CVE Tracker: vulnerabilities by vendor, severity and exploitation status

CVE Tracker

15,513 records

Every published CVE from the last 120 days with CVSS score, vendor and product, cross-referenced against CISA's Known Exploited Vulnerabilities catalog. 8 added to KEV in the last 7 days.

SeverityAll critical high medium lowExploitedIn CISA KEV

CVE	CVSS	EPSS	KEV sources	Patch window	Vendor / product	Summary	Published
CVE-2026-40902	7.5	—	—	—	phpoffice / phpspreadsheet	PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files.	169d ago
CVE-2026-40863	7.5	—	—	—	phpoffice / phpspreadsheet	PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files.	169d ago
CVE-2026-44240	7.5	—	—	—	—	basic-ftp is an FTP client for Node.js.	169d ago
CVE-2026-34665	7.5	—	—	—	adobe / c2pa	CAI Content Credentials versions c2pa-web@0.7.0, c2pa-v0.78.2 and earlier are affected by an Uncontrolled Resource	169d ago
CVE-2026-34652	7.5	—	—	—	adobe / commerce	Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected	169d ago
CVE-2026-34651	7.5	—	—	—	adobe / commerce	Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected	169d ago
CVE-2026-34650	7.5	—	—	—	adobe / commerce	Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected	169d ago
CVE-2026-34649	7.5	—	—	—	adobe / commerce	Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected	169d ago
CVE-2026-34648	7.5	—	—	—	adobe / commerce	Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected	169d ago
CVE-2026-34646	7.5	—	—	—	adobe / commerce	Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected	169d ago
CVE-2026-34645	7.5	—	—	—	adobe / commerce	Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected	169d ago
CVE-2026-23827	7.5	—	—	—	arubanetworks / arubaos	A heap-based buffer overflow vulnerability exists in a Network management service of AOS-8 and AOS-10 that could a	169d ago
CVE-2026-23826	7.5	—	—	—	arubanetworks / arubaos	A vulnerability in a network management service of AOS-8 Operating System could allow an unauthenticated remote at	169d ago
CVE-2026-23825	7.5	—	—	—	arubanetworks / arubaos	Vulnerabilities exist in a protocol-handling component of AOS-8 and AOS-10 Operating Systems.	169d ago
CVE-2026-23824	7.5	—	—	—	arubanetworks / arubaos	Vulnerabilities exist in a protocol-handling component of AOS-8 and AOS-10 Operating Systems.	169d ago
CVE-2026-44167	7.5	—	—	—	—	phpseclib is a PHP secure communications library.	169d ago
CVE-2026-43891	7.5	—	—	—	webtechnologies / changedetection	changedetection.io is a free open source web page change detection tool.	169d ago
CVE-2026-42899	7.5	—	—	—	microsoft / .net	Loop with unreachable exit condition ('infinite loop') in ASP.NET Core allows an unauthorized attacker to deny ser	169d ago
CVE-2026-41895	7.5	—	—	—	webtechnologies / changedetection	changedetection.io is a free open source web page change detection tool.	169d ago
CVE-2026-40406	7.5	—	—	—	microsoft / windows 10 1607	Use after free in Windows TCP/IP allows an unauthorized attacker to disclose information over a network.	169d ago
CVE-2026-40405	7.5	—	—	—	microsoft / windows 11 24h2	Null pointer dereference in Windows TCP/IP allows an unauthorized attacker to deny service over a network.	169d ago
CVE-2026-35424	7.5	—	—	—	microsoft / windows 10 1607	Missing release of memory after effective lifetime in Windows Internet Key Exchange (IKE) Protocol allows an unaut	169d ago
CVE-2026-32161	7.5	—	—	—	microsoft / windows 10 1607	Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Native WiFi	169d ago
CVE-2026-31240	7.5	—	—	—	—	The mem0 1.0.0 server lacks authentication and authorization controls for its memory management API endpoints.	169d ago
CVE-2025-46311	7.5	—	—	—	apple / ipados	An inconsistent user interface issue was addressed with improved state management.	169d ago
CVE-2026-20887	7.5	—	—	—	intel / vision	Improper access control for some Intel Vision software for all versions within Ring 3: User Applications may allow	169d ago
CVE-2026-43513	7.5	—	—	—	apache / tomcat	Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat.	169d ago
CVE-2026-41284	7.5	—	—	—	apache / tomcat	Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat.	169d ago
CVE-2026-6866	7.5	—	—	—	schneider-electric / ecostruxure panel server pas400 firmware	CWE-1188 Initialization of a Resource with an Insecure Default vulnerability exists that could cause unauthorized d	169d ago
CVE-2026-41712	7.5	—	—	—	vmware / spring ai	Spring AI's chat memory component contained a problematic default that, when not explicitly overridden, could resu	169d ago
CVE-2026-8162	7.5	—	—	—	pillarjs / multiparty	multiparty@4.2.3 and lower versions are vulnerable to denial of service via uncaught exception.	169d ago
CVE-2026-8161	7.5	—	—	—	pillarjs / multiparty	multiparty@4.2.3 and lower versions are vulnerable to denial of service via uncaught exception.	169d ago
CVE-2026-8159	7.5	—	—	—	pillarjs / multiparty	multiparty@4.2.3 and lower versions are vulnerable to denial of service via regular expression backtracking in the	169d ago
CVE-2026-33893	7.5	—	—	—	siemens / teamcenter	A vulnerability has been identified in Teamcenter V2312 (All versions < V2312.0014), Teamcenter V2406 (All version	169d ago
CVE-2026-22925	7.5	—	—	—	siemens / simatic cn 4100 firmware	A vulnerability has been identified in SIMATIC CN 4100 (All versions < V5.0).	169d ago
CVE-2025-40947	7.5	—	—	—	siemens / ruggedcom rox mx5000 firmware	A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.1), RUGGEDCOM ROX MX5000RE (All	169d ago
CVE-2025-40833	7.5	—	—	—	—	The affected devices contain a null pointer dereference vulnerability while processing specially crafted IPv4 requ	169d ago
CVE-2026-2993	7.5	—	—	—	—	The AI Chatbot & Workflow Automation by AIWU plugin for WordPress is vulnerable to SQL Injection in versions up to,	169d ago
CVE-2026-7287	7.5	—	—	—	zyxel / nwa1100-n firmware	UNSUPPORTED WHEN ASSIGNED A buffer overflow vulnerability in the formWep(), formWlAc(), formPasswordSetup(),	169d ago
CVE-2026-43873	7.5	—	—	—	—	WWBN AVideo is an open source video platform.	170d ago
CVE-2026-43668	7.5	—	—	—	apple / ipados	A use after free issue was addressed with improved memory management.	170d ago
CVE-2026-43661	7.5	—	—	—	apple / ipados	A buffer overflow issue was addressed with improved memory handling.	170d ago
CVE-2026-43660	7.5	—	—	—	apple / ipados	A validation issue was addressed with improved logic.	170d ago
CVE-2026-43658	7.5	—	—	—	apple / ipados	The issue was addressed with improved memory handling.	170d ago
CVE-2026-43654	7.5	—	—	—	apple / ipados	The issue was addressed with improved memory handling.	170d ago
CVE-2026-43652	7.5	—	—	—	apple / macos	A permissions issue was addressed with additional restrictions.	170d ago
CVE-2026-39871	7.5	—	—	—	apple / macos	A path handling issue was addressed with improved logic.	170d ago
CVE-2026-39870	7.5	—	—	—	apple / macos	The issue was addressed with improved memory handling.	170d ago
CVE-2026-28991	7.5	—	—	—	apple / ipados	An out-of-bounds read was addressed with improved bounds checking.	170d ago
CVE-2026-28990	7.5	—	—	—	apple / ipados	The issue was addressed with improved memory handling.	170d ago
CVE-2026-28987	7.5	—	—	—	apple / ipados	A logging issue was addressed with improved data redaction.	170d ago
CVE-2026-28986	7.5	—	—	—	apple / ipados	A race condition was addressed with additional validation.	170d ago
CVE-2026-28983	7.5	—	—	—	apple / ipados	A type confusion issue was addressed with improved checks.	170d ago
CVE-2026-28976	7.5	—	—	—	apple / macos	An information leakage was addressed with additional validation.	170d ago
CVE-2026-28974	7.5	—	—	—	apple / ipados	This issue was addressed with improved checks to prevent unauthorized actions.	170d ago
CVE-2026-28969	7.5	—	—	—	apple / ipados	A use after free issue was addressed with improved memory management.	170d ago
CVE-2026-28965	7.5	—	—	—	apple / ipados	A privacy issue was addressed with improved checks.	170d ago
CVE-2026-28964	7.5	—	—	—	apple / ipados	An inconsistent user interface issue was addressed with improved state management.	170d ago
CVE-2026-28962	7.5	—	—	—	apple / ipados	This issue was addressed with improved access restrictions.	170d ago
CVE-2026-28959	7.5	—	—	—	apple / ipados	A buffer overflow was addressed with improved bounds checking.	170d ago

Sources: NIST National Vulnerability Database (descriptions, CVSS, CPE); CISA KEV, ENISA EUVD, CIRCL and VulnCheck (exploitation status, three catalogues counted; CIRCL shown as an aggregator); FIRST EPSS (exploitation probability). Patch window is the gap between CVE publication and the earliest KEV listing, so a negative value means a catalogue called it exploited before it was disclosed. Data refreshes every five hours.

Loading

CVE Tracker