CVE Tracker: vulnerabilities by vendor, severity and exploitation status

CVE Tracker

21,446 records

Every published CVE from the last 120 days with CVSS score, vendor and product, cross-referenced against CISA's Known Exploited Vulnerabilities catalog. 5 added to KEV in the last 7 days.

SeverityAll critical high medium lowExploitedIn CISA KEV

CVE	CVSS	EPSS	KEV sources	Patch window	Vendor / product	Summary	Published
CVE-2024-58023	8.4	—	—	—	—	Information disclosure in Bosch Configuration Manager in Version 7.72.0106 allows an attacker to access sensitive	81d ago
CVE-2026-60837	8.4	—	—	—	oracle / price protection	Vulnerability in the Oracle Price Protection product of Oracle E-Business Suite (component: Internal Operations).	82d ago
CVE-2026-60763	8.4	—	—	—	oracle / applications manager	Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Command Line - Rap	82d ago
CVE-2026-60723	8.4	—	—	—	oracle / data integrator	Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Market Place).	82d ago
CVE-2026-60677	8.4	—	—	—	oracle / e-business suite	Vulnerability in the Oracle Common Application Components product of Oracle E-Business Suite (component: Oracle Co	82d ago
CVE-2026-60383	8.4	—	—	—	oracle / service delivery platform	Vulnerability in the Service Delivery Platform product of Oracle Fusion Middleware (component: Messaging Enabler).	82d ago
CVE-2026-60196	8.4	—	—	—	oracle / weblogic server	Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).	82d ago
CVE-2026-60163	8.4	—	—	—	oracle / mysql server	Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication Plu	82d ago
CVE-2026-64877	8.4	—	—	—	tenable / security center	An authenticated non-admin user can exploit a SQL injection flaw in the ticketing REST API to access sensitive dat	82d ago
CVE-2026-64824	8.4	—	—	—	—	Home Assistant Core before 2026.7.0 contains a path traversal vulnerability in the backup-restore function that al	83d ago
CVE-2026-15226	8.4	—	—	—	—	A sandbox confinement bypass vulnerability exists in Canonical snapd within its internal execution environment com	83d ago
CVE-2026-28220	8.4	—	—	—	wazuh / wazuh	Wazuh is a free and open source platform used for threat prevention, detection, and response.	84d ago
CVE-2026-64151	8.4	—	—	—	linux / linux kernel	In the Linux kernel, the following vulnerability has been resolved: iommupt: Check for missing PAGE_SIZE in the pg	85d ago
CVE-2026-64118	8.4	—	—	—	linux / linux kernel	In the Linux kernel, the following vulnerability has been resolved: qed: fix double free in qed_cxt_tables_alloc()	85d ago
CVE-2026-64081	8.4	—	—	—	linux / linux kernel	In the Linux kernel, the following vulnerability has been resolved: firmware: arm_ffa: Validate framework notifica	85d ago
CVE-2026-64045	8.4	—	—	—	linux / linux kernel	In the Linux kernel, the following vulnerability has been resolved: ovpn: tcp - use cached peer pointer in ovpn_tc	85d ago
CVE-2026-63952	8.4	—	—	—	—	In the Linux kernel, the following vulnerability has been resolved: memfd: deny writeable mappings when implying S	85d ago
CVE-2026-63926	8.4	—	—	—	—	In the Linux kernel, the following vulnerability has been resolved: bpf: sockmap: fix tail fragment offset in bpf_	85d ago
CVE-2026-63906	8.4	—	—	—	—	In the Linux kernel, the following vulnerability has been resolved: usb: musb: omap2430: Fix use-after-free in oma	85d ago
CVE-2026-63864	8.4	—	—	—	—	In the Linux kernel, the following vulnerability has been resolved: bpf: Propagate error from visit_tailcall_insn	85d ago
CVE-2026-63860	8.4	—	—	—	—	In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Prefer NLA_NUL_STRING These attribu	85d ago
CVE-2026-63828	8.4	—	—	—	—	In the Linux kernel, the following vulnerability has been resolved: apparmor: mediate the implicit connect of TCP	85d ago
CVE-2026-63818	8.4	—	—	—	—	In the Linux kernel, the following vulnerability has been resolved: f2fs: validate orphan inode entry count f2fs_r	85d ago
CVE-2026-63815	8.4	—	—	—	—	In the Linux kernel, the following vulnerability has been resolved: f2fs: bound i_inline_xattr_size for non-inline	85d ago
CVE-2026-63797	8.4	—	—	—	linux / linux kernel	In the Linux kernel, the following vulnerability has been resolved: rpmsg: char: Fix use-after-free on probe error	85d ago
CVE-2026-53369	8.4	—	—	—	linux / linux kernel	In the Linux kernel, the following vulnerability has been resolved: udf: reject descriptors with oversized CRC len	85d ago
CVE-2026-61446	8.4	—	—	—	—	PraisonAI (praisonaiagents) before 1.6.78 contains a remote code execution vulnerability in the plugin manager, wh	89d ago
CVE-2026-24233	8.4	—	—	—	—	NVIDIA TensorRT-LLM for Linux contains a vulnerability in the restricted unpickler used for model weight deseriali	89d ago
CVE-2026-55045	8.4	—	—	—	microsoft / 365 apps	Out-of-bounds read in Microsoft Office allows an unauthorized attacker to execute code locally.	90d ago
CVE-2026-54128	8.4	—	—	—	microsoft / windows 10 1607	Use after free in Windows DHCP Client allows an unauthorized attacker to execute code locally.	90d ago
CVE-2026-54992	8.4	—	—	—	microsoft / windows 10 1607	Heap-based buffer overflow in Windows Message Queuing Queue Manager allows an unauthorized attacker to execute cod	90d ago
CVE-2026-54122	8.4	—	—	—	microsoft / windows 10 1607	Heap-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code locally.	90d ago
CVE-2026-50520	8.4	—	—	—	microsoft / visual studio code	Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows a	90d ago
CVE-2026-49184	8.4	—	—	—	microsoft / windows 10 1607	Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code locally.	90d ago
CVE-2026-0487	8.4	—	—	—	—	SAProuter on Microsoft Windows allows an unauthenticated attacker to load library (DLL) files from an untrusted loc	90d ago
CVE-2026-57432	8.4	—	—	—	perl / perl	Perl versions through 5.43.10 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read i	91d ago
CVE-2026-54424	8.4	—	—	—	—	An Incorrect Use of Privileged APIs vulnerability in Unity Parsec on Windows hosts leads to a potential Elevation	100d ago
CVE-2026-44941	8.4	—	—	—	opensuse / libzypp	A relative path traversal in the "keyhint" option in repomd.xml parsing of libzypp before 17.38.12 can be used by	102d ago
CVE-2026-58302	8.4	—	—	—	—	rtapi_app in linuxcnc-uspace in LinuxCNC before 2.9.9 allows privilege escalation.	104d ago
CVE-2026-12411	8.4	—	—	—	canonical / lxd	Broken Access Control in the devLXDInstancePatchHandler component of Canonical LXD allows an untrusted guest to mo	108d ago
CVE-2026-54096	8.4	—	—	—	—	File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within	108d ago
CVE-2026-53091	8.4	—	—	—	linux / linux kernel	In the Linux kernel, the following vulnerability has been resolved: net: pull headers in qdisc_pkt_len_segs_init()	110d ago
CVE-2026-54320	8.4	—	—	—	—	Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows.	110d ago
CVE-2026-55255exploited	8.4	0.89%	3/3	+3d	langflow / langflow	Langflow is a tool for building and deploying AI-powered agents and workflows.	111d ago
CVE-2025-26240	8.4	—	—	—	—	In JazzCore python-pdfkit 1.0.0, the from_string method enables the execution of JavaScript code within the contex	117d ago
CVE-2026-46788	8.4	—	—	—	oracle / webcenter content	Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).	117d ago
CVE-2026-35272	8.4	—	—	—	oracle / peoplesoft enterprise pt peopletools	Vulnerability in the PeopleSoft Enterprise PT PeopleTools product of Oracle PeopleSoft (component: Deployment Pack	117d ago
CVE-2026-39118	8.4	—	—	—	—	An issue in Iru, Inc Kandji Agent before v.4.7.5(5374) allows a local attacker to escalate privileges via a client	118d ago
CVE-2026-24067	8.4	—	—	—	—	Slate Digital Connect 1.37.0 for macOS installs a privileged helper tool, com.slatedigital.connect.privileged.help	124d ago
CVE-2026-24066	8.4	—	—	—	—	Slate Digital Connect 1.37.0 for macOS installs a privileged helper tool, com.slatedigital.connect.privileged.help	124d ago
CVE-2026-47931	8.4	—	—	—	adobe / coldfusion	ColdFusion versions 2023.19, 2025.8 and earlier are affected by an Improper Input Validation vulnerability that co	124d ago
CVE-2026-47929	8.4	—	—	—	adobe / coldfusion	ColdFusion versions 2023.19, 2025.8 and earlier are affected by an Incorrect Authorization vulnerability that coul	124d ago
CVE-2026-47635	8.4	—	—	—	microsoft / office 2024	Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.	125d ago
CVE-2026-45641	8.4	—	—	—	microsoft / windows 10 21h2	Access of resource using incompatible type ('type confusion') in Windows Hyper-V allows an unauthorized attacker t	125d ago
CVE-2026-45607	8.4	—	—	—	microsoft / windows 10 1607	Out-of-bounds read in Windows Hyper-V allows an unauthorized attacker to execute code locally.	125d ago
CVE-2026-45482	8.4	—	—	—	microsoft / visual studio code	Improper limitation of a pathname to a restricted directory ('path traversal') in GitHub Copilot and Visual Studio	125d ago
CVE-2026-45474	8.4	—	—	—	microsoft / 365 apps	Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.	125d ago
CVE-2026-45472	8.4	—	—	—	microsoft / 365 apps	Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.	125d ago
CVE-2026-45463	8.4	—	—	—	microsoft / 365 apps	Integer underflow (wrap or wraparound) in Microsoft Office allows an unauthorized attacker to execute code locally	125d ago
CVE-2026-45461	8.4	—	—	—	microsoft / 365 apps	Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.	125d ago

Sources: NIST National Vulnerability Database (descriptions, CVSS, CPE); CISA KEV, ENISA EUVD, CIRCL and VulnCheck (exploitation status, three catalogues counted; CIRCL shown as an aggregator); FIRST EPSS (exploitation probability). Patch window is the gap between CVE publication and the earliest KEV listing, so a negative value means a catalogue called it exploited before it was disclosed. Data refreshes every five hours.

Loading

CVE Tracker