows an attacker to execute arbitrary code via the	47d ago
CVE-2026-79774	8.4	—	—	—	—	Winter CMS versions before 1.2.13 contain an incomplete fix for a Twig sandbox escape vulnerability in System\\Twi	48d ago
CVE-2026-55582	8.4	—	—	—	—	mcp-shell is an MCP server for running shell commands securely, auditably, and on demand.	48d ago
CVE-2026-55581	8.4	—	—	—	—	mcp-shell is an MCP server for running shell commands securely, auditably, and on demand.	48d ago
CVE-2026-78675	8.4	—	—	—	gitpython project / gitpython	GitPython before 3.1.59 fails to disable merge_includes when parsing .gitmodules, allowing attackers to disclose l	48d ago
CVE-2026-72696	8.4	—	—	—	—	Grav CMS before 2.0.16 contains a symlink following vulnerability in Scheduler Job::createLockFile() that allows l	48d ago
CVE-2026-59566	8.4	—	—	—	—	A locally exploitable buffer overflow bug can cause a local denial-of-service attack on affected versions of Zscal	49d ago
CVE-2026-74711	8.4	—	—	—	—	In the Linux kernel, the following vulnerability has been resolved: hwmon: (pmbus) Fix type confusion in notificat	51d ago
CVE-2026-74690	8.4	—	—	—	—	In the Linux kernel, the following vulnerability has been resolved: s390/ism: Fix UAF of sba and ieq during ism_de	51d ago
CVE-2026-74631	8.4	—	—	—	—	In the Linux kernel, the following vulnerability has been resolved: net: smc: fix splice entry lifetime imbalance	51d ago
CVE-2026-74614	8.4	—	—	—	—	In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: read virtqueues under worker loc	51d ago
CVE-2026-74604	8.4	—	—	—	—	In the Linux kernel, the following vulnerability has been resolved: Revert "thermal/drivers/hwmon: Cleanup coding	51d ago
CVE-2026-74589	8.4	—	—	—	—	In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix sk_redir use-after-free in s	51d ago
CVE-2026-18842	8.4	—	—	—	ibm / vios	IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to gain elevated privileges due to an o	52d ago
CVE-2026-18824	8.4	—	—	—	ibm / vios	IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated attacker to execute arbitrary com	52d ago
CVE-2026-63388	8.4	—	—	—	—	Libevent is an event notification library.	52d ago
CVE-2026-17091	8.4	—	—	—	ibm / power system s1122 \(9824-22a\) firmware	IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through F	53d ago
CVE-2026-16832	8.4	—	—	—	ibm / power system e1080 \(9080-hex\) firmware	IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 throu	53d ago
CVE-2026-44901	8.4	—	—	—	—	Wazuh is a free and open source platform used for threat prevention, detection, and response.	54d ago
CVE-2026-58083	8.4	—	—	—	freebsd / freebsd	While the kernel was copying knotes during fork, a knote with a timer-based filter could fire and be enqueued on t	54d ago
CVE-2026-49428	8.4	—	—	—	freebsd / freebsd	Certain system calls, such open(2) with the O_TRUNC flag set, and fspacectl(2), could incorrectly free memory in l	54d ago
CVE-2026-49422	8.4	—	—	—	freebsd / freebsd	The RACK setsockopt(2) handler drops the connection lock in order to copy option data from userspace, then reacqui	54d ago
CVE-2026-76037	8.4	—	—	—	google / chrome	Link following in CredentialProvider in Google Chrome on on Windows prior to 151.0.7922.169 allowed a local attack	54d ago
CVE-2026-70842	8.4	—	—	—	oracle / hyperion financial management	Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security).	54d ago
CVE-2026-70840	8.4	—	—	—	oracle / hyperion financial management	Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security).	54d ago
CVE-2026-70731	8.4	—	—	—	oracle / autonomous health framework	Vulnerability in Oracle Autonomous Health Framework (component: Trace File Analyzer).	54d ago
CVE-2026-60928	8.4	—	—	—	oracle / webcenter content	Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).	54d ago
CVE-2026-64657	8.4	—	—	—	—	Budibase is an open-source low-code platform.	55d ago
CVE-2026-46345	8.4	—	—	—	—	compliance-trestle is a tooling platform for managing compliance as code.	55d ago
CVE-2026-75060	8.4	—	—	—	—	In JetBrains PyCharm before 2026.2.1 code execution was possible via unauthenticated Jupyter MCP tools	56d ago
CVE-2026-74497	8.4	—	—	—	—	In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Clamp frame size in implicit-	58d ago
CVE-2026-74492	8.4	—	—	—	—	In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: do not update comments from	58d ago
CVE-2026-74461	8.4	—	—	—	—	In the Linux kernel, the following vulnerability has been resolved: i2c: imx: Cancel hrtimer before clearing slave	58d ago
CVE-2026-74383	8.4	—	—	—	—	In the Linux kernel, the following vulnerability has been resolved: nvme-pci: fix out-of-bounds access in nvme_set	58d ago
CVE-2026-74333	8.4	—	—	—	—	In the Linux kernel, the following vulnerability has been resolved: ASoC: amd: acp-sdw-legacy: Bound DAI link iter	58d ago

Sources: NIST National Vulnerability Database (descriptions, CVSS, CPE); CISA KEV, ENISA EUVD, CIRCL and VulnCheck (exploitation status, three catalogues counted; CIRCL shown as an aggregator); FIRST EPSS (exploitation probability). Patch window is the gap between CVE publication and the earliest KEV listing, so a negative value means a catalogue called it exploited before it was disclosed. Data refreshes every five hours.

Loading

CVE Tracker