CVE Tracker: vulnerabilities by vendor, severity and exploitation status

CVE Tracker

21,446 records

Every published CVE from the last 120 days with CVSS score, vendor and product, cross-referenced against CISA's Known Exploited Vulnerabilities catalog. 7 added to KEV in the last 7 days.

SeverityAll critical high medium lowExploitedIn CISA KEV

CVE	CVSS	EPSS	KEV sources	Patch window	Vendor / product	Summary	Published
CVE-2026-73774	7.6	—	—	—	hpe / arubaos-cx	A buffer overflow vulnerability exists in the underlying operating system of AOS-CX that could lead to unauthentic	42d ago
CVE-2026-73714	7.6	—	—	—	arubanetworks / fabric composer	A sensitive information disclosure vulnerability exists in the API of HPE Networking Fabric Composer.	42d ago
CVE-2026-40463	7.6	—	—	—	—	WaveSuite is affected by an insufficient role-based access control vulnerability in the CPB Log Files feature.	43d ago
CVE-2026-82017	7.6	—	—	—	—	IGEL OS 12 before 12.7.6 and IGEL OS 11 before 11.11.150 contain a boot registry parameter injection vulnerability	46d ago
CVE-2026-82243	7.6	—	—	—	—	Budibase Server before 3.41.3 contains a server-side request forgery vulnerability in the datasource verify endpoi	46d ago
CVE-2026-38822	7.6	—	—	—	—	In openNDS before 11.0.0, the client_params.sh script, invoked by the openNDS daemon to serve the authenticated cl	47d ago
CVE-2026-59284	7.6	—	—	—	broadcom / spring cloud commons	There is no allow list for property keys when Spring Cloud Commons writable /actuator/env is enabled.	47d ago
CVE-2026-66155	7.6	—	—	—	—	A vulnerability has been identified in Element maps-ng V47 (All versions < V47.12.3), Element maps-ng V48 (All ver	47d ago
CVE-2026-47666	7.6	—	—	—	—	Penpot is an open-source design and prototyping platform.	48d ago
CVE-2026-77368	7.6	—	—	—	—	SeaweedFS is a distributed storage system for files and blobs.	48d ago
CVE-2026-79938	7.6	—	—	—	dell / powerprotect cyber recovery	Dell PowerProtect Cyber Recovery, versions prior to 20.3, contain an Improper Authentication vulnerability.	48d ago
CVE-2026-29988	7.6	—	—	—	—	A cleartext transmission of sensitive information vulnerability in the NFC interface of multiple Milesight IoT dev	48d ago
CVE-2026-80186	7.6	—	—	—	—	A stack-based buffer overflow vulnerability exists in BlueZ, the Linux Bluetooth protocol stack.	49d ago
CVE-2026-55532	7.6	—	—	—	—	PraisonAI is a multi-agent teams system.	49d ago
CVE-2026-69104	7.6	—	—	—	—	An authenticated user may initiate repository migration operations without required repository permissions, potent	49d ago
CVE-2026-79667	7.6	—	—	—	—	Ech0 version 4.3.4 and earlier fails to reliably enforce scoped access token (least-privilege) restrictions on sev	49d ago
CVE-2026-78270	7.6	—	—	—	—	Author SQL Injection in FluentCRM Pro <= 3.1.12 versions.	50d ago
CVE-2026-74011	7.6	—	—	—	—	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in revmakx Infi	54d ago
CVE-2026-77077	7.6	—	—	—	n8n / n8n	n8n versions before 1.123.69, 2.33.4, and 2.34.1 contain a JavaScript task runner VM sandbox escape.	54d ago
CVE-2026-77072	7.6	—	—	—	n8n / n8n	n8n before 1.123.69, 2.33.4, and 2.34.1 contains a stored cross-site scripting vulnerability in the Form node's co	54d ago
CVE-2026-66677	7.6	—	—	—	—	Subscriber Broken Authentication in Leyka <= 3.32.3 versions.	54d ago
CVE-2026-76357	7.6	—	—	—	splunk / soar	In Splunk SOAR versions below 8.6.0, an authenticated user with no role assigned could submit a crafted file path	55d ago
CVE-2026-68900	7.6	—	—	—	—	Wekan is open source kanban built with Meteor.	55d ago
CVE-2026-16828	7.6	—	—	—	ibm / power system e1080 \(9080-hex\) firmware	IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 throu	55d ago
CVE-2024-13942	7.6	—	—	—	—	Secure BootROM of RK3588s SoC is vulnerable to a time-of-check to time-of-use attack in case of booting from exter	55d ago
CVE-2026-53958	7.6	—	—	—	—	4gaBoards is a boards system for realtime project management.	56d ago
CVE-2026-71048	7.6	—	—	—	—	Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply Chain (component: Installation Is	56d ago
CVE-2026-71027	7.6	—	—	—	oracle / commerce experience manager	Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce	56d ago
CVE-2026-71022	7.6	—	—	—	oracle / commerce experience manager	Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce	56d ago
CVE-2026-71021	7.6	—	—	—	oracle / commerce experience manager	Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce	56d ago
CVE-2026-71020	7.6	—	—	—	oracle / commerce experience manager	Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce	56d ago
CVE-2026-70960	7.6	—	—	—	oracle / hyperion financial management	Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security).	56d ago
CVE-2026-70864	7.6	—	—	—	oracle / application testing suite	Vulnerability in Oracle Application Testing Suite.	56d ago
CVE-2026-70803	7.6	—	—	—	oracle / general ledger	Vulnerability in the Oracle General Ledger product of Oracle E-Business Suite (component: Internal Operations).	56d ago
CVE-2026-70791	7.6	—	—	—	oracle / transportation execution	Vulnerability in the Oracle Transportation Execution product of Oracle E-Business Suite (component: Internal Opera	56d ago
CVE-2026-70786	7.6	—	—	—	oracle / service fulfillment manager	Vulnerability in the Oracle Service Fulfillment Manager product of Oracle E-Business Suite (component: Fulfillment	56d ago
CVE-2026-70764	7.6	—	—	—	oracle / general ledger	Vulnerability in the Oracle General Ledger product of Oracle E-Business Suite (component: Internal Operations).	56d ago
CVE-2026-70725	7.6	—	—	—	oracle / advanced inbound telephony	Vulnerability in the Oracle Advanced Inbound Telephony product of Oracle E-Business Suite (component: Internal Ope	56d ago
CVE-2026-70678	7.6	—	—	—	oracle / hyperion calculation manager	Vulnerability in the Oracle Hyperion Calculation Manager product of Oracle Hyperion (component: Security).	56d ago
CVE-2026-61296	7.6	—	—	—	oracle / enterprise asset management	Vulnerability in the Oracle Enterprise Asset Management product of Oracle E-Business Suite (component: Linear Asse	56d ago
CVE-2026-61227	7.6	—	—	—	oracle / webcenter portal	Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools).	56d ago
CVE-2026-61208	7.6	—	—	—	oracle / webcenter portal	Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools).	56d ago
CVE-2026-60909	7.6	—	—	—	oracle / webcenter content	Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).	56d ago
CVE-2026-60748	7.6	—	—	—	oracle / general ledger	Vulnerability in the Oracle General Ledger product of Oracle E-Business Suite (component: Internal Operations).	56d ago
CVE-2026-49223	7.6	—	—	—	—	Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores.	56d ago
CVE-2026-49222	7.6	—	—	—	—	Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores.	56d ago
CVE-2026-49227	7.6	—	—	—	—	Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores.	56d ago
CVE-2026-69189	7.6	—	—	—	—	Hoppscotch is an open source API development ecosystem.	56d ago
CVE-2026-75831	7.6	—	—	—	—	Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the audio and video media rendering thr	56d ago
CVE-2026-65822	7.6	—	—	—	—	ERPNext is a free and open source Enterprise Resource Planning tool.	57d ago
CVE-2026-72825	7.6	—	—	—	—	The getgrav/grav-plugin-api plugin before 1.0.13 contains an API-key scope cap bypass in the POST /reports/twig-co	60d ago
CVE-2026-73408	7.6	—	—	—	—	Budibase is an open-source low-code platform.	61d ago
CVE-2026-72853	7.6	—	—	—	—	Budibase before 3.40.0 contains a SQL injection vulnerability in the Oracle datasource connector's post-write row	61d ago
CVE-2026-72669	7.6	—	—	—	elastic / kibana	The state that Kibana stores for an Observability Onboarding flow is not bound to the user who created the flow, a	61d ago
CVE-2026-16961	7.6	—	—	—	ibm / i	IBM i 7.6, 7.5, and 7.4 s vulnerable to SQL injection.	61d ago
CVE-2026-73509	7.6	—	—	—	—	OpenList a file list program that supports multiple storage.	61d ago
CVE-2026-73346	7.6	—	—	—	—	Administrator SQL Injection in MailChimp For WooCommerce < 6.2 versions.	61d ago
CVE-2026-73326	7.6	—	—	—	—	CamaleonCMS contains a missing authorization vulnerability that allows any authenticated low-privileged user to ac	62d ago
CVE-2026-17111	7.6	—	—	—	ibm / i	IBM i 7.6, 7.5, 7.4, and 7.3 s vulnerable to SQL injection.	62d ago
CVE-2026-16907	7.6	—	—	—	ibm / i	IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code due to improper	62d ago

Sources: NIST National Vulnerability Database (descriptions, CVSS, CPE); CISA KEV, ENISA EUVD, CIRCL and VulnCheck (exploitation status, three catalogues counted; CIRCL shown as an aggregator); FIRST EPSS (exploitation probability). Patch window is the gap between CVE publication and the earliest KEV listing, so a negative value means a catalogue called it exploited before it was disclosed. Data refreshes every five hours.

Loading

CVE Tracker