CVE Tracker: vulnerabilities by vendor, severity and exploitation status

CVE Tracker

21,446 records

Every published CVE from the last 120 days with CVSS score, vendor and product, cross-referenced against CISA's Known Exploited Vulnerabilities catalog. 7 added to KEV in the last 7 days.

SeverityAll critical high medium lowExploitedIn CISA KEV

CVE	CVSS	EPSS	KEV sources	Patch window	Vendor / product	Summary	Published
CVE-2026-33037	8.1	—	—	—	wwbn / avideo	WWBN AVideo is an open source video platform.	208d ago
CVE-2026-32942	8.1	—	—	—	pjsip / pjsip	PJSIP is a free and open source multimedia communication library written in C.	208d ago
CVE-2026-32939	8.1	—	—	—	dataease / dataease	DataEase is an open source data visualization analysis tool.	208d ago
CVE-2026-32808	8.1	—	—	—	pyload / pyload	pyLoad is a free and open-source download manager written in Python.	208d ago
CVE-2026-32759	8.1	—	—	—	filebrowser / filebrowser	File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within	208d ago
CVE-2026-29189	8.1	—	—	—	suitecrm / suitecrm	SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application.	208d ago
CVE-2026-29096	8.1	—	—	—	suitecrm / suitecrm	SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application.	208d ago
CVE-2026-32034	8.1	—	—	—	openclaw / openclaw	OpenClaw versions prior to 2026.2.21 contain an authentication bypass vulnerability in the Control UI when allowIn	208d ago
CVE-2026-33302	8.1	—	—	—	open-emr / openemr	OpenEMR is a free and open source electronic health records and medical practice management application.	208d ago
CVE-2026-33301	8.1	—	—	—	open-emr / openemr	OpenEMR is a free and open source electronic health records and medical practice management application.	208d ago
CVE-2026-2646	8.1	—	—	—	wolfssl / wolfssl	A heap-buffer-overflow vulnerability exists in wolfSSL's wolfSSL_d2i_SSL_SESSION() function.	209d ago
CVE-2026-25471	8.1	—	—	—	—	Authentication Bypass Using an Alternate Path or Channel vulnerability in Themepaste Admin Safety Guard admin-safe	209d ago
CVE-2026-27093	8.1	—	—	—	—	Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerabil	209d ago
CVE-2026-27096	8.1	—	—	—	—	Deserialization of Untrusted Data vulnerability in BuddhaThemes ColorFolio - Freelance Designer WordPress Theme al	209d ago
CVE-2026-32730	8.1	—	—	—	apostrophecms / apostrophecms	ApostropheCMS is an open-source content management framework.	209d ago
CVE-2026-4396	8.1	—	—	—	devolutions / hub reporting service	Improper certificate validation in Devolutions Hub Reporting Service 2025.3.1.1 and earlier allows a network attack	209d ago
CVE-2026-31971	8.1	—	—	—	htslib / htslib	HTSlib is a library for reading and writing bioinformatics file formats.	209d ago
CVE-2026-31970	8.1	—	—	—	htslib / htslib	HTSlib is a library for reading and writing bioinformatics file formats.	209d ago
CVE-2026-31969	8.1	—	—	—	htslib / htslib	HTSlib is a library for reading and writing bioinformatics file formats.	209d ago
CVE-2026-31968	8.1	—	—	—	htslib / htslib	HTSlib is a library for reading and writing bioinformatics file formats.	209d ago
CVE-2026-31963	8.1	—	—	—	htslib / htslib	HTSlib is a library for reading and writing bioinformatics file formats.	209d ago
CVE-2026-32634	8.1	—	—	—	nicolargo / glances	Glances is an open-source system cross-platform monitoring tool.	210d ago
CVE-2026-32610	8.1	—	—	—	nicolargo / glances	Glances is an open-source system cross-platform monitoring tool.	210d ago
CVE-2025-55046	8.1	—	—	—	murasoftware / mura cms	MuraCMS through 10.1.10 contains a CSRF vulnerability that allows attackers to permanently destroy all deleted con	210d ago
CVE-2026-31898	8.1	—	—	—	parall / jspdf	jsPDF is a library to generate PDFs in JavaScript.	210d ago
CVE-2026-2603	8.1	—	—	—	redhat / build of keycloak	A flaw was found in Keycloak.	210d ago
CVE-2026-32841	8.1	—	—	—	edimax / gs-5008pl firmware	Edimax GS-5008PL firmware versions 1.00.54 and prior contain an authentication bypass vulnerability that allows un	210d ago
CVE-2026-30707	8.1	—	—	—	—	An issue was discovered in SpeedExam Online Examination System (SaaS) after v.FEV2026.	210d ago
CVE-2026-24901	8.1	—	—	—	getoutline / outline	Outline is a service that allows for collaborative documentation.	211d ago
CVE-2026-30911	8.1	—	—	—	apache / airflow	Apache Airflow versions 3.1.0 through 3.1.7 missing authorization vulnerability in the Execution API's Human-in-th	211d ago
CVE-2026-3559	8.1	—	—	—	philips / hue bridge v2 firmware	Philips Hue Bridge HomeKit Accessory Protocol Static Nonce Authentication Bypass Vulnerability.	212d ago
CVE-2026-3558	8.1	—	—	—	philips / hue bridge v2 firmware	Philips Hue Bridge HomeKit Accessory Protocol Transient Pairing Mode Authentication Bypass Vulnerability.	212d ago
CVE-2026-32729	8.1	—	—	—	runtipi / runtipi	Runtipi is a personal homeserver orchestrator.	212d ago
CVE-2026-20990	8.1	—	—	—	samsung / android	Improper export of android application components in Secure Folder prior to SMR Mar-2026 Release 1 allows local at	212d ago
CVE-2026-32302	8.1	—	—	—	openclaw / openclaw	OpenClaw is a personal AI assistant.	214d ago
CVE-2026-30914	8.1	—	—	—	sftpgo project / sftpgo	SFTPGo is an open source, event-driven file transfer solution.	214d ago
CVE-2026-22202	8.1	—	—	—	gvectors / wpdiscuz	wpDiscuz before 7.6.47 contains a cross-site request forgery vulnerability that allows attackers to delete all com	214d ago
CVE-2026-22193	8.1	—	—	—	gvectors / wpdiscuz	wpDiscuz before 7.6.47 contains an SQL injection vulnerability in the getAllSubscriptions() function where string	214d ago
CVE-2026-32260	8.1	—	—	—	deno / deno	Deno is a JavaScript, TypeScript, and WebAssembly runtime.	215d ago
CVE-2026-32247	8.1	—	—	—	getzep / graphiti	Graphiti is a framework for building and querying temporal context graphs for AI agents.	215d ago
CVE-2026-32116	8.1	—	—	—	magic-wormhole project / magic wormhole	Magic Wormhole makes it possible to get arbitrary-sized files and directories from one computer to another.	216d ago
CVE-2026-25529	8.1	—	—	—	postalserver / postal	Postal is an open source SMTP server.	216d ago
CVE-2026-31892	8.1	—	—	—	argoproj / argo workflows	Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes.	217d ago
CVE-2026-86185	8	—	—	—	—	Bilibili Desktop through 1.18.0 disables TLS certificate verification process-wide and executes unsigned remote Ja	39d ago
CVE-2026-86140	8	—	—	—	—	In libxml2 before 2.15.4, xmlSnprintfElements in valid.c has a strcat stack-based buffer overflow.	39d ago
CVE-2026-53932	8	—	—	—	—	laravel-backup-restore restores database backups made with spatie/laravel-backup.	39d ago
CVE-2026-85012	8	—	—	—	—	Improper neutralization of special elements used in an OS command (CWE-78) in the blueprint resynthesis framework	41d ago
CVE-2026-80747	8	—	—	—	—	In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Add bounds check for CRAT subtype	41d ago
CVE-2026-49832	8	—	—	—	—	DSpace open source software is a repository application which provides durable access to digital resources.	42d ago
CVE-2026-79755	8	—	—	—	—	Nuclio is a "Serverless" framework for Real-Time Events and Data Processing.	42d ago
CVE-2026-52833	8	—	—	—	—	Nuclio is a "Serverless" framework for Real-Time Events and Data Processing.	42d ago
CVE-2026-52831	8	—	—	—	—	Nuclio is a "Serverless" framework for Real-Time Events and Data Processing.	42d ago
CVE-2026-84665	8	—	—	—	—	Jenkins SonarQube Scanner Plugin 2.18.3 and earlier does not limit URL schemes for the dashboard links it creates	42d ago
CVE-2026-59680	8	—	—	—	—	An OS command injection vulnerability was found in yast2-users.	43d ago
CVE-2026-82282	8	—	—	—	—	Atlantis through 0.47.1 fails to authenticate the /github-app/setup endpoint, allowing unauthenticated attackers t	46d ago
CVE-2026-77586	8	—	—	—	—	In MongoDB Connector for BI, MongoDB object names such as collection, field, and index names are placed into the q	46d ago
CVE-2026-75486	8	—	—	—	—	Synk Sweater Comb before 3.8.8 contains a command injection vulnerability that allows an attacker who controls the	46d ago
CVE-2026-59307	8	—	—	—	vmware / spring integration	An operator who calls JdbcMessageStore.addAllowedPatterns(...) to restrict deserialization receives no protection	47d ago
CVE-2026-24169	8	—	—	—	—	NVIDIA UFM Enterprise contains a vulnerability in the plugin management API, where an authenticated user with low	50d ago
CVE-2026-79662	8	—	—	—	—	Ech0 through 4.5.6 contains an OAuth redirect URI validation vulnerability in parseAndValidateClientRedirect (inte	50d ago

Sources: NIST National Vulnerability Database (descriptions, CVSS, CPE); CISA KEV, ENISA EUVD, CIRCL and VulnCheck (exploitation status, three catalogues counted; CIRCL shown as an aggregator); FIRST EPSS (exploitation probability). Patch window is the gap between CVE publication and the earliest KEV listing, so a negative value means a catalogue called it exploited before it was disclosed. Data refreshes every five hours.

Loading

CVE Tracker