CVE Tracker: vulnerabilities by vendor, severity and exploitation status

CVE Tracker

21,446 records

Every published CVE from the last 120 days with CVSS score, vendor and product, cross-referenced against CISA's Known Exploited Vulnerabilities catalog. 7 added to KEV in the last 7 days.

SeverityAll critical high medium lowExploitedIn CISA KEV

CVE	CVSS	EPSS	KEV sources	Patch window	Vendor / product	Summary	Published
CVE-2025-69167	8.1	—	—	—	—	Unauthenticated Local File Inclusion in Eros <= 1.3 versions.	118d ago
CVE-2025-69165	8.1	—	—	—	—	Unauthenticated Local File Inclusion in Choreo <= 1.6 versions.	118d ago
CVE-2025-69163	8.1	—	—	—	—	Unauthenticated Local File Inclusion in WineShop <= 3.17 versions.	118d ago
CVE-2025-69162	8.1	—	—	—	—	Unauthenticated Local File Inclusion in Grecko <= 5.17 versions.	118d ago
CVE-2025-69161	8.1	—	—	—	—	Unauthenticated Local File Inclusion in Snowy <= 1.13 versions.	118d ago
CVE-2025-69160	8.1	—	—	—	—	Unauthenticated Local File Inclusion in Gita <= 1.11 versions.	118d ago
CVE-2025-69159	8.1	—	—	—	—	Unauthenticated Local File Inclusion in Printo <= 1.11 versions.	118d ago
CVE-2025-69150	8.1	—	—	—	—	Unauthenticated Local File Inclusion in Medeus <= 1.14 versions.	118d ago
CVE-2025-69149	8.1	—	—	—	—	Unauthenticated Local File Inclusion in Top Dog <= 1.0.5 versions.	118d ago
CVE-2025-69148	8.1	—	—	—	—	Unauthenticated Local File Inclusion in Quirky <= 1.23 versions.	118d ago
CVE-2025-69147	8.1	—	—	—	—	Unauthenticated Local File Inclusion in Putter <= 1.17 versions.	118d ago
CVE-2025-69146	8.1	—	—	—	—	Unauthenticated Local File Inclusion in Dom <= 1.24 versions.	118d ago
CVE-2025-69145	8.1	—	—	—	—	Unauthenticated Local File Inclusion in Gat <= 1.16 versions.	118d ago
CVE-2025-69143	8.1	—	—	—	—	Unauthenticated Local File Inclusion in Mission <= 1.22 versions.	118d ago
CVE-2025-69142	8.1	—	—	—	—	Unauthenticated Local File Inclusion in Abelle <= 1.22 versions.	118d ago
CVE-2025-69141	8.1	—	—	—	—	Unauthenticated Local File Inclusion in Kelly Young <= 1.1.0 versions.	118d ago
CVE-2025-69136	8.1	—	—	—	—	Unauthenticated Local File Inclusion in Wanium <= 1.9.8 versions.	118d ago
CVE-2025-69125	8.1	—	—	—	—	Unauthenticated Local File Inclusion in Food Drop <= 1.3 versions.	118d ago
CVE-2025-69124	8.1	—	—	—	—	Unauthenticated Local File Inclusion in Especio <= 1.0 versions.	118d ago
CVE-2025-69121	8.1	—	—	—	—	Unauthenticated Local File Inclusion in Deliciosa <= 1.10.0 versions.	118d ago
CVE-2025-69119	8.1	—	—	—	—	Unauthenticated Local File Inclusion in Corbesier <= 1.15.0 versions.	118d ago
CVE-2025-69118	8.1	—	—	—	—	Unauthenticated Local File Inclusion in CopyPress <= 1.4.5 versions.	118d ago
CVE-2025-69117	8.1	—	—	—	—	Unauthenticated Local File Inclusion in Ingenioso <= 1.14.0 versions.	118d ago
CVE-2025-69116	8.1	—	—	—	—	Unauthenticated Local File Inclusion in Iona <= 1.0.8 versions.	118d ago
CVE-2025-69114	8.1	—	—	—	—	Unauthenticated Local File Inclusion in MaxiNet <= 1.2.10 versions.	118d ago
CVE-2025-69113	8.1	—	—	—	—	Unauthenticated Local File Inclusion in Nexio <= 1.10.0 versions.	118d ago
CVE-2025-69112	8.1	—	—	—	—	Unauthenticated Local File Inclusion in Planty <= 1.14.0 versions.	118d ago
CVE-2025-69110	8.1	—	—	—	—	Unauthenticated Local File Inclusion in AirSupply <= 2.0.0 versions.	118d ago
CVE-2025-69109	8.1	—	—	—	—	Unauthenticated Local File Inclusion in Raider Spirit <= 1.1.2 versions.	118d ago
CVE-2025-69107	8.1	—	—	—	—	Unauthenticated Local File Inclusion in Rosaleen <= 2.8 versions.	118d ago
CVE-2025-69105	8.1	—	—	—	—	Unauthenticated Local File Inclusion in Modernee <= 1.6.0 versions.	118d ago
CVE-2025-60085	8.1	—	—	—	—	Unauthenticated Local File Inclusion in Learnify <= 1.15.0 versions.	118d ago
CVE-2025-58954	8.1	—	—	—	—	Unauthenticated Local File Inclusion in HomeRoofer <= 2.11.0 versions.	118d ago
CVE-2025-58953	8.1	—	—	—	—	Unauthenticated Local File Inclusion in Joly <= 1.22.0 versions.	118d ago
CVE-2025-58952	8.1	—	—	—	—	Unauthenticated Local File Inclusion in Neuronet < 1.14.0 versions.	118d ago
CVE-2025-58924	8.1	—	—	—	—	Unauthenticated Local File Inclusion in Geya <= 1.15 versions.	118d ago
CVE-2026-46939	8.1	—	—	—	oracle / e-business suite	Vulnerability in the Oracle Configure to Order product of Oracle E-Business Suite (component: Supply to Order Work	119d ago
CVE-2026-46927	8.1	—	—	—	oracle / receivables	Vulnerability in the Oracle Receivables product of Oracle E-Business Suite (component: Internal Operations).	119d ago
CVE-2026-46920	8.1	—	—	—	oracle / siebel crm	Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager).	119d ago
CVE-2026-46898	8.1	—	—	—	oracle / enterprise command center framework	Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite (component: Cor	119d ago
CVE-2026-46891	8.1	—	—	—	oracle / jd edwards enterpriseone accounts payable	Vulnerability in the JD Edwards EnterpriseOne Accounts Payable product of Oracle JD Edwards (component: Accounts P	119d ago
CVE-2026-46851	8.1	—	—	—	oracle / peoplesoft enterprise campus software campus community	Vulnerability in the PeopleSoft Enterprise CS Campus Community product of Oracle PeopleSoft (component: Security).	119d ago
CVE-2026-46849	8.1	—	—	—	oracle / peoplesoft enterprise cs student financials	Vulnerability in the PeopleSoft Enterprise CS Student Financials product of Oracle PeopleSoft (component: Other).	119d ago
CVE-2026-35289	8.1	—	—	—	oracle / peoplesoft enterprise pt peopletools	Vulnerability in the PeopleSoft Enterprise PT PeopleTools product of Oracle PeopleSoft (component: Deployment Pack	119d ago
CVE-2026-35279	8.1	—	—	—	oracle / peoplesoft enterprise pt peopletools	Vulnerability in the PeopleSoft Enterprise PT PeopleTools product of Oracle PeopleSoft (component: Performance Mon	119d ago
CVE-2026-35276	8.1	—	—	—	oracle / peoplesoft enterprise pt peopletools	Vulnerability in the PeopleSoft Enterprise PT PeopleTools product of Oracle PeopleSoft (component: Application Ser	119d ago
CVE-2026-53866	8.1	—	—	—	openclaw / openclaw	OpenClaw before 2026.5.12 contains an allowlist bypass vulnerability in shell inline-command parsing that allows a	119d ago
CVE-2026-53864	8.1	—	—	—	openclaw / openclaw	OpenClaw before 2026.5.26 contains an insufficient sanitization vulnerability in the host environment sanitizer th	119d ago
CVE-2026-53857	8.1	—	—	—	openclaw / openclaw	OpenClaw before 2026.5.3 contains a policy enforcement vulnerability where Zalo contacts with mutable display meta	119d ago
CVE-2026-53855	8.1	—	—	—	openclaw / openclaw	OpenClaw before 2026.4.2 contains an inline-eval bypass vulnerability allowing authenticated operators to weaken s	119d ago
CVE-2026-53849	8.1	—	—	—	openclaw / openclaw	OpenClaw before 2026.5.7 contains a privilege escalation vulnerability where the allowFrom feature improperly vali	119d ago
CVE-2026-12328	8.1	—	—	—	mozilla / firefox	Memory safety bugs present in Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird ESR 140.11, Firefox 151 and Thun	119d ago
CVE-2026-12327	8.1	—	—	—	mozilla / firefox	Memory safety bugs present in Firefox ESR 140.11, Thunderbird ESR 140.11, Firefox 151 and Thunderbird 151.	119d ago
CVE-2026-12326	8.1	—	—	—	mozilla / firefox	Memory safety bugs present in Firefox 151 and Thunderbird 151.	119d ago
CVE-2026-12292	8.1	—	—	—	mozilla / firefox	Incorrect boundary conditions in the Web Audio component.	119d ago
CVE-2026-12290	8.1	—	—	—	mozilla / firefox	Memory safety bug fixed in Firefox 152.	119d ago
CVE-2026-8442	8.1	—	—	—	—	The WP Review Slider Pro plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to and includ	120d ago
CVE-2026-48970	8.1	—	—	—	—	Unauthenticated Broken Authentication in Really Simple SSL <= 9.5.10 versions.	120d ago
CVE-2026-42687	8.1	—	—	—	—	Unauthenticated PHP Object Injection in EventPrime <= 4.3.2.1 versions.	120d ago
CVE-2026-42411	8.1	—	—	—	—	Unauthenticated Broken Authentication in CloudSecure WP Security <= 1.4.7 versions.	120d ago

Sources: NIST National Vulnerability Database (descriptions, CVSS, CPE); CISA KEV, ENISA EUVD, CIRCL and VulnCheck (exploitation status, three catalogues counted; CIRCL shown as an aggregator); FIRST EPSS (exploitation probability). Patch window is the gap between CVE publication and the earliest KEV listing, so a negative value means a catalogue called it exploited before it was disclosed. Data refreshes every five hours.

Loading

CVE Tracker