CVE Tracker: vulnerabilities by vendor, severity and exploitation status

CVE Tracker

21,446 records

Every published CVE from the last 120 days with CVSS score, vendor and product, cross-referenced against CISA's Known Exploited Vulnerabilities catalog. 5 added to KEV in the last 7 days.

SeverityAll critical high medium lowExploitedIn CISA KEV

CVE	CVSS	EPSS	KEV sources	Patch window	Vendor / product	Summary	Published
CVE-2026-54666	8.3	—	—	—	—	swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification.	75d ago
CVE-2026-54664	8.3	—	—	—	—	swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification.	75d ago
CVE-2026-54662	8.3	—	—	—	—	swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications.	75d ago
CVE-2026-54661	8.3	—	—	—	—	swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification.	75d ago
CVE-2026-58153	8.3	—	—	—	apache / traffic server	Apache Traffic Server forwards HTTP/2 origin trailers to HTTP/1 clients without proper chunked framing when conver	75d ago
CVE-2026-17497	8.3	—	—	—	notegen / notegen	NoteGen before 0.32.0 grants the Tauri shell plugin shell:allow-execute capability for bash, python, and python3 w	78d ago
CVE-2026-64515	8.3	—	—	—	—	In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix MLE defragmentation If eit	79d ago
CVE-2026-65709	8.3	—	—	—	—	sysPass through version 3.2.11 contains a missing object-level authorization vulnerability in the JSON-RPC API tha	80d ago
CVE-2026-66027	8.3	—	—	—	—	Suna before 0.9.102 contains a broken access control vulnerability in the message queue API that allows authentica	80d ago
CVE-2026-16804	8.3	—	—	—	google / chrome	Use after free in Input in Google Chrome prior to 150.0.7871.186 allowed a remote attacker who had compromised the	81d ago
CVE-2026-16413	8.3	—	—	—	google / chrome	Out of bounds write in ANGLE in Google Chrome prior to 150.0.7871.182 allowed a remote attacker who had compromise	83d ago
CVE-2026-62473	8.3	—	—	—	oracle / installed base	Vulnerability in the Oracle Installed Base product of Oracle E-Business Suite (component: Create Item Instance).	83d ago
CVE-2026-60788	8.3	—	—	—	oracle / sales offline	Vulnerability in the Oracle Sales Offline product of Oracle E-Business Suite (component: Internal Operations).	83d ago
CVE-2026-60640	8.3	—	—	—	oracle / webcenter content	Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).	83d ago
CVE-2026-60582	8.3	—	—	—	oracle / enterprise command center framework	Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite (component: Cor	83d ago
CVE-2026-60471	8.3	—	—	—	oracle / webcenter content	Vulnerability in the WebCenter Content: Imaging product of Oracle Fusion Middleware (component: Core).	83d ago
CVE-2026-47419	8.3	—	—	—	—	PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system.	83d ago
CVE-2026-47415	8.3	—	—	—	—	PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system.	83d ago
CVE-2026-47866	8.3	—	—	—	broadcom / vmware avi load balancer	VMware Avi Load Balancer contains an authorization bypass vulnerability.	86d ago
CVE-2026-62349	8.3	—	—	—	—	TDengine is an open source, time-series database optimized for Internet of Things devices.	89d ago
CVE-2026-59258	8.3	—	—	—	—	immich before 3.0.3 contains a broken access control vulnerability in the PUT /albums/:id/user/:userId endpoint th	89d ago
CVE-2026-53516	8.3	—	—	—	better-auth / better auth	Better Auth is an authentication and authorization library for TypeScript.	89d ago
CVE-2026-20296	8.3	—	—	—	splunk / splunk	In Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.8, and 9.4.13, and Splunk Cloud Platform versions below 1	89d ago
CVE-2026-10673	8.3	—	—	—	zephyrproject / zephyr	The Zephyr ADIN2111/ADIN1110 10BASE-T1S/T1L Ethernet driver (drivers/ethernet/eth_adin2111.c) reassembles received	89d ago
CVE-2026-47158	8.3	—	—	—	—	Vaultwarden is a Bitwarden-compatible server written in Rust.	89d ago
CVE-2026-55723	8.3	—	—	—	f5 / nginx ingress controller	When NGINX Ingress Controller is configured with Custom Resource Definitions (CRDs) or Ingress annotations, an inj	89d ago
CVE-2026-56400	8.3	—	—	—	openwebui / open webui	open-webui before 0.3.14 contains a cross-origin resource sharing misconfiguration allowing arbitrary origins with	89d ago
CVE-2026-15774	8.3	—	—	—	google / chrome	Use after free in Skia in Google Chrome prior to 150.0.7871.125 allowed a remote attacker who had compromised the	90d ago
CVE-2026-15772	8.3	—	—	—	google / chrome	Use after free in GPU in Google Chrome on Android prior to 150.0.7871.125 allowed a remote attacker who had compro	90d ago
CVE-2026-15769	8.3	—	—	—	google / chrome	Insufficient validation of untrusted input in Linux Toolkit Theming in Google Chrome on Linux prior to 150.0.7871.	90d ago
CVE-2026-56181	8.3	—	—	—	microsoft / windows 11 24h2	Origin validation error in Windows Network Address Translation (NAT) allows an unauthorized attacker to perform sp	90d ago
CVE-2026-15736	8.3	—	—	—	—	Snowflake SQLAlchemy versions prior to 1.11.0 contain several security vulnerabilities, including: Improper handli	90d ago
CVE-2026-62196	8.3	—	—	—	openclaw / openclaw	OpenClaw versions 2026.3.22 before 2026.6.6 contain an authorization bypass vulnerability where WhatsApp group IDs	91d ago
CVE-2026-62195	8.3	—	—	—	openclaw / openclaw	OpenClaw versions 2026.5.20 before 2026.6.6 contain an authorization bypass vulnerability in the MCP loopback feat	91d ago
CVE-2026-58596	8.3	—	—	—	microsoft / edge chromium	Untrusted pointer dereference in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privil	92d ago
CVE-2026-56241	8.3	—	—	—	—	Capgo before 12.128.2 contains a privilege escalation vulnerability where demoted super_admin users retain access	92d ago
CVE-2026-58281	8.3	—	—	—	microsoft / edge chromium	Deserialization of untrusted data in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute co	93d ago
CVE-2026-57850	8.3	—	—	—	—	RustDesk before 1.4.9 does not enforce a session's authorized connection scope on the server side, so a peer grant	94d ago
CVE-2026-56675	8.3	—	—	—	—	9Router is an AI router & token saver.	94d ago
CVE-2026-56305	8.3	—	—	—	—	Capgo before 12.128.2 contains an authentication bypass vulnerability in the password change endpoint that allows	94d ago
CVE-2026-15122	8.3	—	—	—	google / chrome	Insufficient validation of untrusted input in Codecs in Google Chrome on Windows prior to 150.0.7871.115 allowed a	96d ago
CVE-2026-15120	8.3	—	—	—	google / chrome	Use after free in Core in Google Chrome on Windows prior to 150.0.7871.115 allowed a remote attacker who had compr	96d ago
CVE-2026-15119	8.3	—	—	—	google / chrome	Race in GetUserMedia in Google Chrome prior to 150.0.7871.115 allowed a remote attacker who had compromised the re	96d ago
CVE-2026-55830	8.3	—	—	—	—	RestrictedPython is a tool that helps to define a subset of the Python language which allows to provide a program	96d ago
CVE-2026-55427	8.3	—	—	—	coder / coder	Coder allows organizations to provision remote development environments via Terraform.	96d ago
CVE-2026-49229	8.3	—	—	—	—	Actual is a local-first personal finance app.	97d ago
CVE-2026-49471	8.3	—	—	—	oraios-ai / serena	Serena is a powerful MCP toolkit for coding that provides semantic retrieval and editing capabilities.	97d ago
CVE-2026-11340	8.3	—	—	—	—	Missing Authorization vulnerability in HAVELSAN Inc.	97d ago
CVE-2026-58295	8.3	—	—	—	microsoft / edge chromium	Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unautho	101d ago
CVE-2026-58288	8.3	—	—	—	microsoft / edge chromium	Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.	101d ago
CVE-2026-58287	8.3	—	—	—	microsoft / edge chromium	Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.	101d ago
CVE-2026-58285	8.3	—	—	—	microsoft / edge chromium	Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unautho	101d ago
CVE-2026-58284	8.3	—	—	—	microsoft / edge chromium	Improper authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a n	101d ago
CVE-2026-55118	8.3	—	—	—	ui / unifi network application	A malicious actor with access to the network,low privileges and under certain conditions could exploit an Improper	102d ago
CVE-2026-57278	8.3	—	—	—	—	GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that	102d ago
CVE-2026-57277	8.3	—	—	—	—	GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that	102d ago
CVE-2026-57276	8.3	—	—	—	—	GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that	102d ago
CVE-2026-57275	8.3	—	—	—	—	GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that	102d ago
CVE-2026-57274	8.3	—	—	—	—	GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that	102d ago
CVE-2026-57273	8.3	—	—	—	—	GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that	102d ago

Sources: NIST National Vulnerability Database (descriptions, CVSS, CPE); CISA KEV, ENISA EUVD, CIRCL and VulnCheck (exploitation status, three catalogues counted; CIRCL shown as an aggregator); FIRST EPSS (exploitation probability). Patch window is the gap between CVE publication and the earliest KEV listing, so a negative value means a catalogue called it exploited before it was disclosed. Data refreshes every five hours.

Loading

CVE Tracker