CVE Tracker: vulnerabilities by vendor, severity and exploitation status

CVE Tracker

15,513 records

Every published CVE from the last 120 days with CVSS score, vendor and product, cross-referenced against CISA's Known Exploited Vulnerabilities catalog. 8 added to KEV in the last 7 days.

SeverityAll critical high medium lowExploitedIn CISA KEV

CVE	CVSS	EPSS	KEV sources	Patch window	Vendor / product	Summary	Published
CVE-2026-57990	7.4	—	—	—	microsoft / edge chromium	Files or directories accessible to external parties in Microsoft Edge (Chromium-based) allows an unauthorized atta	94d ago
CVE-2026-57989	7.4	—	—	—	microsoft / edge chromium	Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information	94d ago
CVE-2026-66141	7.4	—	—	—	exim / exim	Exim before 4.99.5 allows .forward privilege escalation because force_command for a pipe transport is mishandled.	96d ago
CVE-2026-64829	7.4	—	—	—	—	Question2Answer through 1.8.8 contains a session invalidation vulnerability that allows attackers with a previousl	98d ago
CVE-2026-56820	7.4	—	—	—	netty / netty	Netty is a network application framework for development of protocol servers and clients.	98d ago
CVE-2026-61234	7.4	—	—	—	oracle / peoplesoft enterprise fin common objects	Vulnerability in the PeopleSoft Enterprise FIN Common Objects Brazil product of Oracle PeopleSoft (component: ePro	99d ago
CVE-2026-61210	7.4	—	—	—	oracle / peoplesoft enterprise scm manufacturing	Vulnerability in the PeopleSoft Enterprise SCM Manufacturing product of Oracle PeopleSoft (component: Security).	99d ago
CVE-2026-61185	7.4	—	—	—	oracle / agile product lifecycle management for process	Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (compone	99d ago
CVE-2026-61173	7.4	—	—	—	oracle / agile product lifecycle management	Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Security).	99d ago
CVE-2026-61164	7.4	—	—	—	oracle / commerce experience manager	Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce	99d ago
CVE-2026-61135	7.4	—	—	—	oracle / commerce platform	Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework)	99d ago
CVE-2026-61113	7.4	—	—	—	oracle / application object library	Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core).	99d ago
CVE-2026-60827	7.4	—	—	—	oracle / isupport	Vulnerability in the Oracle iSupport product of Oracle E-Business Suite (component: Internal Operations).	99d ago
CVE-2026-60823	7.4	—	—	—	oracle / isupport	Vulnerability in the Oracle iSupport product of Oracle E-Business Suite (component: Internal Operations).	99d ago
CVE-2026-60725	7.4	—	—	—	oracle / mysql router	Vulnerability in the MySQL Router product of Oracle MySQL (component: Router: General).	99d ago
CVE-2026-60667	7.4	—	—	—	oracle / peoplesoft enterprise hcm human resources	Vulnerability in the PeopleSoft Enterprise HCM Human Resources product of Oracle PeopleSoft (component: Core).	99d ago
CVE-2026-60317	7.4	—	—	—	oracle / mysql connector\/net	Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Net).	99d ago
CVE-2026-60179	7.4	—	—	—	oracle / mysql connector\/c\+\+	Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/C++).	99d ago
CVE-2026-47058	7.4	—	—	—	oracle / jre	Vulnerability in Oracle Java SE (component: Scripting).	99d ago
CVE-2026-47050	7.4	—	—	—	oracle / vm virtualbox	Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).	99d ago
CVE-2026-47026	7.4	—	—	—	oracle / peoplesoft enterprise peopletools	Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: OpenSearch Dashboa	99d ago
CVE-2026-46943	7.4	—	—	—	oracle / retail eftlink	Vulnerability in the Oracle Retail EFTLink product of Oracle Retail Applications (component: Core/Plugin).	99d ago
CVE-2026-16404	7.4	—	—	—	mozilla / firefox mobile	Spoofing issue in Firefox for Android.	99d ago
CVE-2026-62232	7.4	—	—	—	—	Grav before 2.0.4 contains a two-factor authentication bypass vulnerability in the login plugin where the regenera	103d ago
CVE-2026-46513	7.4	—	—	—	—	Frogman provides headless PBX control through MCP and HTTP API.	104d ago
CVE-2026-48287	7.4	—	—	—	adobe / c2pa	CAI Content Credentials is affected by an Untrusted Search Path vulnerability that could result in arbitrary code	106d ago
CVE-2026-47473	7.4	—	—	—	—	NVIDIA TensorRT-LLM contains a vulnerability where an attacker could cause a write-what-where condition.	106d ago
CVE-2026-4017	7.4	—	—	—	—	Buffer Overflow in the entry handler of the TraceEvent() system call could allow an attacker with local access to c	106d ago
CVE-2026-54127	7.4	—	—	—	microsoft / windows 11 24h2	Use after free in Windows Hyper-V allows an unauthorized attacker to elevate privileges locally.	106d ago
CVE-2026-54429	7.4	—	—	—	—	A vulnerability has been identified in SIMATIC S7-PLCSIM Advanced (All versions).	106d ago
CVE-2026-62240	7.4	—	—	—	crewai / crewai	CrewAI before 1.15.1 contains a server-side request forgery vulnerability in the validate_url function that perfor	107d ago
CVE-2026-49969	7.4	—	—	—	—	Laravel-Mediable before 7.0.0 contains a server-side request forgery vulnerability that allows remote attackers to	107d ago
CVE-2026-10665	7.4	—	—	—	zephyrproject / zephyr	In Zephyr's WireGuard subsystem (subsys/net/lib/wireguard), wg_process_data_message() in wg_crypto.c linearizes an	108d ago
CVE-2026-15081	7.4	—	—	—	handkerchief / location selector	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Locat	110d ago
CVE-2026-53450	7.4	—	—	—	coturn project / coturn	Coturn is a free open source implementation of TURN and STUN Server.	110d ago
CVE-2026-55672	7.4	—	—	—	—	ZITADEL is an open source identity management platform.	110d ago
CVE-2026-54919	7.4	—	—	—	yhirose / cpp-httplib	cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library.	110d ago
CVE-2026-56676	7.4	—	—	—	—	9Router is an AI router & token saver.	110d ago
CVE-2026-54784	7.4	—	—	—	—	CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core.	111d ago
CVE-2026-54783	7.4	—	—	—	—	CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core.	111d ago
CVE-2026-54781	7.4	—	—	—	—	CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core.	111d ago
CVE-2026-54774	7.4	—	—	—	—	CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core.	111d ago
CVE-2026-59806	7.4	—	—	—	—	Gradio before 6.20.0 contains an open redirect and server-side request forgery vulnerability that allows attackers	112d ago
CVE-2026-56776	7.4	—	—	—	n8n / n8n	n8n before 1.123.55, 2.25.7, and 2.26.2 contains an authorization bypass in the POST /workflows/{workflowId}/test-	112d ago
CVE-2026-55436	7.4	—	—	—	coder / coder	Coder allows organizations to provision remote development environments via Terraform.	112d ago
CVE-2026-55076	7.4	—	—	—	coder / coder	Coder allows organizations to provision remote development environments via Terraform.	112d ago
CVE-2026-55075	7.4	—	—	—	coder / coder	Coder allows organizations to provision remote development environments via Terraform.	113d ago
CVE-2026-6900	7.4	—	—	—	—	Improper certificate validation vulnerability in B&R Industrial Automation GmbH APROL.	114d ago
CVE-2026-57993	7.4	—	—	—	microsoft / edge chromium	Server-side request forgery (ssrf) in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform s	117d ago
CVE-2026-57991	7.4	—	—	—	microsoft / edge chromium	Improper link resolution before file access ('link following') in Microsoft Edge (Chromium-based) allows an unauth	117d ago
CVE-2026-13341	7.4	—	—	—	—	A vulnerability exists in the Kong Konnect Model Context Protocol (MCP) server prior to version 1.0.0, which could	117d ago
CVE-2026-9547	7.4	—	—	—	haxx / curl	When a libcurl-based application performs transfers via `SCP://` or `SFTP://` and utilizes the `CURLOPT_SSH_KEYFUNC	117d ago
CVE-2026-57736	7.4	—	—	—	—	Insertion of Sensitive Information Into Sent Data vulnerability in HubSpot allows Retrieve Embedded Sensitive Data	119d ago
CVE-2026-57723	7.4	—	—	—	—	Cross-Site Request Forgery (CSRF) vulnerability in e4jvikwp VikBooking Hotel Booking Engine & PMS allows Path Trav	119d ago
CVE-2026-12579	7.4	—	—	—	—	AS228T with Authentication Bypass Vulnerability	119d ago
CVE-2026-7830	7.4	—	—	—	uvnc / ultravnc	UltraVNC through 1.8.2.2 uses inadequate cryptography in the MS-Logon II authentication scheme (rfbUltraVNC_MsLogon	119d ago
CVE-2026-11541	7.4	—	—	—	ibm / websphere application server	IBM CICS Transaction Gateway for Multiplatforms 9.1, 9.2, 9.3, and 10.1 IBM WebSphere Application Server 9.0, and	120d ago
CVE-2026-44946	7.4	—	—	—	suse / rancher	A SAML authentication replay vulnerability in Rancher's Assertion Consumer Service (ACS) handler did not enforce o	120d ago
CVE-2026-10646	7.4	—	—	—	zephyrproject / zephyr	Zephyr's BSD-sockets getaddrinfo() implementation (subsys/net/lib/sockets/getaddrinfo.c) passes a pointer to a sta	122d ago
CVE-2026-50136	7.4	—	—	—	budibase / budibase	Budibase is an open-source low-code platform.	124d ago

Sources: NIST National Vulnerability Database (descriptions, CVSS, CPE); CISA KEV, ENISA EUVD, CIRCL and VulnCheck (exploitation status, three catalogues counted; CIRCL shown as an aggregator); FIRST EPSS (exploitation probability). Patch window is the gap between CVE publication and the earliest KEV listing, so a negative value means a catalogue called it exploited before it was disclosed. Data refreshes every five hours.

Loading

CVE Tracker