CVE Tracker: vulnerabilities by vendor, severity and exploitation status

CVE Tracker

21,446 records

Every published CVE from the last 120 days with CVSS score, vendor and product, cross-referenced against CISA's Known Exploited Vulnerabilities catalog. 7 added to KEV in the last 7 days.

SeverityAll critical high medium lowExploitedIn CISA KEV

CVE	CVSS	EPSS	KEV sources	Patch window	Vendor / product	Summary	Published
CVE-2026-78414	8	—	—	—	—	Cross-site scripting in the Web Administration interface of Network Optix Nx Witness VMS before version 6.1.3 on L	51d ago
CVE-2026-31880	8	—	—	—	—	Combodo iTop is a web based IT service management tool.	53d ago
CVE-2026-31803	8	—	—	—	—	Combodo iTop is a web based IT service management tool.	53d ago
CVE-2026-30890	8	—	—	—	—	Combodo iTop is a web based IT service management tool.	53d ago
CVE-2026-30826	8	—	—	—	—	Combodo iTop is a web based IT service management tool.	53d ago
CVE-2026-18282	8	—	—	—	—	Sony XAV-9500ES AVRCP_Br_Response_Parser Heap-based Buffer Overflow Remote Code Execution Vulnerability.	55d ago
CVE-2026-18281	8	—	—	—	—	Sony XAV-9500ES l2_reassemble_sdu Heap-based Buffer Overflow Remote Code Execution Vulnerability.	55d ago
CVE-2026-14951	8	—	—	—	—	An low privileged remote attacker can cause authenticated users to perform unintended actions in the FDS Web inter	55d ago
CVE-2026-76139	8	—	—	—	—	A flaw was found in acm-operator-bundle.	55d ago
CVE-2026-71122	8	—	—	—	oracle / business intelligence	Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Platf	56d ago
CVE-2026-70802	8	—	—	—	oracle / public sector human resources	Vulnerability in the Oracle Public Sector Human Resources product of Oracle E-Business Suite (component: Regressio	56d ago
CVE-2026-70690	8	—	—	—	oracle / human resources management system	Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: US Payroll - General).	56d ago
CVE-2026-62602	8	—	—	—	oracle / hyperion calculation manager	Vulnerability in the Oracle Hyperion Calculation Manager product of Oracle Hyperion (component: Security).	56d ago
CVE-2026-60998	8	—	—	—	oracle / identity manager connector	Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Microsoft A	56d ago
CVE-2026-60961	8	—	—	—	oracle / webcenter content	Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).	56d ago
CVE-2026-45790	8	—	—	—	—	Dokploy is a free, self-hostable Platform as a Service (PaaS).	57d ago
CVE-2026-16138	8	—	—	—	progress / sharefile storage zones controller	In Progress ShareFile Storage Zones Controller v5.12.5 and below versions, unsafe deserialization of untrusted fil	58d ago
CVE-2026-74539	8	—	—	—	—	In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: lock sk in iso_sock_getname Ac	60d ago
CVE-2026-74528	8	—	—	—	—	In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: hold conn in hci_past_syn	60d ago
CVE-2026-70454	8	—	—	—	—	rsync 3.2.0 through 3.2.3 (openssl mode) and rsync-ssl through 3.4.4 (stunnel mode) contain a TLS certificate vali	62d ago
CVE-2026-72809	8	—	—	—	—	SiYuan versions <= v3.7.2 (patched in v3.7.4) contain an authentication bypass vulnerability in the kernel's Check	62d ago
CVE-2026-72807	8	—	—	—	—	SiYuan versions before v3.7.4 contain a second-order SQL injection vulnerability in attribute-view template column	62d ago
CVE-2026-65937	8	—	—	—	progress / whatsup gold	In WhatsUp Gold versions released before 2026.0.2, an authenticated attacker can bypass frontend controls and inje	63d ago
CVE-2026-62911	8	—	—	—	microsoft / exchange server	Authentication bypass by capture-replay in Microsoft Exchange Server allows an authorized attacker to elevate priv	64d ago
CVE-2026-57105	8	—	—	—	microsoft / sharepoint server	Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoin	64d ago
CVE-2026-15581	8	—	—	—	—	A flaw was found in the TrustyAI Service (TAS) deployment.	64d ago
CVE-2026-68085	8	—	—	—	—	In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_uart: clear HCI_UART_SENDING wh	65d ago
CVE-2026-68772	8	—	—	—	—	ZenML 0.94.6 contains a remote code execution vulnerability in the CloudpickleMaterializer component that allows a	68d ago
CVE-2026-48080	8	—	—	—	—	OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform.	68d ago
CVE-2026-71312	8	—	—	—	—	rclone is a command-line program to sync files and directories to and from different cloud storage providers.	69d ago
CVE-2026-66297	8	—	—	—	livebook / livebook	Improper Neutralization of Special Elements used in an OS Command (OS Command Injection) vulnerability in livebook	69d ago
CVE-2026-71279	8	—	—	—	—	Zigbee2MQTT's ExternalJSExtension.getFilePath (lib/extension/externalJS.ts) joins a parameter received via an MQTT	70d ago
CVE-2026-16623	8	—	—	—	—	The Create Block WordPress plugin before 2.10.0 does not correctly escape user-supplied text before writing it int	71d ago
CVE-2026-18599	8	—	—	—	—	A flaw has been found in GL.iNet GL-MT3000 up to 4.4.5.	72d ago
CVE-2026-9044	8	—	—	—	tp-link / archer axe75 firmware	An OS command injection vulnerability exists in the VPN module of TP-Link AXE75 V1 routers.	74d ago
CVE-2026-47873	8	—	—	—	—	The Boot Dashboard Docker integration in Spring Tools publishes container control ports on all of the host's netwo	76d ago
CVE-2026-47858	8	—	—	—	—	Starting Spring Boot applications in the Spring Tools with the live information mode enabled makes the running app	76d ago
CVE-2026-12703	8	—	—	—	—	TeamViewer Full Client and Host for macOS before version 15.80 contain a business logic error that can allow an au	77d ago
CVE-2026-59690	8	—	—	—	progress / connection manager for objectscale	A Missing Authorization vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connec	79d ago
CVE-2026-59689	8	—	—	—	progress / connection manager for objectscale	An Incorrect Authorization vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Con	79d ago
CVE-2026-64406	8	—	—	—	linux / linux kernel	In the Linux kernel, the following vulnerability has been resolved: Bluetooth: fix UAF in bt_accept_dequeue() bt_a	81d ago
CVE-2026-12736	8	—	—	—	—	The Wpify Woo plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 5.4.16.	82d ago
CVE-2026-35425	8	—	—	—	microsoft / azure api management	Improper access control in Azure API Management (APIM) allows an authorized attacker to execute code over a networ	82d ago
CVE-2026-60371	8	—	—	—	oracle / platform security for java	Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized	83d ago
CVE-2026-63265	8	—	—	—	—	Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in various Regular Labs ext	83d ago
CVE-2026-61224	8	—	—	—	oracle / communications converged application server	Vulnerability in the Oracle Communications Converged Application Server product of Oracle Communications (componen	84d ago
CVE-2026-61067	8	—	—	—	oracle / access manager	Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine).	84d ago
CVE-2026-61009	8	—	—	—	oracle / e-business suite	Vulnerability in the Oracle Process Manufacturing Logistics product of Oracle E-Business Suite (component: Interna	84d ago
CVE-2026-60807	8	—	—	—	oracle / bills of material	Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite (component: Internal Operations).	84d ago
CVE-2026-60790	8	—	—	—	oracle / sales offline	Vulnerability in the Oracle Sales Offline product of Oracle E-Business Suite (component: Internal Operations).	84d ago
CVE-2026-60652	8	—	—	—	oracle / webcenter content	Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Web Content Manageme	84d ago
CVE-2026-60650	8	—	—	—	oracle / webcenter content	Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Web Content Manageme	84d ago
CVE-2026-60648	8	—	—	—	oracle / webcenter content	Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Web Content Manageme	84d ago
CVE-2026-60646	8	—	—	—	oracle / webcenter content	Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Web Content Manageme	84d ago
CVE-2026-60643	8	—	—	—	oracle / webcenter content	Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).	84d ago
CVE-2026-60579	8	—	—	—	oracle / enterprise command center framework	Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite (component: Cor	84d ago
CVE-2026-60533	8	—	—	—	oracle / identity manager connector	Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Generic Uni	84d ago
CVE-2026-60325	8	—	—	—	oracle / access manager	Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine).	84d ago
CVE-2026-46923	8	—	—	—	oracle / public sector financials	Vulnerability in the Oracle Public Sector Financials (International) product of Oracle E-Business Suite (component	84d ago
CVE-2026-47237	8	—	—	—	—	Kubeflow Community Distribution helps users to install Kubeflow Platform in popular Kubernetes clusters.	84d ago

Sources: NIST National Vulnerability Database (descriptions, CVSS, CPE); CISA KEV, ENISA EUVD, CIRCL and VulnCheck (exploitation status, three catalogues counted; CIRCL shown as an aggregator); FIRST EPSS (exploitation probability). Patch window is the gap between CVE publication and the earliest KEV listing, so a negative value means a catalogue called it exploited before it was disclosed. Data refreshes every five hours.

Loading

CVE Tracker