CVE Tracker: vulnerabilities by vendor, severity and exploitation status

CVE Tracker

21,446 records

Every published CVE from the last 120 days with CVSS score, vendor and product, cross-referenced against CISA's Known Exploited Vulnerabilities catalog. 7 added to KEV in the last 7 days.

SeverityAll critical high medium lowExploitedIn CISA KEV

CVE	CVSS	EPSS	KEV sources	Patch window	Vendor / product	Summary	Published
CVE-2026-59542	7.7	—	—	—	—	Subscriber Arbitrary File Deletion in Kali Forms <= 2.4.18 versions.	82d ago
CVE-2026-13078	7.7	—	—	—	mongodb / mongodb	A vulnerability was discovered in MongoDB Server where the server-side MozJS scripting engine unconditionally regi	83d ago
CVE-2026-61390	7.7	—	—	—	—	There is a heap buffer overflow vulnerability in some Hikvision cameras, which may allow unauthenticated attackers	83d ago
CVE-2026-62567	7.7	—	—	—	oracle / human resources management system	Vulnerability in the Oracle HRMS (UK) product of Oracle E-Business Suite (component: UK Payroll).	84d ago
CVE-2026-62560	7.7	—	—	—	oracle / human resources management system	Vulnerability in the Oracle HRMS (Norway) product of Oracle E-Business Suite (component: Internal Operations).	84d ago
CVE-2026-61324	7.7	—	—	—	oracle / advanced benefits	Vulnerability in the Oracle Advanced Benefits product of Oracle E-Business Suite (component: Internal Operations).	84d ago
CVE-2026-61142	7.7	—	—	—	oracle / payroll	Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations).	84d ago
CVE-2026-61125	7.7	—	—	—	oracle / e-business suite	Vulnerability in the Oracle Configure to Order product of Oracle E-Business Suite (component: Supply to Order Work	84d ago
CVE-2026-61014	7.7	—	—	—	oracle / inventory management	Vulnerability in the Oracle Inventory Management product of Oracle E-Business Suite (component: Internal Operation	84d ago
CVE-2026-60923	7.7	—	—	—	oracle / capacity	Vulnerability in the Oracle Capacity product of Oracle E-Business Suite (component: Internal Operations).	84d ago
CVE-2026-60824	7.7	—	—	—	oracle / isupport	Vulnerability in the Oracle iSupport product of Oracle E-Business Suite (component: Internal Operations).	84d ago
CVE-2026-60750	7.7	—	—	—	oracle / payroll	Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations).	84d ago
CVE-2026-60690	7.7	—	—	—	oracle / siebel crm	Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager).	84d ago
CVE-2026-60683	7.7	—	—	—	oracle / e-business suite	Vulnerability in the Oracle Process Manufacturing Regulatory Management product of Oracle E-Business Suite (compon	84d ago
CVE-2026-60657	7.7	—	—	—	oracle / webcenter content	Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).	84d ago
CVE-2026-60586	7.7	—	—	—	oracle / mysql connector\/j	Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J).	84d ago
CVE-2026-60548	7.7	—	—	—	oracle / soa suite	Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Integration Business Insight	84d ago
CVE-2026-60534	7.7	—	—	—	oracle / identity manager connector	Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: PeopleSoft	84d ago
CVE-2026-60440	7.7	—	—	—	oracle / service delivery platform	Vulnerability in the Service Delivery Platform product of Oracle Fusion Middleware (component: Messaging Enabler).	84d ago
CVE-2026-46987	7.7	—	—	—	oracle / enterprise manager base platform	Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Appl	84d ago
CVE-2026-63769	7.7	—	—	—	—	Huginn through 2022.08.18 contains a server-side request forgery vulnerability in the fetch_url method of Scenario	85d ago
CVE-2026-63731	7.7	—	—	—	—	HyperDX before 2.31.0 contains a server-side request forgery vulnerability that allows authenticated team members	85d ago
CVE-2026-63107	7.7	—	—	—	—	LimeSurvey through 6.17.10 and 7.0.4 contains a server-side request forgery vulnerability in the REST API survey t	85d ago
CVE-2026-46555	7.7	—	—	—	verygoodplugins / whatsapp mcp server	WhatsApp MCP Server is a Model Context Protocol (MCP) server for WhatsApp, enabling Claude to read and send WhatsA	85d ago
CVE-2026-54910	7.7	—	—	—	—	FileBrowser Quantum is a free, self-hosted, web-based file manager.	85d ago
CVE-2026-63739	7.7	—	—	—	surrealdb / surrealdb	SurrealDB before 3.1.5 contains an arbitrary file read vulnerability in the DEFINE ANALYZER mapper filter that all	85d ago
CVE-2026-64039	7.7	—	—	—	—	In the Linux kernel, the following vulnerability has been resolved: drm/msm/snapshot: fix dumping of the unaligned	86d ago
CVE-2026-7754	7.7	—	—	—	langflow / langflow	IBM Langflow OSS 1.0.0 through 1.10.0 Langflow 1.9.0 could allow server-side request forgery (SSRF) due to insecure	88d ago
CVE-2026-62227	7.7	—	—	—	openclaw / openclaw	OpenClaw 2026.4.14 before 2026.5.26 contain a server-side request forgery vulnerability in browser snapshot routes	89d ago
CVE-2026-62201	7.7	—	—	—	openclaw / openclaw	OpenClaw versions before 2026.6.6 contain a network policy bypass vulnerability in the sandbox exec-server that al	89d ago
CVE-2026-57077	7.7	—	—	—	—	YAML::Syck versions before 1.47 for Perl allow an out-of-bounds read via an unbounded newline scan in newline_len.	89d ago
CVE-2026-45313	7.7	—	—	—	—	Sandboxie-Plus is an open source sandbox-based isolation software for Windows.	90d ago
CVE-2026-53514	7.7	—	—	—	better-auth / better auth	Better Auth is an authentication and authorization library for TypeScript.	90d ago
CVE-2026-48799	7.7	—	—	—	—	Postiz is an AI social media scheduling tool.	90d ago
CVE-2026-47164	7.7	—	—	—	—	Vaultwarden is a Bitwarden-compatible server written in Rust.	90d ago
CVE-2026-45806	7.7	—	—	—	—	Penpot is an open-source design tool for design and code collaboration.	90d ago
CVE-2026-61835	7.7	—	—	—	monospace / directus	Directus is a real-time API and App dashboard for managing SQL database content.	90d ago
CVE-2026-61644	7.7	—	—	—	—	FastGPT is a knowledge-based AI application platform.	90d ago
CVE-2026-14251	7.7	—	—	—	—	A flaw was found in the OpenShift GitOps operator.	91d ago
CVE-2026-61520	7.7	—	—	—	—	Simple Machines Forum 2.1 prior to commit 4bf35cf and 3.0 prior to commit b4d23df contains a server-side request f	91d ago
CVE-2026-49853	7.7	—	—	—	—	Tornado is a Python web framework and asynchronous networking library.	91d ago
CVE-2026-48332	7.7	—	—	—	adobe / coldfusion	ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in a Security featu	91d ago
CVE-2026-48328	7.7	—	—	—	adobe / coldfusion	ColdFusion is affected by an Improper Input Validation vulnerability that could result in a Security feature bypas	91d ago
CVE-2026-48348	7.7	—	—	—	adobe / animate	Animate is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in t	91d ago
CVE-2026-48347	7.7	—	—	—	adobe / animate	Animate is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection	91d ago
CVE-2026-15392	7.7	—	—	—	—	DBD::File versions before 1.651 for Perl do not ensure the table file is not a symlink to an untrusted location.	91d ago
CVE-2026-14903	7.7	—	—	—	ivanti / xtraction	Path traversal in Ivanti Xtraction before version 2026.2.1 allows a remote authenticated attacker to read arbitrar	91d ago
CVE-2026-57212	7.7	—	—	—	broadcom / rabbitmq server	RabbitMQ is a messaging and streaming broker.	95d ago
CVE-2026-55659	7.7	—	—	—	—	Grist is spreadsheet software using Python as its formula language.	95d ago
CVE-2026-55516	7.7	—	—	—	snipeitapp / snipe-it	Snipe-IT is an IT asset/license management system.	95d ago
CVE-2026-56689	7.7	—	—	—	dell / powerflex manager	Dell PowerFlex Manager, Version prior to 5.1.0.1, contain(s) an Improper Neutralization of Special Elements used i	95d ago
CVE-2026-59832	7.7	—	—	—	—	SiYuan is an open-source personal knowledge management system.	96d ago
CVE-2026-33655	7.7	—	—	—	newapi / new api	New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system.	96d ago
CVE-2026-55208	7.7	—	—	—	—	Pimcore Studio Backend Bundle is the backend bundle for Pimcore Studio.	96d ago
CVE-2026-59221	7.7	—	—	—	openwebui / open webui	Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform.	96d ago
CVE-2026-59216	7.7	—	—	—	openwebui / open webui	Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform.	96d ago
CVE-2026-58207	7.7	—	—	—	linuxfoundation / nats-server	NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system.	97d ago
CVE-2026-14373	7.7	—	—	—	—	HashiCorp Nomad and Nomad Enterprise did not enforce the allow_privileged restriction for the Docker task driver's	97d ago
CVE-2026-55874	7.7	—	—	—	—	SeaweedFS is a distributed storage system.	97d ago
CVE-2026-60002	7.7	—	—	—	openbsd / openssh	ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during a key re-exchange.	98d ago

Sources: NIST National Vulnerability Database (descriptions, CVSS, CPE); CISA KEV, ENISA EUVD, CIRCL and VulnCheck (exploitation status, three catalogues counted; CIRCL shown as an aggregator); FIRST EPSS (exploitation probability). Patch window is the gap between CVE publication and the earliest KEV listing, so a negative value means a catalogue called it exploited before it was disclosed. Data refreshes every five hours.

Loading

CVE Tracker