CVE Tracker: vulnerabilities by vendor, severity and exploitation status

CVE Tracker

21,446 records

Every published CVE from the last 120 days with CVSS score, vendor and product, cross-referenced against CISA's Known Exploited Vulnerabilities catalog. 7 added to KEV in the last 7 days.

SeverityAll critical high medium lowExploitedIn CISA KEV

CVE	CVSS	EPSS	KEV sources	Patch window	Vendor / product	Summary	Published
CVE-2026-84196	7.7	—	—	—	—	Kyverno before 1.18.0 contains a server-side request forgery vulnerability in apiCall.service.url that allows auth	42d ago
CVE-2026-84195	7.7	—	—	—	—	Kyverno before 1.16.4 automatically attaches the admission controller's ServiceAccount token to outbound HTTP requ	42d ago
CVE-2026-53553	7.7	—	—	—	—	Goploy is an open-source automation deployment system.	43d ago
CVE-2026-79750	7.7	—	—	—	—	MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separa	43d ago
CVE-2026-82871	7.7	—	—	—	—	ToolJet before v3.16.208 fails to validate organization membership in database read routes, allowing any authentic	44d ago
CVE-2026-82869	7.7	—	—	—	—	ToolJet Database versions before v3.16.44 contain a privilege escalation vulnerability in the join_tables endpoint	44d ago
CVE-2026-16600	7.7	—	—	—	—	The SmartAIPress WordPress plugin through 1.2.0 does not perform a capability check on one of its AJAX actions and	46d ago
CVE-2026-41012	7.7	—	—	—	—	Traffic interception vulnerability in BOSH Director vCenter CPI allows attackers positioned between BOSH Director	46d ago
CVE-2026-81490	7.7	—	—	—	—	A database user able to create a view in a namespace that MongoDB Connector for BI samples can cause the schema-sa	46d ago
CVE-2026-82242	7.7	—	—	—	—	Budibase versions before 3.41.3 contain a missing authorization vulnerability in the POST /api/resources/duplicate	46d ago
CVE-2026-75889	7.7	—	—	—	—	Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonito	47d ago
CVE-2026-81679	7.7	—	—	—	—	OpenRemote versions before 1.28.0 contain a cross-realm information disclosure vulnerability in the Notification R	47d ago
CVE-2026-81576	7.7	—	—	—	—	If configured as a server, CodeMeter Runtime before versions 8.41a and 9.10 issues handles per connection and reli	48d ago
CVE-2026-77017	7.7	—	—	—	—	The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor conf	48d ago
CVE-2026-47879	7.7	—	—	—	—	Spring Cloud Gateway JsonToGrpcGatewayFilterFactory allows arbitrary Spring Resource locations for defining the pr	48d ago
CVE-2026-61617	7.7	—	—	—	—	Wings is the server control plane for the Pterodactyl game-server management panel.	48d ago
CVE-2026-61792	7.7	—	—	—	—	Weblate is a web-based continuous localization platform used to manage software translations.	48d ago
CVE-2026-75797	7.7	—	—	—	—	The AI Engine WordPress plugin before 3.7.2 does not confine a caller-supplied URL when mapping it to a local file	49d ago
CVE-2026-57171	7.7	—	—	—	—	Compliance-trestle (Trestle) is a Python SDK and command-line tool for managing OSCAL compliance documents.	49d ago
CVE-2026-79245	7.7	—	—	—	google / chrome	Use after free in UI in Google Chrome prior to 152.0.7977.65 allowed a local attacker who had compromised the rend	49d ago
CVE-2026-79659	7.7	—	—	—	—	Ech0 before 4.7.3 contains a server-side request forgery vulnerability in the fetchPeerConnectInfo function that u	49d ago
CVE-2026-19851	7.7	—	—	—	—	A Use of Default Password vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an	50d ago
CVE-2026-56707	7.7	—	—	—	—	Grav Flex Objects plugin versions 1.4.0 through 1.4.7 contain an authorization bypass vulnerability in the flex-ob	50d ago
CVE-2026-71366	7.7	—	—	—	—	A server-side request forgery (SSRF) vulnerability was found in multiple AWX notification backends.	50d ago
CVE-2026-34948	7.7	—	—	—	—	Combodo iTop is a web based IT service management tool.	53d ago
CVE-2026-54457	7.7	—	—	—	—	TensorZero is an open-source LLMOps platform that unifies an LLM gateway, observability, evaluation, optimization,	53d ago
CVE-2026-55622	7.7	—	—	—	—	Incus is a system container and virtual machine manager.	53d ago
CVE-2026-55621	7.7	—	—	—	—	Incus is a system container and virtual machine manager.	53d ago
CVE-2026-73267	7.7	—	—	—	—	A flaw was found in the clusterclaims-controller component of multicluster engine (MCE).	54d ago
CVE-2026-69855	7.7	—	—	—	—	Server-side request forgery (ssrf) in Microsoft Copilot in Azure allows an authorized attacker to disclose informa	54d ago
CVE-2026-17423	7.7	—	—	—	ibm / vios	IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to obtain sensitive information and ca	54d ago
CVE-2026-17024	7.7	—	—	—	ibm / vios	IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to impro	54d ago
CVE-2026-17003	7.7	—	—	—	ibm / vios	IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to compromise the confidentiality and	54d ago
CVE-2026-73137	7.7	—	—	—	—	A flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management (RHACM)	54d ago
CVE-2026-76344	7.7	—	—	—	splunk / splunk	In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "p	55d ago
CVE-2026-75569	7.7	—	—	—	—	A flaw was found in mce-operator-bundle.	55d ago
CVE-2026-54493	7.7	—	—	—	—	Koel is a free, open-source music streaming solution.	55d ago
CVE-2026-53549	7.7	—	—	—	—	Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities.	55d ago
CVE-2026-16819	7.7	—	—	—	ibm / vios	IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to cause a denial of service and compro	55d ago
CVE-2026-76225	7.7	—	—	—	—	ArcadeDB before 26.8.1 contains a server-side request forgery vulnerability in the OpenCypher LOAD CSV implementat	55d ago
CVE-2026-71141	7.7	—	—	—	oracle / vm virtualbox	Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).	56d ago
CVE-2026-71056	7.7	—	—	—	oracle / business intelligence	Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Se	56d ago
CVE-2026-70988	7.7	—	—	—	oracle / commerce experience manager	Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce	56d ago
CVE-2026-70945	7.7	—	—	—	oracle / payroll	Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations).	56d ago
CVE-2026-70942	7.7	—	—	—	oracle / hyperion financial management	Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security).	56d ago
CVE-2026-70894	7.7	—	—	—	oracle / hyperion data relationship management	Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access an	56d ago
CVE-2026-70857	7.7	—	—	—	oracle / siebel crm	Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Open UI).	56d ago
CVE-2026-70828	7.7	—	—	—	oracle / hyperion financial management	Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security).	56d ago
CVE-2026-70827	7.7	—	—	—	oracle / mes for process manufacturing	Vulnerability in the Oracle MES for Process Manufacturing product of Oracle E-Business Suite (component: Internal	56d ago
CVE-2026-70804	7.7	—	—	—	oracle / public sector human resources	Vulnerability in the Oracle Public Sector Human Resources product of Oracle E-Business Suite (component: Regressio	56d ago
CVE-2026-70771	7.7	—	—	—	oracle / warehouse management	Vulnerability in the Oracle Warehouse Management product of Oracle E-Business Suite (component: Internal Operation	56d ago
CVE-2026-70723	7.7	—	—	—	oracle / hyperion profitability and cost management	Vulnerability in the Oracle Hyperion Profitability and Cost Management product of Oracle Hyperion (component: Depl	56d ago
CVE-2026-70717	7.7	—	—	—	oracle / autonomous health framework	Vulnerability in Oracle Autonomous Health Framework (component: Cluster Health Analyzer).	56d ago
CVE-2026-70695	7.7	—	—	—	oracle / payments	Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission).	56d ago
CVE-2026-70694	7.7	—	—	—	oracle / payments	Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission).	56d ago
CVE-2026-70692	7.7	—	—	—	oracle / marketing encyclopedia system	Vulnerability in the Oracle Marketing Encyclopedia System product of Oracle E-Business Suite (component: Internal	56d ago
CVE-2026-70687	7.7	—	—	—	oracle / marketing	Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Audience).	56d ago
CVE-2026-62594	7.7	—	—	—	oracle / siebel crm	Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: Open Integration).	56d ago
CVE-2026-62593	7.7	—	—	—	oracle / siebel crm	Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: Open Integration).	56d ago
CVE-2026-62571	7.7	—	—	—	oracle / hyperion calculation manager	Vulnerability in the Oracle Hyperion Calculation Manager product of Oracle Hyperion (component: Security).	56d ago

Sources: NIST National Vulnerability Database (descriptions, CVSS, CPE); CISA KEV, ENISA EUVD, CIRCL and VulnCheck (exploitation status, three catalogues counted; CIRCL shown as an aggregator); FIRST EPSS (exploitation probability). Patch window is the gap between CVE publication and the earliest KEV listing, so a negative value means a catalogue called it exploited before it was disclosed. Data refreshes every five hours.

Loading

CVE Tracker