CVE Tracker: vulnerabilities by vendor, severity and exploitation status

CVE Tracker

21,446 records

Every published CVE from the last 120 days with CVSS score, vendor and product, cross-referenced against CISA's Known Exploited Vulnerabilities catalog. 5 added to KEV in the last 7 days.

SeverityAll critical high medium lowExploitedIn CISA KEV

CVE	CVSS	EPSS	KEV sources	Patch window	Vendor / product	Summary	Published
CVE-2026-48391	8.2	—	—	—	adobe / bridge	Bridge is affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the	76d ago
CVE-2026-48390	8.2	—	—	—	adobe / bridge	Bridge is affected by an Incorrect Authorization vulnerability that could result in privilege escalation.	76d ago
CVE-2026-47483	8.2	—	—	—	—	NVIDIA DCGM Exporter for all platforms contains a vulnerability in the /debug/pprof endpoints, where an attacker c	76d ago
CVE-2026-43910	8.2	—	—	—	appium / java-client	Appium Java Client is the Java language binding for writing Appium tests that conform to the W3C WebDriver protoco	76d ago
CVE-2026-64737	8.2	—	—	—	apple / macos	An authorization issue was addressed with improved state management.	77d ago
CVE-2026-43772	8.2	—	—	—	apple / macos	A path traversal issue was addressed with improved input validation.	77d ago
CVE-2026-64642	8.2	—	—	—	vercel / next.js	Next.js is a React framework for building full-stack web applications.	77d ago
CVE-2026-9830	8.2	—	—	—	—	The bookingpress-appointment-booking-pro WordPress plugin before 5.7.3 does not correctly invoke its REST permissio	77d ago
CVE-2026-64448	8.2	—	—	—	linux / linux kernel	In the Linux kernel, the following vulnerability has been resolved: smb: client: restrict implied bcc[0] exemption	79d ago
CVE-2026-64435	8.2	—	—	—	linux / linux kernel	In the Linux kernel, the following vulnerability has been resolved: audit: Fix data races of skb_queue_len() reade	79d ago
CVE-2026-64389	8.2	—	—	—	linux / linux kernel	In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate NTLMv2 response before updatin	79d ago
CVE-2026-64380	8.2	—	—	—	—	In the Linux kernel, the following vulnerability has been resolved: smb: client: harden POSIX SID length parsing p	79d ago
CVE-2026-64287	8.2	—	—	—	linux / linux kernel	In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Bound used_lrs when flushing the p	79d ago
CVE-2026-64286	8.2	—	—	—	linux / linux kernel	In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Clear __hyp_running_vcpu when flus	79d ago
CVE-2026-65604	8.2	—	—	—	—	Skipper contains an incomplete fix for CVE-2026-50197 in which oversized request bodies bypass Open Policy Agent (	81d ago
CVE-2026-16002	8.2	—	—	—	—	The affected product is vulnerable to an Out-of-bounds read, which may allow an attacker to crash the parsing proc	81d ago
CVE-2026-63765	8.2	—	—	—	—	Chatwoot before 4.16.0 contains an authentication bypass vulnerability in the direct uploads controller that allow	81d ago
CVE-2026-62456	8.2	—	—	—	oracle / human resources management system	Vulnerability in the Oracle HRMS (UK) product of Oracle E-Business Suite (component: Internal Operations).	83d ago
CVE-2026-61240	8.2	—	—	—	oracle / peoplesoft enterprise fin common objects	Vulnerability in the PeopleSoft Enterprise FIN Common Objects Argentina product of Oracle PeopleSoft (component: e	83d ago
CVE-2026-61205	8.2	—	—	—	oracle / peoplesoft enterprise scm purchasing	Vulnerability in the PeopleSoft Enterprise SCM Purchasing product of Oracle PeopleSoft (component: Purchasing).	83d ago
CVE-2026-61101	8.2	—	—	—	oracle / e-business suite	Vulnerability in the Oracle MES for Process Manufacturing product of Oracle E-Business Suite (component: Internal	83d ago
CVE-2026-61089	8.2	—	—	—	oracle / peoplesoft enterprise scm inventory	Vulnerability in the PeopleSoft Enterprise SCM Inventory product of Oracle PeopleSoft (component: Security).	83d ago
CVE-2026-60854	8.2	—	—	—	oracle / quality	Vulnerability in the Oracle Quality product of Oracle E-Business Suite (component: Internal Operations).	83d ago
CVE-2026-60810	8.2	—	—	—	oracle / e-business suite	Vulnerability in the Oracle Supply Chain Trading Connector product of Oracle E-Business Suite (component: Collabor	83d ago
CVE-2026-60674	8.2	—	—	—	oracle / business intelligence	Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Pl	83d ago
CVE-2026-60668	8.2	—	—	—	oracle / peoplesoft enterprise hcm human resources	Vulnerability in the PeopleSoft Enterprise HCM Human Resources product of Oracle PeopleSoft (component: French Pub	83d ago
CVE-2026-60665	8.2	—	—	—	oracle / peoplesoft enterprise hcm global payroll switzerland	Vulnerability in the PeopleSoft Enterprise HCM Global Payroll Switzerland product of Oracle PeopleSoft (component:	83d ago
CVE-2026-60615	8.2	—	—	—	oracle / peoplesoft enterprise campus software campus community	Vulnerability in the PeopleSoft Enterprise CS Campus Community product of Oracle PeopleSoft (component: Security).	83d ago
CVE-2026-60544	8.2	—	—	—	oracle / soa suite	Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: B2B Engine).	83d ago
CVE-2026-60525	8.2	—	—	—	oracle / webcenter content	Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).	83d ago
CVE-2026-60428	8.2	—	—	—	oracle / unified directory	Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD Core).	83d ago
CVE-2026-60421	8.2	—	—	—	oracle / unified directory	Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD Core).	83d ago
CVE-2026-60315	8.2	—	—	—	oracle / mysql server	Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: X Plugin).	83d ago
CVE-2026-60284	8.2	—	—	—	oracle / coherence	Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core).	83d ago
CVE-2026-60255	8.2	—	—	—	oracle / coherence	Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core).	83d ago
CVE-2026-47046	8.2	—	—	—	oracle / database server	Vulnerability in the RDBMS component of Oracle Database Server.	83d ago
CVE-2026-46993	8.2	—	—	—	oracle / enterprise manager base platform	Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Agen	83d ago
CVE-2026-65056	8.2	—	—	—	—	mcp-webresearch 0.1.7 contains a server-side request forgery vulnerability that allows attackers to access interna	83d ago
CVE-2026-47688	8.2	—	—	—	fogproject / fogproject	FOG is a free open-source cloning/imaging/rescue suite/inventory management system.	83d ago
CVE-2026-47255	8.2	—	—	—	—	AgenticMail gives AI agents real email addresses and phone numbers.	84d ago
CVE-2026-41521	8.2	—	—	—	neutrinolabs / xrdp	xrdp is an open source RDP server.	84d ago
CVE-2026-46415	8.2	—	—	—	—	The Caddy Defender plugin is a middleware for Caddy that allows users to block or manipulate requests based on the	84d ago
CVE-2026-13577	8.2	—	—	—	—	Dancer2 versions through 2.1.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable	84d ago
CVE-2026-63913	8.2	—	—	—	—	In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: tcp: do not force CLOSE	85d ago
CVE-2026-63867	8.2	—	—	—	—	In the Linux kernel, the following vulnerability has been resolved: mptcp: close TOCTOU race while computing rcv_w	85d ago
CVE-2026-10130	8.2	—	—	—	—	QueryWeaver contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid	86d ago
CVE-2026-13410	8.2	—	—	—	—	Dancer::Plugin::Auth::Google versions before 0.08 for Perl have TLS verification disabled.	87d ago
CVE-2026-49998	8.2	—	—	—	—	Centrifugo is an open-source scalable real-time messaging server.	88d ago
CVE-2026-45325	8.2	—	—	—	—	Gestor de Oferta is a web application for managing mobility service offerings.	88d ago
CVE-2026-35149	8.2	—	—	—	hcltech / dfx server	HCL DFXServer is affected by an Authentication Bypass vulnerability via server response manipulation.	88d ago
CVE-2026-35147	8.2	—	—	—	hcltech / dfx server	HCL DFXServer is affected by a Broken Authentication vulnerability via direct API access.	88d ago
CVE-2026-46485	8.2	—	—	—	—	Dashy is a self-hostable personal dashboard.	89d ago
CVE-2026-58658	8.2	—	—	—	—	GPUStack through 2.2.1, fixed in commit 4e20551, contains an unauthenticated information disclosure vulnerability	89d ago
CVE-2026-12382	8.2	—	—	—	—	A flaw was found in the AAP Gateway Envoy proxy configuration.	89d ago
CVE-2026-60005	8.2	—	—	—	f5 / nginx gateway fabric	NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_slice_module module.	89d ago
CVE-2026-61435	8.2	—	—	—	—	PraisonAI before 4.6.78 contains an authentication bypass in the Call API agent invocation endpoints (src/praisona	89d ago
CVE-2026-49981	8.2	—	—	—	symfony / twig	Twig is a template language for PHP.	90d ago
CVE-2026-48290	8.2	—	—	—	adobe / c2pa	CAI Content Credentials is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in arb	90d ago
CVE-2026-50528	8.2	—	—	—	microsoft / .net	Incorrect authorization in .NET allows an unauthorized attacker to bypass a security feature over a network.	90d ago
CVE-2026-48345	8.2	—	—	—	adobe / animate	Animate is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection	90d ago

Sources: NIST National Vulnerability Database (descriptions, CVSS, CPE); CISA KEV, ENISA EUVD, CIRCL and VulnCheck (exploitation status, three catalogues counted; CIRCL shown as an aggregator); FIRST EPSS (exploitation probability). Patch window is the gap between CVE publication and the earliest KEV listing, so a negative value means a catalogue called it exploited before it was disclosed. Data refreshes every five hours.

Loading

CVE Tracker