CVE Tracker: vulnerabilities by vendor, severity and exploitation status

CVE Tracker

21,446 records

Every published CVE from the last 120 days with CVSS score, vendor and product, cross-referenced against CISA's Known Exploited Vulnerabilities catalog. 7 added to KEV in the last 7 days.

SeverityAll critical high medium lowExploitedIn CISA KEV

CVE	CVSS	EPSS	KEV sources	Patch window	Vendor / product	Summary	Published
CVE-2026-60222	8.1	—	—	—	oracle / coherence	Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core).	84d ago
CVE-2026-60201	8.1	—	—	—	oracle / weblogic server	Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).	84d ago
CVE-2026-60192	8.1	—	—	—	oracle / mysql connector\/net	Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Net).	84d ago
CVE-2026-60169	8.1	—	—	—	oracle / hospitality simphony	Vulnerability in the Oracle Hospitality Simphony product of Oracle Food and Beverage Applications (component: POS)	84d ago
CVE-2026-47028	8.1	—	—	—	oracle / e-business suite	Vulnerability in the Oracle Document Management and Collaboration product of Oracle E-Business Suite (component: A	84d ago
CVE-2026-47019	8.1	—	—	—	oracle / product hub	Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Item Catalog).	84d ago
CVE-2026-47014	8.1	—	—	—	oracle / product workbench	Vulnerability in the Oracle Product Workbench product of Oracle E-Business Suite (component: Security).	84d ago
CVE-2026-10678	8.1	—	—	—	zephyrproject / zephyr	The MCTP-over-I2C+GPIO target binding in Zephyr (subsys/pmci/mctp/mctp_i2c_gpio_target.c) processes pseudo-registe	84d ago
CVE-2026-8982	8.1	—	—	—	autel / maxicharger single charger firmware	Two undocumented privileged accounts exist in Autel Maxi Charger Single firmware through V1.03.51.	84d ago
CVE-2026-50758	8.1	—	—	—	—	Cross Site Scripting vulnerability in DayuanJiang next-ai-draw-io 0.4.13 allows a remote attacker to execute arbit	84d ago
CVE-2026-47418	8.1	—	—	—	—	PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system.	84d ago
CVE-2026-47417	8.1	—	—	—	—	PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system.	84d ago
CVE-2026-47412	8.1	—	—	—	—	PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system.	84d ago
CVE-2026-47409	8.1	—	—	—	—	PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system.	84d ago
CVE-2026-47406	8.1	—	—	—	—	PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system.	84d ago
CVE-2026-47398	8.1	—	—	—	—	PraisonAI is a multi-agent teams system.	84d ago
CVE-2026-47129	8.1	—	—	—	—	NextCRM is open-source customer relationship management (CRM) software.	85d ago
CVE-2026-13381	8.1	—	—	—	vsee / clinic	VSee Clinic 7.1.26 and API 1.3.0 contain an Insecure Direct Object Reference (IDOR) vulnerability in the /v1.3.0/a	85d ago
CVE-2026-32821	8.1	—	—	—	—	dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data.	85d ago
CVE-2026-62418	8.1	—	—	—	apache / syncope	Low-privileged authenticated Server-Side Request Forgery (SSRF) vulnerability in Apache Syncope via Connectors and	85d ago
CVE-2026-63756	8.1	—	—	—	surrealdb / surrealdb	SurrealDB versions before 3.1.0 contain a time-of-check/time-of-use race condition in the HTTP /rpc endpoint that	85d ago
CVE-2026-63735	8.1	—	—	—	surrealdb / surrealdb	SurrealDB versions before 3.2.0 fail to validate namespace and database scope in custom API routes, allowing authe	85d ago
CVE-2026-13142	8.1	—	—	—	—	The Social Login, Passkeys, Magic Link & Email OTP WordPress plugin before 1.4.1 does not enforce rate limiting or	86d ago
CVE-2026-64176	8.1	—	—	—	linux / linux kernel	In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix driver-set TX rates on	86d ago
CVE-2026-63925	8.1	—	—	—	—	In the Linux kernel, the following vulnerability has been resolved: macsec: fix replay protection at XPN lower-PN	86d ago
CVE-2026-63909	8.1	—	—	—	—	In the Linux kernel, the following vulnerability has been resolved: ksmbd: OOB read regression in smb_check_perm_d	86d ago
CVE-2026-63893	8.1	—	—	—	—	In the Linux kernel, the following vulnerability has been resolved: thunderbolt: property: Reject u32 wrap in tb_p	86d ago
CVE-2026-63889	8.1	—	—	—	—	In the Linux kernel, the following vulnerability has been resolved: scsi: scsi_transport_fc: Widen FPIN pname walk	86d ago
CVE-2026-53390	8.1	—	—	—	linux / linux kernel	In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix out-of-bounds read in smb_check_per	86d ago
CVE-2026-9323	8.1	—	—	—	—	The urwid web display backend (urwid/display/web.py) generates web session identifiers (urwid_id) in Screen.start()	87d ago
CVE-2026-13445	8.1	—	—	—	langflow / langflow	IBM Langflow OSS 1.0.0 through 1.10.1 can allow an authenticated attacker to exploit the SaveToFile component to r	88d ago
CVE-2026-45260	8.1	—	—	—	—	Pimcore is an Open Source Data & Experience Management Platform.	88d ago
CVE-2026-13473	8.1	—	—	—	ibm / storage protect	IBM Storage Protect Client 8.1.0.0 through 8.1.27.0, 8.1.27.1, and 8.2.0.0 through 8.2.1.0 IBM Storage Protect is	88d ago
CVE-2026-13448	8.1	—	—	—	langflow / langflow	IBM Langflow OSS 1.0.0 through 1.10.1 Lanflow OSS contains an unauthenticated remote code execution vulnerability	88d ago
CVE-2026-63094	8.1	—	—	—	—	SigNoz before 0.134.0 contains an open redirect vulnerability in the SSO authentication flow that allows unauthent	88d ago
CVE-2025-60357	8.1	—	—	—	ahnlab / epp management	AhnLab EPP Management v1.0.14.32-6249 was discovered to contain a NoSQL injection vulnerability via the eventlog/a	88d ago
CVE-2026-11961	8.1	—	—	—	—	The User Registration & Membership WordPress plugin before 5.2.3 does not validate that the membership tier submit	89d ago
CVE-2026-62234	8.1	—	—	—	—	Grav before 2.0.4 fails to restrict cURL protocols in webhook dispatch, allowing authenticated users with api.webh	89d ago
CVE-2026-62231	8.1	—	—	—	—	The Grav API plugin (getgrav/grav-plugin-api) before 1.0.6 contains an authorization bypass: API keys can be creat	89d ago
CVE-2026-62209	8.1	—	—	—	openclaw / openclaw	OpenClaw versions 2026.5.10-beta.1 before 2026.6.5 contain an authorization bypass in the ClickClack agent-mode di	89d ago
CVE-2026-43978	8.1	—	—	—	—	wger is a free, open-source workout and fitness manager.	89d ago
CVE-2026-55173	8.1	—	—	—	—	WWBN AVideo is an open source video platform.	89d ago
CVE-2026-44019	8.1	—	—	—	—	Docling Core defines core data types and transformations for the document processing application Docling.	89d ago
CVE-2026-46353	8.1	—	—	—	—	BigBlueButton is an open-source virtual classroom.	89d ago
CVE-2026-46351	8.1	—	—	—	—	BigBlueButton is an open-source virtual classroom.	89d ago
CVE-2021-27137zero day	8.1	4.0%	3/3	43d before	dd-wrt / dd-wrt	An issue was discovered in router/upnp/src/ssdp.c in DD-WRT before 45724.	89d ago
CVE-2026-63305	8.1	—	—	—	—	AVideo through 29.0 contains an OS command injection vulnerability in the ffmpeg.json.php endpoint where notifyCod	89d ago
CVE-2026-63304	8.1	—	—	—	—	AVideo through 29.0 contains an OS command injection vulnerability in plugin/API/standAlone/functions.php where th	89d ago
CVE-2026-15008	8.1	—	—	—	—	The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin plugin for WordPress is v	90d ago
CVE-2026-12585	8.1	—	—	—	—	The Abandoned Cart Lite for WooCommerce WordPress plugin before 6.8.2 does not protect the integrity of its cart-r	90d ago
CVE-2026-1609	8.1	—	—	—	redhat / build of keycloak	A flaw was found in Keycloak.	90d ago
CVE-2026-59950	8.1	—	—	—	lfprojects / mcp python sdk	The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP).	90d ago
CVE-2026-58660	8.1	—	—	—	—	Kanboard through 1.2.52, fixed in commit 564cc30, BoardAjaxController save() method (used by the kanban board drag	90d ago
CVE-2026-53518	8.1	—	—	—	better-auth / better-auth\/oauth-provider	Better Auth is an authentication and authorization library for TypeScript.	90d ago
CVE-2026-53517	8.1	—	—	—	better-auth / better-auth\/oauth-provider	Better Auth is an authentication and authorization library for TypeScript.	90d ago
CVE-2026-20156	8.1	—	—	—	cisco / roomos	As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco RoomOS engineering team	90d ago
CVE-2026-62685	8.1	—	—	—	—	File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within	90d ago
CVE-2026-42533	8.1	—	—	—	f5 / nginx gateway fabric	A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string e	90d ago
CVE-2026-61873	8.1	—	—	—	—	Grav before 9.1.8 contains an arbitrary file write vulnerability in the Form plugin's process.save.filename parame	90d ago
CVE-2026-61443	8.1	—	—	—	—	PraisonAI before 1.6.78 contains a remote code execution vulnerability in SkillTools.run_skill_script() that execu	90d ago

Sources: NIST National Vulnerability Database (descriptions, CVSS, CPE); CISA KEV, ENISA EUVD, CIRCL and VulnCheck (exploitation status, three catalogues counted; CIRCL shown as an aggregator); FIRST EPSS (exploitation probability). Patch window is the gap between CVE publication and the earliest KEV listing, so a negative value means a catalogue called it exploited before it was disclosed. Data refreshes every five hours.

Loading

CVE Tracker