CVE Tracker: vulnerabilities by vendor, severity and exploitation status

CVE Tracker

15,513 records

Every published CVE from the last 120 days with CVSS score, vendor and product, cross-referenced against CISA's Known Exploited Vulnerabilities catalog. 10 added to KEV in the last 7 days.

SeverityAll critical high medium lowExploitedIn CISA KEV

CVE	CVSS	EPSS	KEV sources	Patch window	Vendor / product	Summary	Published
CVE-2026-14866	7.7	—	—	—	ibm / i access client solutions	IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 is vulnerable to injection of rogue certificate authority d	78d ago
CVE-2026-16863	7.7	—	—	—	ibm / i	IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to an	78d ago
CVE-2026-16627	7.7	—	—	—	gitlab / gitlab	GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.2 that under certain c	78d ago
CVE-2026-73122	7.7	—	—	—	—	A flaw was found in the multicloud-operators-channel component of Red Hat Advanced Cluster Management (RHACM).	78d ago
CVE-2026-66878	7.7	—	—	—	—	A flaw was found in multicloud-operators-subscription.	78d ago
CVE-2026-48447	7.7	—	—	—	adobe / lightroom	Lightroom Classic is affected by an Incorrect Authorization vulnerability that could result in arbitrary code exec	79d ago
CVE-2026-48414	7.7	—	—	—	—	Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-priv	79d ago
CVE-2026-48385	7.7	—	—	—	adobe / coldfusion	ColdFusion is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Inject	79d ago
CVE-2026-18127	7.7	—	—	—	—	External control of a filename in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a remote auth	79d ago
CVE-2026-72773	7.7	—	—	—	n8n / n8n	n8n before 2.31.5 and 2.32.x before 2.32.1 contain a path-confinement bypass in the @n8n/computer-use file-search	79d ago
CVE-2026-18941	7.7	—	—	—	—	A flaw was found in Feast and feast-operator.	80d ago
CVE-2026-68340	7.7	—	—	—	—	In the Linux kernel, the following vulnerability has been resolved: hwmon: occ: validate poll response sensor bloc	80d ago
CVE-2026-68255	7.7	—	—	—	—	In the Linux kernel, the following vulnerability has been resolved: drm/virtio: bound EDID block reads to the resp	80d ago
CVE-2026-72591	7.7	—	—	—	—	A server-side request forgery (SSRF) vulnerability in gabehf/Koito through v0.3.2 allows an authenticated user to	80d ago
CVE-2026-72566	7.7	—	—	—	—	A server-side request forgery (SSRF) vulnerability in automatisch through commit 41f3c56 allows a low-privileged a	80d ago
CVE-2026-67620	7.7	—	—	—	flowiseai / flowise	Flowise through 3.1.4 contains a server-side request forgery vulnerability in the SSRF guard implemented in httpSe	82d ago
CVE-2026-16589	7.7	—	—	—	—	The WP Directory Kit WordPress plugin before 1.5.5 does not sanitize and escape a parameter before using it in a S	82d ago
CVE-2026-64636	7.7	—	—	—	—	An SQL injection vulnerability in Plesk Obsidian up to 18.0.80 for Linux and Windows allows an authenticated user	83d ago
CVE-2026-56793	7.7	—	—	—	dell / openmanage server administrator	Dell OpenManage Server Administrator, versions prior to 11.1.0.2, contains an Improper Authentication vulnerabilit	83d ago
CVE-2026-8183	7.7	—	—	—	langflow / langflow	IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 thro	85d ago
CVE-2026-20313	7.7	—	—	—	—	As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Catalyst SD-WAN enginee	85d ago
CVE-2026-20124	7.7	—	—	—	—	A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS XE Software could allow an	85d ago
CVE-2026-51401	7.7	—	—	—	vim / vim	An issue in Vim Project v9.2.0389 and earlier allows a local attacker to execute arbitrary code via the vms_fixfil	86d ago
CVE-2026-70479	7.7	—	—	—	—	Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform.	86d ago
CVE-2026-66310	7.7	—	—	—	microsoft / edge	External control of file name or path in Microsoft Edge for Android allows an unauthorized attacker to disclose in	86d ago
CVE-2026-69086	7.7	—	—	—	—	SiYuan versions before v3.7.3 fail to validate the avID parameter on all code branches in attribute-view read endp	87d ago
CVE-2026-20483	7.7	—	—	—	mediatek / mt8893 firmware	In Telephony, there is a possible escalation of privilege due to a missing permission check.	87d ago
CVE-2026-14538	7.7	—	—	—	google / mcp toolbox for databases	An improper authorization and security-boundary bypass vulnerability in the bigquery-execute-sql tool component of	90d ago
CVE-2026-59931	7.7	—	—	—	—	PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files.	93d ago
CVE-2026-28896	7.7	—	—	—	apple / macos	The issue was addressed with improved memory handling.	94d ago
CVE-2026-17527	7.7	—	—	—	—	In containerized-data-importer (CDI), the aggregated cdi.kubevirt.io:view ClusterRole, intended to provide read-on	94d ago
CVE-2026-64524	7.7	—	—	—	—	In the Linux kernel, the following vulnerability has been resolved: drm/hyperv: validate resolution_count and fix	96d ago
CVE-2026-64456	7.7	—	—	—	—	In the Linux kernel, the following vulnerability has been resolved: hwrng: virtio: clamp device-reported used.len	96d ago
CVE-2026-63313	7.7	—	—	—	—	9Router before 0.4.72 contains a server-side request forgery (SSRF) vulnerability in the /v1/web/fetch endpoint.	98d ago
CVE-2026-43820	7.7	—	—	—	apple / swiftnio ssl	NIOSSLCertificate._subjectAlternativeNames provides access to the raw bytes for a cert's SANs.	98d ago
CVE-2026-59542	7.7	—	—	—	—	Subscriber Arbitrary File Deletion in Kali Forms <= 2.4.18 versions.	98d ago
CVE-2026-13078	7.7	—	—	—	mongodb / mongodb	A vulnerability was discovered in MongoDB Server where the server-side MozJS scripting engine unconditionally regi	99d ago
CVE-2026-61390	7.7	—	—	—	—	There is a heap buffer overflow vulnerability in some Hikvision cameras, which may allow unauthenticated attackers	99d ago
CVE-2026-62567	7.7	—	—	—	oracle / human resources management system	Vulnerability in the Oracle HRMS (UK) product of Oracle E-Business Suite (component: UK Payroll).	100d ago
CVE-2026-62560	7.7	—	—	—	oracle / human resources management system	Vulnerability in the Oracle HRMS (Norway) product of Oracle E-Business Suite (component: Internal Operations).	100d ago
CVE-2026-61324	7.7	—	—	—	oracle / advanced benefits	Vulnerability in the Oracle Advanced Benefits product of Oracle E-Business Suite (component: Internal Operations).	100d ago
CVE-2026-61142	7.7	—	—	—	oracle / payroll	Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations).	100d ago
CVE-2026-61125	7.7	—	—	—	oracle / e-business suite	Vulnerability in the Oracle Configure to Order product of Oracle E-Business Suite (component: Supply to Order Work	100d ago
CVE-2026-61014	7.7	—	—	—	oracle / inventory management	Vulnerability in the Oracle Inventory Management product of Oracle E-Business Suite (component: Internal Operation	100d ago
CVE-2026-60923	7.7	—	—	—	oracle / capacity	Vulnerability in the Oracle Capacity product of Oracle E-Business Suite (component: Internal Operations).	100d ago
CVE-2026-60824	7.7	—	—	—	oracle / isupport	Vulnerability in the Oracle iSupport product of Oracle E-Business Suite (component: Internal Operations).	100d ago
CVE-2026-60750	7.7	—	—	—	oracle / payroll	Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations).	100d ago
CVE-2026-60690	7.7	—	—	—	oracle / siebel crm	Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager).	100d ago
CVE-2026-60683	7.7	—	—	—	oracle / e-business suite	Vulnerability in the Oracle Process Manufacturing Regulatory Management product of Oracle E-Business Suite (compon	100d ago
CVE-2026-60657	7.7	—	—	—	oracle / webcenter content	Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).	100d ago
CVE-2026-60586	7.7	—	—	—	oracle / mysql connector\/j	Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J).	100d ago
CVE-2026-60548	7.7	—	—	—	oracle / soa suite	Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Integration Business Insight	100d ago
CVE-2026-60534	7.7	—	—	—	oracle / identity manager connector	Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: PeopleSoft	100d ago
CVE-2026-60440	7.7	—	—	—	oracle / service delivery platform	Vulnerability in the Service Delivery Platform product of Oracle Fusion Middleware (component: Messaging Enabler).	100d ago
CVE-2026-46987	7.7	—	—	—	oracle / enterprise manager base platform	Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Appl	100d ago
CVE-2026-63769	7.7	—	—	—	—	Huginn through 2022.08.18 contains a server-side request forgery vulnerability in the fetch_url method of Scenario	101d ago
CVE-2026-63731	7.7	—	—	—	—	HyperDX before 2.31.0 contains a server-side request forgery vulnerability that allows authenticated team members	101d ago
CVE-2026-63107	7.7	—	—	—	—	LimeSurvey through 6.17.10 and 7.0.4 contains a server-side request forgery vulnerability in the REST API survey t	101d ago
CVE-2026-46555	7.7	—	—	—	verygoodplugins / whatsapp mcp server	WhatsApp MCP Server is a Model Context Protocol (MCP) server for WhatsApp, enabling Claude to read and send WhatsA	101d ago
CVE-2026-54910	7.7	—	—	—	—	FileBrowser Quantum is a free, self-hosted, web-based file manager.	101d ago

Sources: NIST National Vulnerability Database (descriptions, CVSS, CPE); CISA KEV, ENISA EUVD, CIRCL and VulnCheck (exploitation status, three catalogues counted; CIRCL shown as an aggregator); FIRST EPSS (exploitation probability). Patch window is the gap between CVE publication and the earliest KEV listing, so a negative value means a catalogue called it exploited before it was disclosed. Data refreshes every five hours.

Loading

CVE Tracker