CVE Tracker: vulnerabilities by vendor, severity and exploitation status

CVE Tracker

21,446 records

Every published CVE from the last 120 days with CVSS score, vendor and product, cross-referenced against CISA's Known Exploited Vulnerabilities catalog. 5 added to KEV in the last 7 days.

SeverityAll critical high medium lowExploitedIn CISA KEV

CVE	CVSS	EPSS	KEV sources	Patch window	Vendor / product	Summary	Published
CVE-2026-56104	8.2	—	—	—	—	Chainlit before 2.10.1 contains a session hijacking vulnerability that allows unauthenticated attackers to restore	112d ago
CVE-2019-25756	8.2	—	—	—	wdmtech / vaccount	Joomla! Component vAccount 2.0.2 contains an SQL injection vulnerability that allows unauthenticated attackers to	115d ago
CVE-2019-25755	8.2	—	—	—	wdmtech / vreview	Joomla Component vReview 1.9.11 contains an SQL injection vulnerability that allows unauthenticated attackers to e	115d ago
CVE-2019-25754	8.2	—	—	—	wdmtech / vrestaurant	Joomla Component vRestaurant 1.9.4 contains an SQL injection vulnerability that allows unauthenticated attackers t	115d ago
CVE-2019-25753	8.2	—	—	—	wdmtech / vmap	Joomla! Component VMap 1.9.6 contains an SQL injection vulnerability that allows unauthenticated attackers to exec	115d ago
CVE-2019-25752	8.2	—	—	—	cmsjunkie / j-businessdirectory	Joomla! Component J-BusinessDirectory 4.9.7 contains an SQL injection vulnerability that allows unauthenticated at	115d ago
CVE-2019-25751	8.2	—	—	—	cmsjunkie / classifiedsmanager	Joomla Component J-ClassifiedsManager 3.0.5 contains an SQL injection vulnerability that allows unauthenticated at	115d ago
CVE-2019-25750	8.2	—	—	—	cmsjunkie / multiplehotelreservation	Joomla Component J-MultipleHotelReservation 6.0.7 contains an SQL injection vulnerability that allows unauthentica	115d ago
CVE-2026-49260	8.2	—	—	—	—	PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page.	115d ago
CVE-2019-25748	8.2	—	—	—	cmsjunkie / jhotelreservation	Joomla JHotelReservation 6.0.7 contains an SQL injection vulnerability that allows unauthenticated attackers to ex	115d ago
CVE-2017-20282	8.2	—	—	—	soft-php / jcart for opencart	Joomla! Component jCart for OpenCart 2.0 contains an SQL injection vulnerability that allows unauthenticated attac	115d ago
CVE-2017-20281	8.2	—	—	—	joomlaboat / extra search	Joomla! Component Extra Search 2.2.8 contains an SQL injection vulnerability that allows unauthenticated attackers	115d ago
CVE-2017-20280	8.2	—	—	—	myportfolio / myportfolio	Joomla Component Myportfolio 3.0.2 contains an SQL injection vulnerability that allows unauthenticated attackers t	115d ago
CVE-2017-20279	8.2	—	—	—	extensions / joomla payage	Joomla Payage 2.05 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate dat	115d ago
CVE-2017-20278	8.2	—	—	—	joomboost / joomrecipe	Joomla Component JoomRecipe 1.0.3 contains an SQL injection vulnerability that allows unauthenticated attackers to	115d ago
CVE-2017-20277	8.2	—	—	—	joomboost / joomla joomrecipe	Joomla JoomRecipe 1.0.4 component contains a blind SQL injection vulnerability in the search_author parameter on t	115d ago
CVE-2017-20276	8.2	—	—	—	simbunch / simgenealogy	Joomla! Component SIMGenealogy 2.1.5 contains an SQL injection vulnerability that allows unauthenticated attackers	115d ago
CVE-2017-20275	8.2	—	—	—	henryschorradt / bridge	Joomla! Component PHP-Bridge 1.2.3 contains an SQL injection vulnerability that allows unauthenticated attackers t	115d ago
CVE-2017-20274	8.2	—	—	—	king-products / learning management system king	Joomla LMS King Professional 3.2.4.0 contains an SQL injection vulnerability that allows unauthenticated attackers	115d ago
CVE-2017-20273	8.2	—	—	—	joomalshowroom / event registration pro calendar	Joomla Event Registration Pro Calendar 4.1.3 contains an SQL injection vulnerability that allows unauthenticated a	115d ago
CVE-2017-20272	8.2	—	—	—	faboba / ultimate property listing	Joomla Ultimate Property Listing 1.0.2 contains an SQL injection vulnerability that allows unauthenticated attacke	115d ago
CVE-2017-20271	8.2	—	—	—	nordmograph / streetguessr game	Joomla StreetGuessr Game 1.1.8 contains an SQL injection vulnerability that allows unauthenticated attackers to ex	115d ago
CVE-2017-20270	8.2	—	—	—	raindropsinfotech / twitch tv	Joomla! Component Twitch Tv 1.1 contains an SQL injection vulnerability that allows unauthenticated attackers to e	115d ago
CVE-2017-20269	8.2	—	—	—	terrywcarter / kissgallery	Joomla! Component KissGallery 1.0.0 contains an SQL injection vulnerability that allows unauthenticated attackers	115d ago
CVE-2017-20268	8.2	—	—	—	zcontent / zap calendar lite	Joomla! Component Zap Calendar Lite 4.3.4 contains an SQL injection vulnerability that allows unauthenticated atta	115d ago
CVE-2017-20267	8.2	—	—	—	joomla / calendar planner	Joomla! Component Calendar Planner 1.0.1 contains an SQL injection vulnerability that allows unauthenticated attac	115d ago
CVE-2017-20266	8.2	—	—	—	joomshaper / standard pro movie database	Joomla SP Movie Database 1.3 contains an SQL injection vulnerability that allows unauthenticated attackers to exec	115d ago
CVE-2017-20263	8.2	—	—	—	focalpointx / focalpoint	Joomla! Component FocalPoint Pro/Free 1.2.3 contains an SQL injection vulnerability that allows unauthenticated at	115d ago
CVE-2017-20262	8.2	—	—	—	webkul / ajax quiz	Joomla! Component Ajax Quiz 1.8 contains an SQL injection vulnerability that allows unauthenticated attackers to e	115d ago
CVE-2017-20261	8.2	—	—	—	weborange / bargain product vm3	Joomla! Component Bargain Product VM3 1.0 contains an SQL injection vulnerability that allows unauthenticated atta	115d ago
CVE-2017-20260	8.2	—	—	—	weborange / price alert	Joomla! Component Price Alert 3.0.2 contains an SQL injection vulnerability that allows unauthenticated attackers	115d ago
CVE-2017-20259	8.2	—	—	—	joomlashack / osdownloads	Joomla OSDownloads 1.7.4 contains an SQL injection vulnerability that allows unauthenticated attackers to execute	115d ago
CVE-2017-20258	8.2	—	—	—	extro / responsive portfolio	Joomla! Component RPC Responsive Portfolio 1.6.1 contains an SQL injection vulnerability that allows unauthenticat	115d ago
CVE-2017-20257	8.2	—	—	—	joomplace / quiz deluxe	Joomla! Component Quiz Deluxe 3.7.4 contains an SQL injection vulnerability that allows unauthenticated attackers	115d ago
CVE-2017-20256	8.2	—	—	—	joomplace / survey force deluxe	Joomla Survey Force Deluxe 3.2.4 contains an SQL injection vulnerability that allows unauthenticated attackers to	115d ago
CVE-2017-20255	8.2	—	—	—	joombooking / jb visa	Joomla! Component JB Visa 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to exe	115d ago
CVE-2017-20254	8.2	—	—	—	gegabyte / user bench	Joomla! Component User Bench 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to	115d ago
CVE-2017-20253	8.2	—	—	—	gegabyte / my projects	Joomla! Component My Projects 2.0 contains an SQL injection vulnerability that allows unauthenticated attackers to	115d ago
CVE-2017-20252	8.2	—	—	—	nextgeneditor / nextgen editor	Joomla NextGen Editor 2.1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execu	115d ago
CVE-2026-48617	8.2	—	—	—	nodejs / node.js	A flaw in Node.js Permission Model enforcement allows Bypass via `process.report.writeReport()` Path Misvalidation	116d ago
CVE-2026-48764	8.2	—	—	—	—	TypeBot is a chatbot builder tool.	117d ago
CVE-2026-50194	8.2	—	—	—	—	Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native app	117d ago
CVE-2026-55202	8.2	—	—	—	—	Tinyproxy through 1.11.3, fixed in commit 09312a1, fails to properly validate the Host header during stathost dete	117d ago
CVE-2026-30802	8.2	—	—	—	rti / connext micro	Out-of-bounds Read vulnerability in RTI Connext Micro (Core Libraries) allows Overread Buffers.This issue affects	117d ago
CVE-2026-54184	8.2	—	—	—	—	Unauthenticated Insecure Direct Object References (IDOR) in Clean Login <= 1.15 versions.	117d ago
CVE-2026-49081	8.2	—	—	—	—	Unauthenticated Broken Access Control in User Registration Stripe <= 1.3.12 versions.	117d ago
CVE-2026-48788	8.2	—	—	—	—	Remark42 is a self-hosted comment engine for blogs, articles, or any other place where readers can add comments.	117d ago
CVE-2026-40726	8.2	—	—	—	—	Unauthenticated Broken Access Control in User Registration Stripe <= 1.3.14 versions.	117d ago
CVE-2026-46866	8.2	—	—	—	oracle / enterprise manager base platform	Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Agen	117d ago
CVE-2026-46865	8.2	—	—	—	oracle / enterprise manager base platform	Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Exte	117d ago
CVE-2026-46806	8.2	—	—	—	oracle / webcenter content	Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).	117d ago
CVE-2026-35288	8.2	—	—	—	oracle / peoplesoft enterprise pt peopletools	Vulnerability in the PeopleSoft Enterprise PT PeopleTools product of Oracle PeopleSoft (component: Deployment Pack	117d ago
CVE-2026-35274	8.2	—	—	—	oracle / peoplesoft enterprise pt peopletools	Vulnerability in the PeopleSoft Enterprise PT PeopleTools product of Oracle PeopleSoft (component: Deployment Pack	117d ago
CVE-2026-48780	8.2	—	—	—	—	Forem is open source software for building communities.	118d ago
CVE-2026-49065	8.2	—	—	—	—	Unauthenticated Broken Access Control in Hippoo Mobile App for WooCommerce <= 1.9.5 versions.	119d ago
CVE-2026-42664	8.2	—	—	—	—	Unauthenticated Broken Access Control in AI Product Search for WooCommerce – Motive Commerce Search <= 1.38.	119d ago
CVE-2016-20073	8.2	—	—	—	—	Answer My Question 1.3 plugin for WordPress contains an SQL injection vulnerability that allows unauthenticated at	119d ago
CVE-2016-20072	8.2	—	—	—	—	BBS e-Franchise 1.1.1 plugin for WordPress contains an SQL injection vulnerability that allows unauthenticated att	119d ago
CVE-2016-20071	8.2	—	—	—	—	The 404 Redirection Manager plugin version 1.0 for WordPress contains an unauthenticated SQL injection vulnerabili	119d ago
CVE-2016-20069	8.2	—	—	—	—	WordPress Booking Calendar Contact Form 1.0.23 contains an unauthenticated blind SQL injection vulnerability in th	119d ago

Sources: NIST National Vulnerability Database (descriptions, CVSS, CPE); CISA KEV, ENISA EUVD, CIRCL and VulnCheck (exploitation status, three catalogues counted; CIRCL shown as an aggregator); FIRST EPSS (exploitation probability). Patch window is the gap between CVE publication and the earliest KEV listing, so a negative value means a catalogue called it exploited before it was disclosed. Data refreshes every five hours.

Loading

CVE Tracker