CVE Tracker: vulnerabilities by vendor, severity and exploitation status

CVE Tracker

21,446 records

Every published CVE from the last 120 days with CVSS score, vendor and product, cross-referenced against CISA's Known Exploited Vulnerabilities catalog. 7 added to KEV in the last 7 days.

SeverityAll critical high medium lowExploitedIn CISA KEV

CVE	CVSS	EPSS	KEV sources	Patch window	Vendor / product	Summary	Published
CVE-2026-21575	8	—	—	—	atlassian / sourcetree	This High severity RCE (Remote Code Execution) vulnerability was introduced in version 3.4.11 of Sourcetree for Ma	85d ago
CVE-2026-55626	8	—	—	—	neutrinolabs / xrdp	xrdp is an open source RDP server.	86d ago
CVE-2025-71392	8	—	—	—	surrealdb / surrealdb	SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 fails to properly escape table and field names	88d ago
CVE-2026-45162	8	—	—	—	—	Pimcore is an Open Source Data & Experience Management Platform.	89d ago
CVE-2026-62215	8	—	—	—	openclaw / openclaw	OpenClaw versions before 2026.6.5 contain an authentication bypass vulnerability in HTTP Canvas responses that all	89d ago
CVE-2026-50683	8	—	—	—	microsoft / windows 10 1607	Heap-based buffer overflow in Windows DHCP Server allows an authorized attacker to elevate privileges over an adja	92d ago
CVE-2026-50502	8	—	—	—	microsoft / windows 10 1607	Insufficient granularity of access control in Windows Event Logging Service allows an authorized attacker to execu	92d ago
CVE-2026-50365	8	—	—	—	microsoft / windows 10 1607	Improper authentication in Windows RPC API allows an unauthorized attacker to elevate privileges over an adjacent	92d ago
CVE-2026-58647	8	—	—	—	microsoft / power bi report server	Improper neutralization of input during web page generation ('cross-site scripting') in Power BI allows an authori	92d ago
CVE-2026-49169	8	—	—	—	microsoft / windows server 2025	Use after free in DNS Server allows an authorized attacker to execute code over a network.	92d ago
CVE-2026-42975	8	—	—	—	microsoft / windows 10 1607	Heap-based buffer overflow in Windows Bluetooth Port Driver allows an unauthorized attacker to execute code over a	92d ago
CVE-2026-40400	8	—	—	—	microsoft / windows 10 1607	Relative path traversal in Windows PowerShell allows an authorized attacker to execute code over a network.	92d ago
CVE-2026-15293	8	—	—	—	—	The WP Business Intelligence Lite plugin for WordPress is vulnerable to authorization bypass in all versions up to	96d ago
CVE-2026-59224	8	—	—	—	openwebui / open webui	Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform.	97d ago
CVE-2026-11903	8	—	—	—	progress / moveit transfer	Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOV	98d ago
CVE-2026-14476	8	—	—	—	—	A path traversal flaw was found in SSSD's AD GPO provider.	99d ago
CVE-2026-34171	8	—	—	—	—	Coolify is an open-source and self-hostable tool for managing servers, applications, and databases.	99d ago
CVE-2025-53829	8	—	—	—	—	ownCloud is a file storage, synchronization, and sharing application.	100d ago
CVE-2026-11766	8	—	—	—	—	The Ultimate Member WordPress plugin before 2.12.0 does not properly sanitise and escape the value of custom texta	100d ago
CVE-2026-53357	8	—	—	—	linux / linux kernel	In the Linux kernel, the following vulnerability has been resolved: Bluetooth: fix UAF in l2cap_sock_cleanup_liste	104d ago
CVE-2026-49091	8	—	—	—	elastic / kibana	Improper Output Neutralization for Logs (CWE-117) in Kibana can lead to log injection via Log Injection-Tampering-	105d ago
CVE-2026-10538	8	—	—	—	—	Messaging consumer functionality allows deserialization of user-controlled data without sufficient restriction of	105d ago
CVE-2026-12240	8	—	—	—	—	The Export User Data plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path v	106d ago
CVE-2026-40711	8	—	—	—	—	Dell Dell Container Storage Modules, version(s) csi-powerstore v2.16.0, csi-unity v2.16.0, csi-powerflex v2.16.0,	110d ago
CVE-2026-54030	8	—	—	—	librechat / librechat	LibreChat is an enhanced ChatGPT clone that supports multiple AI providers.	111d ago
CVE-2026-53256	8	—	—	—	linux / linux kernel	In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: hold listener socket in rfc	111d ago
CVE-2026-10712	8	—	—	—	gitlab / gitlab	GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.10 before 18.11.6, 19.0 before 19.0.	111d ago
CVE-2026-23879	8	—	—	—	—	py7zr is a Python-based library and utility to support 7zip archive compression, decompression, encryption and dec	111d ago
CVE-2026-48719	8	—	—	—	—	Warp is an agentic development environment.	112d ago
CVE-2026-39598	8	—	—	—	—	Unrestricted Upload of File with Dangerous Type vulnerability in Kodezen LLC Academy LMS Pro allows Upload a Web S	119d ago
CVE-2025-48640	8	—	—	—	google / android	In multiple locations, there is a possible 3rd party passkey entry pairing approval due to a missing permission ch	119d ago
CVE-2026-46894	8	—	—	—	oracle / isupplier portal	Vulnerability in the Oracle iSupplier Portal product of Oracle E-Business Suite (component: Home Page).	119d ago
CVE-2026-46796	8	—	—	—	oracle / webcenter sites	Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites).	119d ago
CVE-2026-46787	8	—	—	—	oracle / webcenter content	Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).	119d ago
CVE-2025-68713	8	—	—	—	—	An issue was discovered in Rakuten Send Anywhere (File Transfer) for Android (com.estmob.android.sendanywhere) 23.	120d ago
CVE-2026-12222	8	—	—	—	—	A vulnerability was determined in Yealink SIP-T46U 108.86.0.118.	121d ago
CVE-2026-12221	8	—	—	—	—	A vulnerability was found in Yealink SIP-T46U 108.86.0.118.	121d ago
CVE-2026-12220	8	—	—	—	—	A vulnerability has been found in Yealink SIP-T46U 108.86.0.118.	121d ago
CVE-2026-12218	8	—	—	—	—	A vulnerability was detected in Yealink SIP-T46U 108.87.50.1.	121d ago
CVE-2026-53829	8	—	—	—	openclaw / openclaw	OpenClaw before 2026.5.18 contains an approval display truncation vulnerability allowing authenticated users to hi	123d ago
CVE-2026-48165	8	—	—	—	mariadb / mariadb	MariaDB server is a community developed fork of MySQL server.	124d ago
CVE-2026-48163	8	—	—	—	mariadb / mariadb	MariaDB server is a community developed fork of MySQL server.	124d ago
CVE-2026-44168	8	—	—	—	mariadb / mariadb	MariaDB server is a community developed fork of MySQL server.	124d ago
CVE-2026-48612	8	—	—	—	—	Improper state verification in the OAuth implementation could allow an attacker to manipulate the authentication f	124d ago
CVE-2026-34693	8	—	—	—	adobe / experience manager	Adobe Experience Manager Forms JEE versions LTS SP1, 6.5.24.0 and earlier are affected by a reflected Cross-Site S	127d ago
CVE-2026-9212	8	—	—	—	netgear / lbr1020 firmware	Insufficient authentication and input validation in the listed NETGEAR models allow users connected to the local ne	127d ago
CVE-2026-47298	8	—	—	—	microsoft / sharepoint server	Improper authorization in Microsoft Office SharePoint allows an authorized attacker to execute code over a network	127d ago
CVE-2026-45644	8	—	—	—	microsoft / live share canvas	Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Live Share Canva	127d ago
CVE-2026-0419	8	—	—	—	netgear / jr6150 firmware	Insufficient input validation in NETGEAR JR6150 (AC750 WiFi Router 802.11ac Dual Band Gigabit released in 2014) all	127d ago
CVE-2026-0411	8	—	—	—	netgear / rbe970 firmware	An information disclosure vulnerability in the NETGEAR Orbi satellites (RBR/RBE/RBS Series) could allow a user conn	127d ago
CVE-2026-46332	8	—	—	—	linux / linux kernel	In the Linux kernel, the following vulnerability has been resolved: greybus: gb-beagleplay: bound bootloader recei	127d ago
CVE-2026-41724	8	—	—	—	vmware / aria operations	VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor	128d ago
CVE-2026-41723	8	—	—	—	vmware / aria operations	VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor	128d ago
CVE-2026-41722	8	—	—	—	vmware / aria operations	VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor	128d ago
CVE-2026-11401	8	—	—	—	—	An untrusted search path issue in the GlobalDatabasePlugin in the AWS Advanced Go Wrapper for Amazon Aurora Postgr	130d ago
CVE-2026-11400	8	—	—	—	—	An untrusted search path issue in the GlobalDatabasePlugin in the AWS Advanced JDBC Wrapper for Amazon Aurora Post	130d ago
CVE-2026-45745	8	—	—	—	termix / termix	Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities.	131d ago
CVE-2026-11241	8	—	—	—	google / chrome	Insufficient validation of untrusted input in Cast in Google Chrome prior to 149.0.7827.53 allowed an attacker on	131d ago
CVE-2025-14773	8	—	—	—	abb / t-mac plus	Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in ABB T-MAC Pl	133d ago
CVE-2026-35482	8	—	—	—	alf / alf	alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups.	133d ago

Sources: NIST National Vulnerability Database (descriptions, CVSS, CPE); CISA KEV, ENISA EUVD, CIRCL and VulnCheck (exploitation status, three catalogues counted; CIRCL shown as an aggregator); FIRST EPSS (exploitation probability). Patch window is the gap between CVE publication and the earliest KEV listing, so a negative value means a catalogue called it exploited before it was disclosed. Data refreshes every five hours.

Loading

CVE Tracker