CVE Tracker: vulnerabilities by vendor, severity and exploitation status

CVE Tracker

21,446 records

Every published CVE from the last 120 days with CVSS score, vendor and product, cross-referenced against CISA's Known Exploited Vulnerabilities catalog. 5 added to KEV in the last 7 days.

SeverityAll critical high medium lowExploitedIn CISA KEV

CVE	CVSS	EPSS	KEV sources	Patch window	Vendor / product	Summary	Published
CVE-2018-25416	8.2	—	—	—	—	AiOPMSD Final 1.0.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbit	135d ago
CVE-2018-25415	8.2	—	—	—	—	AiOPMSD Final 1.0.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbit	135d ago
CVE-2018-25414	8.2	—	—	—	—	AiOPMSD Final 1.0.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbit	135d ago
CVE-2018-25413	8.2	—	—	—	—	AiOPMSD Final 1.0.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbit	135d ago
CVE-2018-25411	8.2	—	—	—	—	MGB OpenSource Guestbook 0.7.0.2 contains an SQL injection vulnerability that allows unauthenticated attackers to	135d ago
CVE-2018-25407	8.2	—	—	—	—	eNdonesia Portal 8.7 contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to execu	135d ago
CVE-2018-25406	8.2	—	—	—	—	eNdonesia Portal 8.7 contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to execu	135d ago
CVE-2018-25405	8.2	—	—	—	—	eNdonesia Portal 8.7 contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to execu	135d ago
CVE-2026-45627	8.2	—	—	—	—	Arcane is an interface for managing Docker containers, images, networks, and volumes.	136d ago
CVE-2018-25404	8.2	—	—	—	—	The Open ISES Project 3.30A contains an SQL injection vulnerability that allows unauthenticated attackers to execu	136d ago
CVE-2018-25403	8.2	—	—	—	—	The Open ISES Project 3.30A contains an SQL injection vulnerability that allows unauthenticated attackers to execu	136d ago
CVE-2018-25402	8.2	—	—	—	—	The Open ISES Project 3.30A contains an SQL injection vulnerability that allows unauthenticated attackers to execu	136d ago
CVE-2018-25401	8.2	—	—	—	—	The Open ISES Project 3.30A contains an SQL injection vulnerability that allows unauthenticated attackers to execu	136d ago
CVE-2018-25400	8.2	—	—	—	—	The Open ISES Project 3.30A contains an SQL injection vulnerability that allows unauthenticated attackers to execu	136d ago
CVE-2018-25399	8.2	—	—	—	—	The Open ISES Project 3.30A contains an SQL injection vulnerability that allows unauthenticated attackers to execu	136d ago
CVE-2018-25398	8.2	—	—	—	—	The Open ISES Project 3.30A contains an SQL injection vulnerability that allows unauthenticated attackers to execu	136d ago
CVE-2018-25395	8.2	—	—	—	—	Kados R10 GreenBee contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitr	136d ago
CVE-2018-25394	8.2	—	—	—	—	Kados R10 GreenBee contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitr	136d ago
CVE-2018-25390	8.2	—	—	—	—	HaPe PKH 1.1 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database	136d ago
CVE-2018-25389	8.2	—	—	—	—	HaPe PKH 1.1 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database	136d ago
CVE-2018-25386	8.2	—	—	—	—	HaPe PKH 1.1 contains multiple SQL injection vulnerabilities in admin/media.php that allow attackers to manipulate	136d ago
CVE-2018-25385	8.2	—	—	—	—	E-Registrasi Pencak Silat 18.10 contains an SQL injection vulnerability that allows unauthenticated attackers to e	136d ago
CVE-2018-25382	8.2	—	—	—	—	Zechat 1.5 contains an SQL injection vulnerability that allows unauthenticated attackers to extract database infor	136d ago
CVE-2026-46510	8.2	—	—	—	—	form-data-objectizer converts FormData to object.	136d ago
CVE-2026-45615	8.2	—	—	—	—	mouse07410/asn1c is an ASN.1 compiler.	136d ago
CVE-2026-46509	8.2	—	—	—	—	deepobj provides get, set, delete deep objects in javascript.	137d ago
CVE-2026-44358	8.2	—	—	—	—	Espressif Shared GitHub DangerJS is a reusable GitHub Action CI DangerJS workflow for Espressif GitHub projects.	137d ago
CVE-2026-35676	8.2	—	—	—	—	phpMyFAQ before 4.1.3 contains an unauthenticated password reset vulnerability in the user password update API end	137d ago
CVE-2026-35675	8.2	—	—	—	—	phpMyFAQ before 4.1.3 contains an authentication bypass vulnerability in the password reset endpoint that allows u	137d ago
CVE-2026-45137	8.2	—	—	—	anchor-lang / anchor	Anchor is a framework providing several convenient developer tools for writing Solana programs.	138d ago
CVE-2026-44712	8.2	—	—	—	—	pam_usb provides hardware authentication for Linux using ordinary removable media.	138d ago
CVE-2026-4868	8.2	—	—	—	gitlab / gitlab	GitLab has remediated an issue in GitLab EE affecting all versions from 18.8 before 18.10.7, 18.11 before 18.11.4,	138d ago
CVE-2026-45089	8.2	—	—	—	—	Dalfox is a powerful open-source XSS scanner and utility focused on automation.	138d ago
CVE-2026-44483	8.2	—	—	—	—	RVF (formerly Remix Validated Form) provides easy form validation and state management for React.	138d ago
CVE-2026-44328	8.2	—	—	—	free5gc / free5gc	free5GC is an open-source implementation of the 5G core network.	138d ago
CVE-2026-42083	8.2	—	—	—	free5gc / free5gc	free5GC is an open-source implementation of the 5G core network.	138d ago
CVE-2026-44971	8.2	—	—	—	—	GuardDog is a CLI tool to identify malicious PyPI packages.	138d ago
CVE-2026-46037	8.2	—	—	—	linux / linux kernel	In the Linux kernel, the following vulnerability has been resolved: ipv4: icmp: validate reply type before using i	138d ago
CVE-2025-71311	8.2	—	—	—	linux / linux kernel	In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Initialize new folios before use KMS	138d ago
CVE-2026-45843	8.2	—	—	—	linux / linux kernel	In the Linux kernel, the following vulnerability has been resolved: slip: bound decode() reads against the compres	139d ago
CVE-2026-42735	8.2	—	—	—	—	Authentication Bypass Using an Alternate Path or Channel vulnerability in Iqonic Design KiviCare kivicare-clinic-m	139d ago
CVE-2026-9312	8.2	—	—	—	github / enterprise server	A server-side request forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed an unaut	139d ago
CVE-2026-5260	8.2	—	—	—	—	A flaw was found in libgnutls.	139d ago
CVE-2026-42013	8.2	—	—	—	—	A flaw was found in gnutls.	139d ago
CVE-2026-44843	8.2	—	—	—	langchain / langchain	LangChain is a framework for building agents and LLM-powered applications.	139d ago
CVE-2026-8890	8.2	—	—	—	—	code100x contains an authentication bypass vulnerability in the Mobile API that allows unauthenticated attackers to	139d ago
CVE-2026-44728	8.2	—	—	—	babel / babel	Babel is a compiler for writing next generation JavaScript.	139d ago
CVE-2026-48126	8.2	—	—	—	—	Algernon is a small self-contained pure-Go web server.	139d ago
CVE-2018-25379	8.2	—	—	—	—	Collectric CMU 1.0 contains a boolean-based blind SQL injection vulnerability in the lang parameter that allows un	140d ago
CVE-2018-25372	8.2	—	—	—	—	MedDream PACS Server Premium 6.7.1.1 contains an SQL injection vulnerability that allows unauthenticated attackers	140d ago
CVE-2018-25371	8.2	—	—	—	—	mooSocial Store Plugin 2.6 contains a blind SQL injection vulnerability that allows unauthenticated attackers to m	140d ago
CVE-2018-25364	8.2	—	—	—	—	Twitter-Clone 1 contains a SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary	140d ago
CVE-2018-25362	8.2	—	—	—	—	Twitter-Clone 1 contains a SQL injection vulnerability in follow.php that allows attackers to manipulate database	140d ago
CVE-2018-25351	8.2	—	—	—	—	Joomla! Component EkRishta 2.10 contains an error-based SQL injection vulnerability that allows unauthenticated at	142d ago
CVE-2018-25348	8.2	—	—	—	—	Joomla! Component Ek Rishta 2.10 contains an SQL injection vulnerability that allows unauthenticated attackers to	142d ago
CVE-2018-25342	8.2	—	—	—	—	Smartshop 1 contains a time-based blind SQL injection vulnerability that allows unauthenticated attackers to manip	142d ago
CVE-2018-25341	8.2	—	—	—	—	Smartshop 1 contains a SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL	142d ago
CVE-2018-25340	8.2	—	—	—	—	Smartshop 1 contains a SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL	142d ago
CVE-2026-9284	8.2	—	—	—	—	The WooCommerce PayPal Payments plugin for WordPress is vulnerable to unauthorized order manipulation and informati	143d ago
CVE-2026-5843	8.2	—	—	—	docker / docker desktop	The MLX inference backend in Docker Model Runner on macOS uses the MLX-LM library, which unconditionally imports an	143d ago

Sources: NIST National Vulnerability Database (descriptions, CVSS, CPE); CISA KEV, ENISA EUVD, CIRCL and VulnCheck (exploitation status, three catalogues counted; CIRCL shown as an aggregator); FIRST EPSS (exploitation probability). Patch window is the gap between CVE publication and the earliest KEV listing, so a negative value means a catalogue called it exploited before it was disclosed. Data refreshes every five hours.

Loading

CVE Tracker