CVE Tracker: vulnerabilities by vendor, severity and exploitation status

CVE Tracker

15,513 records

Every published CVE from the last 120 days with CVSS score, vendor and product, cross-referenced against CISA's Known Exploited Vulnerabilities catalog. 8 added to KEV in the last 7 days.

SeverityAll critical high medium lowExploitedIn CISA KEV

CVE	CVSS	EPSS	KEV sources	Patch window	Vendor / product	Summary	Published
CVE-2026-11576	7.5	—	—	—	eclipse / threadx netx duo	The security fix for CVE-2025-0728 in eclipse-threadx NetX Duo refactors error handling in the HTTP server PUT pro	131d ago
CVE-2026-47633	7.5	—	—	—	microsoft / cost management	Exposure of sensitive information to an unauthorized actor in Cost Management Interactive Experiences allows an un	132d ago
CVE-2026-48937	7.5	—	—	—	nodejs / node.js	A flaw in Node.js HTTP/2 server API can cause servers to keep accepting data even after sending a `GOAWAY` frame.	132d ago
CVE-2026-55204	7.5	—	—	—	haproxy / haproxy	HAProxy through 3.4.0, fixed in commit 9a6d1fe, contains a null pointer dereference vulnerability in hpack_dht_ins	132d ago
CVE-2026-55203	7.5	—	—	—	haproxy / haproxy	HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn struct	132d ago
CVE-2026-38718	7.5	—	—	—	inhandnetworks / ir915l-fq39-s firmware	InHand Networks IR912 V1.0.0.r20042 and IR915 V1.0.0.r20042 (including earlier versions) were discovered to contai	132d ago
CVE-2025-53114	7.5	—	—	—	—	CometD is a scalable comet implementation for web messaging.	132d ago
CVE-2026-45617	7.5	—	—	—	—	LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript.	133d ago
CVE-2026-45357	7.5	—	—	—	—	LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript.	133d ago
CVE-2026-8050	7.5	—	—	—	—	In SignalRGB versions prior to 1.3.7.0, seven of the thirteen IOCTL handlers dereference the SystemBuffer pointer w	133d ago
CVE-2026-50200	7.5	—	—	—	—	Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native app	133d ago
CVE-2026-50196	7.5	—	—	—	—	Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native app	133d ago
CVE-2026-48979	7.5	—	—	—	—	PHP Standard Library (PSL) is set of APIs covering async, collections, networking, I/O, cryptography, terminal UI,	133d ago
CVE-2026-10696	7.5	—	—	—	devolutions / unigetui	Use of an incorrectly resolved name or reference in the pinget backend in Devolutions UniGetUI 2026.2.0 and earlie	133d ago
CVE-2026-53869	7.5	—	—	—	—	Hermes Agent before 0.16.0 contains a DNS rebinding vulnerability in WebSocket endpoints that allows remote attack	133d ago
CVE-2026-48818	7.5	—	—	—	encode / starlette	Starlette is a lightweight ASGI framework/toolkit.	133d ago
CVE-2026-6734	7.5	—	—	—	nodejs / undici	Impact: When using Socks5ProxyAgent, undici reuses a single connection pool across different origins without verify	133d ago
CVE-2026-47774	7.5	—	—	—	envoyproxy / envoy	Envoy is an open source edge and service proxy designed for cloud-native applications.	133d ago
CVE-2026-9675	7.5	—	—	—	nodejs / undici	Impact: The undici WebSocket client enforces maxPayloadSize per-frame but does not enforce the cumulative size of f	133d ago
CVE-2026-53872	7.5	—	—	—	—	picklescan before 0.0.35 contains an unsafe pickle deserialization vulnerability allowing unauthenticated attacker	133d ago
CVE-2026-20190	7.5	—	—	—	cisco / identity services engine	A vulnerability in Cisco ISE and ISE-PIC could allow an unauthenticated, remote attacker to view sensitive informa	133d ago
CVE-2026-12151	7.5	—	—	—	nodejs / undici	Impact: The undici WebSocket client enforces maxPayloadSize on the cumulative byte count of fragments in a message	133d ago
CVE-2026-54810	7.5	—	—	—	—	Missing Authorization vulnerability in Nexi Payments Nexi XPay allows Exploiting Incorrectly Configured Access Con	133d ago
CVE-2026-22283	7.5	—	—	—	dell / powerflex manager	Dell PowerFlex Manager, version(s) prior to 5.1.0.1, contain(s) an Inclusion of Functionality from Untrusted Contr	133d ago
CVE-2026-54816	7.5	—	—	—	—	Improper Control of Generation of Code ('Code Injection') vulnerability in Monetizemore Advanced Ads allows Remote	133d ago
CVE-2026-54417	7.5	—	—	—	—	An integer overflow in the mtar_next function in src/microtar.c in rxi microtar 0.1.0 allows a remote attacker to	133d ago
CVE-2026-9690	7.5	—	—	—	—	Unauthenticated Arbitrary File Download in WP Media folder Addon <= 4.0.1 versions.	133d ago
CVE-2026-54802	7.5	—	—	—	—	Unauthenticated Broken Authentication in SMS Alert Order Notifications <= 3.9.3 versions.	133d ago
CVE-2026-52696	7.5	—	—	—	—	Unauthenticated Sensitive Data Exposure in JetBlog <= 2.4.8 versions.	133d ago
CVE-2026-49057	7.5	—	—	—	—	Unauthenticated Broken Access Control in JobSearch <= 3.2.7 versions.	133d ago
CVE-2026-48929	7.5	—	—	—	rocket.chat / rocket.chat	Rocket.Chat in versions <8.5.1, <8.4.4, <8.3.6, <8.2.6, <8.1.6, <8.0.7, <7.13.9, and <7.10.13 is vulnerable to una	133d ago
CVE-2026-48779	7.5	—	—	—	ws project / ws	ws is an open source WebSocket client and server for Node.js.	133d ago
CVE-2026-40721	7.5	—	—	—	—	Contributor Local File Inclusion in Element Pack Pro <= 9.0.6 versions.	133d ago
CVE-2026-34888	7.5	—	—	—	—	Unauthenticated Sensitive Data Exposure in Bricksforge <= 3.1.8.4 versions.	133d ago
CVE-2026-22334	7.5	—	—	—	—	Subscriber Arbitrary File Download in Woocommerce Book Price <= 1.3 versions.	133d ago
CVE-2026-12462	7.5	—	—	—	google / chrome	Use after free in Media in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who had compromised the	133d ago
CVE-2026-12455	7.5	—	—	—	google / chrome	Use after free in Tab Strip in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who convinced a use	133d ago
CVE-2026-12445	7.5	—	—	—	google / chrome	Use after free in Extensions in Google Chrome prior to 149.0.7827.155 allowed an attacker who convinced a user to	133d ago
CVE-2026-12360	7.5	—	—	—	—	The JetEngine plugin for WordPress is vulnerable to SQL injection in all versions up to and including 3.8.10.1.	133d ago
CVE-2026-12199	7.5	—	—	—	—	A vulnerability in `nltk.app.wordnet_app` up to version 3.9.3 allows unauthenticated remote shutdown of the local	133d ago
CVE-2025-69131	7.5	—	—	—	—	Unauthenticated Arbitrary File Download in WordPress & WooCommerce Scraper Plugin, Import Data from Any Site <= 1.	133d ago
CVE-2025-69103	7.5	—	—	—	—	Subscriber Arbitrary Content Deletion in Brikk <= 3.0.0 versions.	133d ago
CVE-2025-49403	7.5	—	—	—	—	Unauthenticated Arbitrary File Download in Premium Age Verification / Restriction for WordPress <= 3.0.2 versions.	133d ago
CVE-2024-32729	7.5	—	—	—	—	Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in QuantumCloud Conve	133d ago
CVE-2026-46974	7.5	—	—	—	oracle / vm virtualbox	Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).	133d ago
CVE-2026-46971	7.5	—	—	—	oracle / hr intelligence	Vulnerability in the Oracle HR Intelligence product of Oracle E-Business Suite (component: Internal Operations).	133d ago
CVE-2026-46966	7.5	—	—	—	oracle / universal work queue	Vulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite (component: Work Provider Site	133d ago
CVE-2026-46959	7.5	—	—	—	oracle / subledger accounting	Vulnerability in the Oracle Subledger Accounting product of Oracle E-Business Suite (component: Internal Operation	133d ago
CVE-2026-46958	7.5	—	—	—	oracle / subledger accounting	Vulnerability in the Oracle Subledger Accounting product of Oracle E-Business Suite (component: Internal Operation	133d ago
CVE-2026-46957	7.5	—	—	—	oracle / isupplier portal	Vulnerability in the Oracle iSupplier Portal product of Oracle E-Business Suite (component: Internal Operations).	133d ago
CVE-2026-46955	7.5	—	—	—	oracle / human resources	Vulnerability in the Oracle Human Resources product of Oracle E-Business Suite (component: Person).	133d ago
CVE-2026-46935	7.5	—	—	—	oracle / complex maintenance repair and overhaul	Vulnerability in the Oracle Complex Maintenance, Repair and Overhaul product of Oracle E-Business Suite (component	133d ago
CVE-2026-46934	7.5	—	—	—	oracle / complex maintenance repair and overhaul	Vulnerability in the Oracle Complex Maintenance, Repair and Overhaul product of Oracle E-Business Suite (component	133d ago
CVE-2026-46873	7.5	—	—	—	oracle / vm virtualbox	Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: VMSVGA device).	133d ago
CVE-2026-46863	7.5	—	—	—	oracle / mysql cluster	Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Connection Handling).	133d ago
CVE-2026-46862	7.5	—	—	—	oracle / mysql router	Vulnerability in the MySQL Router product of Oracle MySQL (component: Router: General).	133d ago
CVE-2026-46791	7.5	—	—	—	oracle / webcenter content	Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).	133d ago
CVE-2026-35295	7.5	—	—	—	oracle / webcenter sites	Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites).	133d ago
CVE-2026-35275	7.5	—	—	—	oracle / vm virtualbox	Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Shared Folders).	133d ago
CVE-2026-35269	7.5	—	—	—	oracle / identity manager	Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: REST WebServices).	133d ago

Sources: NIST National Vulnerability Database (descriptions, CVSS, CPE); CISA KEV, ENISA EUVD, CIRCL and VulnCheck (exploitation status, three catalogues counted; CIRCL shown as an aggregator); FIRST EPSS (exploitation probability). Patch window is the gap between CVE publication and the earliest KEV listing, so a negative value means a catalogue called it exploited before it was disclosed. Data refreshes every five hours.

Loading

CVE Tracker