CVE Tracker: vulnerabilities by vendor, severity and exploitation status

CVE Tracker

15,513 records

Every published CVE from the last 120 days with CVSS score, vendor and product, cross-referenced against CISA's Known Exploited Vulnerabilities catalog. 8 added to KEV in the last 7 days.

SeverityAll critical high medium lowExploitedIn CISA KEV

CVE	CVSS	EPSS	KEV sources	Patch window	Vendor / product	Summary	Published
CVE-2026-54457	7.7	—	—	—	—	TensorZero is an open-source LLMOps platform that unifies an LLM gateway, observability, evaluation, optimization,	69d ago
CVE-2026-55622	7.7	—	—	—	—	Incus is a system container and virtual machine manager.	69d ago
CVE-2026-55621	7.7	—	—	—	—	Incus is a system container and virtual machine manager.	69d ago
CVE-2026-73267	7.7	—	—	—	—	A flaw was found in the clusterclaims-controller component of multicluster engine (MCE).	69d ago
CVE-2026-69855	7.7	—	—	—	—	Server-side request forgery (ssrf) in Microsoft Copilot in Azure allows an authorized attacker to disclose informa	70d ago
CVE-2026-17423	7.7	—	—	—	ibm / vios	IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to obtain sensitive information and ca	70d ago
CVE-2026-17024	7.7	—	—	—	ibm / vios	IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to impro	70d ago
CVE-2026-17003	7.7	—	—	—	ibm / vios	IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to compromise the confidentiality and	70d ago
CVE-2026-73137	7.7	—	—	—	—	A flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management (RHACM)	70d ago
CVE-2026-76344	7.7	—	—	—	splunk / splunk	In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "p	71d ago
CVE-2026-75569	7.7	—	—	—	—	A flaw was found in mce-operator-bundle.	71d ago
CVE-2026-54493	7.7	—	—	—	—	Koel is a free, open-source music streaming solution.	71d ago
CVE-2026-53549	7.7	—	—	—	—	Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities.	71d ago
CVE-2026-16819	7.7	—	—	—	ibm / vios	IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to cause a denial of service and compro	71d ago
CVE-2026-76225	7.7	—	—	—	—	ArcadeDB before 26.8.1 contains a server-side request forgery vulnerability in the OpenCypher LOAD CSV implementat	71d ago
CVE-2026-71141	7.7	—	—	—	oracle / vm virtualbox	Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).	72d ago
CVE-2026-71056	7.7	—	—	—	oracle / business intelligence	Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Se	72d ago
CVE-2026-70988	7.7	—	—	—	oracle / commerce experience manager	Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce	72d ago
CVE-2026-70945	7.7	—	—	—	oracle / payroll	Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations).	72d ago
CVE-2026-70942	7.7	—	—	—	oracle / hyperion financial management	Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security).	72d ago
CVE-2026-70894	7.7	—	—	—	oracle / hyperion data relationship management	Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access an	72d ago
CVE-2026-70857	7.7	—	—	—	oracle / siebel crm	Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Open UI).	72d ago
CVE-2026-70828	7.7	—	—	—	oracle / hyperion financial management	Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security).	72d ago
CVE-2026-70827	7.7	—	—	—	oracle / mes for process manufacturing	Vulnerability in the Oracle MES for Process Manufacturing product of Oracle E-Business Suite (component: Internal	72d ago
CVE-2026-70804	7.7	—	—	—	oracle / public sector human resources	Vulnerability in the Oracle Public Sector Human Resources product of Oracle E-Business Suite (component: Regressio	72d ago
CVE-2026-70771	7.7	—	—	—	oracle / warehouse management	Vulnerability in the Oracle Warehouse Management product of Oracle E-Business Suite (component: Internal Operation	72d ago
CVE-2026-70723	7.7	—	—	—	oracle / hyperion profitability and cost management	Vulnerability in the Oracle Hyperion Profitability and Cost Management product of Oracle Hyperion (component: Depl	72d ago
CVE-2026-70717	7.7	—	—	—	oracle / autonomous health framework	Vulnerability in Oracle Autonomous Health Framework (component: Cluster Health Analyzer).	72d ago
CVE-2026-70695	7.7	—	—	—	oracle / payments	Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission).	72d ago
CVE-2026-70694	7.7	—	—	—	oracle / payments	Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission).	72d ago
CVE-2026-70692	7.7	—	—	—	oracle / marketing encyclopedia system	Vulnerability in the Oracle Marketing Encyclopedia System product of Oracle E-Business Suite (component: Internal	72d ago
CVE-2026-70687	7.7	—	—	—	oracle / marketing	Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Audience).	72d ago
CVE-2026-62594	7.7	—	—	—	oracle / siebel crm	Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: Open Integration).	72d ago
CVE-2026-62593	7.7	—	—	—	oracle / siebel crm	Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: Open Integration).	72d ago
CVE-2026-62571	7.7	—	—	—	oracle / hyperion calculation manager	Vulnerability in the Oracle Hyperion Calculation Manager product of Oracle Hyperion (component: Security).	72d ago
CVE-2026-62467	7.7	—	—	—	oracle / hyperion infrastructure technology	Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Common Event	72d ago
CVE-2026-61331	7.7	—	—	—	oracle / e-business suite	Vulnerability in the Oracle Financials Common Modules product of Oracle E-Business Suite (component: Common Compon	72d ago
CVE-2026-61199	7.7	—	—	—	oracle / webcenter portal	Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools).	72d ago
CVE-2026-60983	7.7	—	—	—	oracle / webcenter content	Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).	72d ago
CVE-2026-60969	7.7	—	—	—	oracle / unified directory	Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD Core).	72d ago
CVE-2026-60733	7.7	—	—	—	oracle / webcenter portal	Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Composer).	72d ago
CVE-2026-71307	7.7	—	—	—	—	Lemur manages TLS certificate creation.	72d ago
CVE-2026-71303	7.7	—	—	—	—	Lemur manages TLS certificate creation.	72d ago
CVE-2026-71365	7.7	—	—	—	—	A server-side request forgery (SSRF) vulnerability was found in AWX's webhook status callback mechanism.	72d ago
CVE-2026-50575	7.7	—	—	—	—	BetterDesk is a remote desktop management solution.	72d ago
CVE-2026-75842	7.7	—	—	—	—	ArcadeDB versions before 26.8.1 contain an arbitrary file read vulnerability in the OpenCypher LOAD CSV FROM claus	72d ago
CVE-2026-71567	7.7	—	—	—	—	In openshift-metal3/fakefish there is a repeated pattern in some of the scripts where shell variables are injected	73d ago
CVE-2026-74869	7.7	—	—	—	—	stoatchat before 0.15.0 contains a missing authorization vulnerability in the Subscribe message handler that allow	73d ago
CVE-2026-72487	7.7	—	—	—	—	In the Linux kernel, the following vulnerability has been resolved: PCI: Check ROM header and data structure addr	75d ago
CVE-2026-69101	7.7	—	—	—	—	Datavane TIS v5.0.0 contains an XML external entity (XXE) injection vulnerability that allows authenticated attack	76d ago
CVE-2026-72859	7.7	—	—	—	—	Budibase versions 3.39.4 before 3.40.0 contain an authorization regression in the S3 attachment upload endpoint th	76d ago
CVE-2026-72857	7.7	—	—	—	—	Budibase before 3.40.0 fails to redact datasource credentials stored in STRING typed fields, allowing authenticate	77d ago
CVE-2026-72849	7.7	—	—	—	—	Budibase before 3.40.0 contains a cross-site request forgery vulnerability in the chat-link handoff endpoint that	77d ago
CVE-2026-73530	7.7	—	—	—	—	Flyto2 Core before 2.28.0 contains a server-side request forgery guard bypass vulnerability that allows attackers	77d ago
CVE-2026-72672	7.7	—	—	—	elastic / kibana	The Elastic Security capability that suggests existing field values while a user authors endpoint policy artifacts	77d ago
CVE-2026-72670	7.7	—	—	—	elastic / kibana	A lower privileged user who holds only the privilege to read agent policies can read the entire configuration of a	77d ago
CVE-2026-58314	7.7	—	—	—	—	Two SSRF findings in Gitea 1.26.2	77d ago
CVE-2026-66661	7.7	—	—	—	—	Subscriber Privilege Escalation in Directories Pro <= 2.0.5 versions.	77d ago
CVE-2026-65582	7.7	—	—	—	—	Subscriber Arbitrary File Download in AI Hub <= 1.3.10 versions.	77d ago
CVE-2026-73498	7.7	—	—	—	—	MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira).	78d ago

Sources: NIST National Vulnerability Database (descriptions, CVSS, CPE); CISA KEV, ENISA EUVD, CIRCL and VulnCheck (exploitation status, three catalogues counted; CIRCL shown as an aggregator); FIRST EPSS (exploitation probability). Patch window is the gap between CVE publication and the earliest KEV listing, so a negative value means a catalogue called it exploited before it was disclosed. Data refreshes every five hours.

Loading

CVE Tracker