CVE Tracker: vulnerabilities by vendor, severity and exploitation status

CVE Tracker

15,513 records

Every published CVE from the last 120 days with CVSS score, vendor and product, cross-referenced against CISA's Known Exploited Vulnerabilities catalog. 8 added to KEV in the last 7 days.

SeverityAll critical high medium lowExploitedIn CISA KEV

CVE	CVSS	EPSS	KEV sources	Patch window	Vendor / product	Summary	Published
CVE-2026-41707	7.4	—	—	—	—	Authentication Bypass by Capture-replay vulnerability in Spring Spring Security allows Spring Security's DPoPProof	64d ago
CVE-2026-79286	7.4	—	—	—	google / chrome	Missing authorization in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a local attacker	64d ago
CVE-2026-79664	7.4	—	—	—	—	Ech0 before 4.7.3 fails to properly revoke access tokens created with never-expire option, allowing attackers to m	64d ago
CVE-2026-53561	7.4	—	—	—	apache / hive	An improper authentication vulnerability in HiveServer2 SAML bearer-token validation in Apache Hive 4.0.0 through	64d ago
CVE-2026-56135	7.4	—	—	—	—	In NTFS-3G through 2026.2.25, a heap-based buffer overflow exists in the function build_inherited_id() in libntfs-	65d ago
CVE-2026-76072	7.4	—	—	—	—	The Continue CLI applies an incomplete denylist as its only barrier to destructive shell commands when running una	65d ago
CVE-2026-76844	7.4	—	—	—	—	webpack-dev-middleware resolves a request to a local file in getFilenameFromUrl by testing the request pathname ag	65d ago
CVE-2026-21751	7.4	—	—	—	—	HCL Hive is affected by a cryptographic primitive with a risky implementation which could allow an attacker unauth	65d ago
CVE-2026-10582	7.4	—	—	—	—	Hugo's security.http.urls allowlist is the only control on outbound fetches made by resources.GetRemote, and it in	65d ago
CVE-2026-78157	7.4	—	—	—	—	A vulnerability was detected in Open5GS 2.8.0.	65d ago
CVE-2026-78156	7.4	—	—	—	—	A security vulnerability has been detected in Open5GS 2.8.0.	65d ago
CVE-2026-78141exploited	7.4	2.7%	1/3	+9d	—	A vulnerability has been found in Tenda CH22 1.0.0.1.	66d ago
CVE-2026-78063	7.4	—	—	—	—	A security flaw has been discovered in Tenda CH22 1.0.0.1.	66d ago
CVE-2026-78122	7.4	—	—	—	—	docker-socket-proxy fails to properly gate read endpoints in the /containers Docker API namespace when the CONTAIN	67d ago
CVE-2026-77945	7.4	—	—	—	—	A vulnerability was found in TRENDnet TEW-821DAP 2.2.01b05.	67d ago
CVE-2026-53525	7.4	—	—	—	—	WeeChat (Wee Enhanced Environment for Chat) is a free chat client.	68d ago
CVE-2026-62960	7.4	—	—	—	—	Git for Windows is the Windows port of Git.	68d ago
CVE-2026-77031	7.4	—	—	—	—	A vulnerability has been found in Tenda CH22 1.0.0.1.	69d ago
CVE-2026-77004	7.4	—	—	—	—	A flaw has been found in Comfast CF-N1-S 2.6.0.1.	69d ago
CVE-2026-19611	7.4	—	—	—	—	A flaw was found in WildFly Elytron.	69d ago
CVE-2026-76591	7.4	—	—	—	—	A security flaw has been discovered in TRENDnet TEW-755AP up to 20260702.	70d ago
CVE-2026-76403	7.4	—	—	—	splunk / connect for kafka	In Splunk Connect for Kafka versions below 2.2.7, an unauthenticated user positioned in the network path could rea	70d ago
CVE-2026-76362	7.4	—	—	—	splunk / soar	In Splunk SOAR versions below 8.6.0, an unauthenticated user who can observe or alter network traffic between Splu	70d ago
CVE-2025-36254	7.4	—	—	—	ibm / ds8900f firmware	IBM System Storage DS8A00 10.1.3.0 through 10.11.35.0 and IBM DS8900F 89.40.83.0 through 89.44.25.0 could allow an	70d ago
CVE-2026-76583	7.4	—	—	—	—	A vulnerability was identified in TRENDnet TV-IP751WIC 11.03.03.	70d ago
CVE-2026-76582	7.4	—	—	—	—	A vulnerability was determined in TRENDnet TEW-821DAP 2.2.01b05.	70d ago
CVE-2026-16851	7.4	—	—	—	ibm / aix	IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to a	70d ago
CVE-2026-62669	7.4	—	—	—	—	Grav Login Plugin adds login, basic ACL, and session wide messages to Grav.	70d ago
CVE-2026-76214	7.4	—	—	—	phpmyfaq / phpmyfaq	phpMyFAQ before 4.1.7 fails to persist the WebAuthn login challenge generated by prepareForLogin, because neither	70d ago
CVE-2026-76213	7.4	—	—	—	phpmyfaq / phpmyfaq	phpMyFAQ before 4.1.7 contains a brute-force vulnerability in the two-factor authentication step where the failure	70d ago
CVE-2026-58088	7.4	—	—	—	freebsd / freebsd	The ELF core dump code counted the number of dumpable VM map entries, allocated a buffer for the corresponding pro	70d ago
CVE-2026-75985	7.4	—	—	—	—	A flaw has been found in TRENDnet Router 1.1.02b01.	70d ago
CVE-2026-75984	7.4	—	—	—	—	A vulnerability was detected in TRENDnet TEW-823DRU 1.1.02b01.	70d ago
CVE-2026-71143	7.4	—	—	—	oracle / communications unified inventory management	Vulnerability in the Oracle Communications Unified Inventory Management product of Oracle Communications (componen	71d ago
CVE-2026-71009	7.4	—	—	—	oracle / commerce experience manager	Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce	71d ago
CVE-2026-70898	7.4	—	—	—	oracle / hyperion data relationship management	Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access an	71d ago
CVE-2026-70823	7.4	—	—	—	oracle / hyperion financial management	Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security).	71d ago
CVE-2026-70790	7.4	—	—	—	oracle / telecommunications billing integrator	Vulnerability in the Oracle Telecommunications Billing Integrator product of Oracle E-Business Suite (component: I	71d ago
CVE-2026-70783	7.4	—	—	—	oracle / service contracts	Vulnerability in the Oracle Service Contracts product of Oracle E-Business Suite (component: Internal Operations).	71d ago
CVE-2026-70779	7.4	—	—	—	oracle / isupplier portal	Vulnerability in the Oracle iSupplier Portal product of Oracle E-Business Suite (component: Internal Operations).	71d ago
CVE-2026-70734	7.4	—	—	—	oracle / autonomous health framework	Vulnerability in Oracle Autonomous Health Framework (component: Trace File Analyzer).	71d ago
CVE-2026-70699	7.4	—	—	—	oracle / payments	Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission).	71d ago
CVE-2026-70672	7.4	—	—	—	oracle / reports developer	Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Security and Authent	71d ago
CVE-2026-62538	7.4	—	—	—	oracle / hyperion infrastructure technology	Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Installation	71d ago
CVE-2026-62492	7.4	—	—	—	oracle / hyperion infrastructure technology	Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Common Secur	71d ago
CVE-2026-60933	7.4	—	—	—	oracle / webcenter content	Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).	71d ago
CVE-2026-60915	7.4	—	—	—	oracle / helidon	Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server).	71d ago
CVE-2026-60856	7.4	—	—	—	oracle / peoplesoft enterprise peopletools	Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Install and Packag	71d ago
CVE-2026-60820	7.4	—	—	—	oracle / siebel crm	Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: REST).	71d ago
CVE-2026-60803	7.4	—	—	—	oracle / siebel apps - marketing	Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing).	71d ago
CVE-2026-60797	7.4	—	—	—	oracle / siebel crm	Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: REST).	71d ago
CVE-2026-60792	7.4	—	—	—	oracle / siebel crm	Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).	71d ago
CVE-2026-60766	7.4	—	—	—	oracle / siebel crm	Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: REST).	71d ago
CVE-2026-60759	7.4	—	—	—	—	Vulnerability in the Oracle Internet Procurement Connector product of Oracle E-Business Suite (component: Internal	71d ago
CVE-2026-70666	7.4	—	—	—	—	Lemur manages TLS certificate creation.	71d ago
CVE-2026-50577	7.4	—	—	—	—	ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany's elec	71d ago
CVE-2026-75912	7.4	—	—	—	—	CodeWhale versions before 0.8.64 contain an argument injection vulnerability in the git_blame tool that allows att	71d ago
CVE-2026-66635	7.4	—	—	—	—	Unauthenticated Cross Site Request Forgery (CSRF) in Slider by 10Web <= 1.2.62 versions.	71d ago
CVE-2026-59825	7.4	—	—	—	—	Mastodon is a free, open-source social network server based on ActivityPub.	71d ago
CVE-2026-18534	7.4	—	—	—	—	ArcSearch for iOS versions prior to 1.48.0 could keep the address bar hidden after a page-initiated scroll, allowi	71d ago

Sources: NIST National Vulnerability Database (descriptions, CVSS, CPE); CISA KEV, ENISA EUVD, CIRCL and VulnCheck (exploitation status, three catalogues counted; CIRCL shown as an aggregator); FIRST EPSS (exploitation probability). Patch window is the gap between CVE publication and the earliest KEV listing, so a negative value means a catalogue called it exploited before it was disclosed. Data refreshes every five hours.

Loading

CVE Tracker