CVE Tracker: vulnerabilities by vendor, severity and exploitation status

CVE Tracker

21,446 records

Every published CVE from the last 120 days with CVSS score, vendor and product, cross-referenced against CISA's Known Exploited Vulnerabilities catalog. 5 added to KEV in the last 7 days.

SeverityAll critical high medium lowExploitedIn CISA KEV

CVE	CVSS	EPSS	KEV sources	Patch window	Vendor / product	Summary	Published
CVE-2026-62545	7.5	—	—	—	oracle / hyperion infrastructure technology	Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Installation	55d ago
CVE-2026-62481	7.5	—	—	—	oracle / hyperion infrastructure technology	Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Common Event	55d ago
CVE-2026-61007	7.5	—	—	—	oracle / webcenter sites	Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites).	55d ago
CVE-2026-60993	7.5	—	—	—	oracle / identity manager connector	Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core).	55d ago
CVE-2026-60975	7.5	—	—	—	oracle / peoplesoft enterprise peopletools	Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Security).	55d ago
CVE-2026-60956	7.5	—	—	—	oracle / jd edwards enterpriseone us payroll	Vulnerability in the JD Edwards EnterpriseOne US Payroll product of Oracle JD Edwards (component: Payroll).	55d ago
CVE-2026-60914	7.5	—	—	—	oracle / unified directory	Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD Core).	55d ago
CVE-2026-60906	7.5	—	—	—	oracle / webcenter content	Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).	55d ago
CVE-2026-60889	7.5	—	—	—	oracle / unified directory	Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD Core).	55d ago
CVE-2026-60850	7.5	—	—	—	oracle / unified directory	Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD Core).	55d ago
CVE-2026-60808	7.5	—	—	—	oracle / siebel apps - marketing	Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Email Marketing).	55d ago
CVE-2026-60769	7.5	—	—	—	oracle / general ledger	Vulnerability in the Oracle General Ledger product of Oracle E-Business Suite (component: Internal Operations).	55d ago
CVE-2026-60765	7.5	—	—	—	oracle / siebel apps - marketing	Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing).	55d ago
CVE-2026-60679	7.5	—	—	—	oracle / weblogic server	Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).	55d ago
CVE-2026-60590	7.5	—	—	—	oracle / hospitality simphony	Vulnerability in the Oracle Hospitality Simphony product of Oracle Food and Beverage Applications (component: POS)	55d ago
CVE-2026-60393	7.5	—	—	—	oracle / hyperion infrastructure technology	Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Lifecycle Ma	55d ago
CVE-2026-60391	7.5	—	—	—	oracle / hyperion financial management	Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion (component: Server).	55d ago
CVE-2026-75936	7.5	—	—	—	—	Improper handling of highly compressed data in the GZIP auto-decompression handler in Amazon ion-java before 1.12.	55d ago
CVE-2026-75935	7.5	—	—	—	—	Uncontrolled memory allocation in the binary Ion stream cursor in Amazon ion-java before 1.12.0 might allow remote	55d ago
CVE-2026-71676	7.5	—	—	—	—	Buffer Overflow vulnerability in Open5GS v.2.7.0 allows a remote attacker to cause a denial of service via the NAS	55d ago
CVE-2026-71675	7.5	—	—	—	—	An issue in Open5GS v.2.7.0 allows a remote attacker to cause a denial of service via the ngap_send_to_nas() funct	55d ago
CVE-2026-52829	7.5	—	—	—	—	ZEBRA is a Zcash node written entirely in Rust.	55d ago
CVE-2026-52481	7.5	—	—	—	—	An issue in SJRC F11 SJ-GPS-PRO firmware build 2019-09-17 allows a remote attacker to obtain sensitive information	55d ago
CVE-2026-47629	7.5	—	—	—	nvidia / triton inference server	NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause improper input val	55d ago
CVE-2026-47628	7.5	—	—	—	nvidia / triton inference server	NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause an allocation of r	55d ago
CVE-2026-24184	7.5	—	—	—	nvidia / cumulus linux	NVIDIA Cumulus Linux contains a vulnerability in the Link Layer Discovery Protocol (LLDP) daemon component, where	55d ago
CVE-2026-75897	7.5	—	—	—	—	Improper input validation in the capabilities route handler in OpenSearch Dashboards - the size of the request pay	55d ago
CVE-2026-50578	7.5	—	—	—	—	ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany's elec	55d ago
CVE-2026-75915	7.5	—	—	—	—	CodeWhale versions before 0.8.64 contain an environment variable exposure vulnerability in the js_execution tool t	55d ago
CVE-2026-75914	7.5	—	—	—	—	CodeWhale versions before 0.8.64 contain a path traversal vulnerability in the image_analyze tool that fails to ca	55d ago
CVE-2026-75859	7.5	—	—	—	—	CodeWhale versions before 0.8.64 fail to validate file paths in the project config instructions field, allowing at	55d ago
CVE-2026-73337	7.5	—	—	—	joomla / joomla\!	Joomla! Core - [20260807] - MFA Authentication Bypass in Joomla 4.0.0-5.4.7 and 6.0.0-6.1.2 - Insufficient state c	55d ago
CVE-2026-19500	7.5	—	—	—	—	The Entries component in Brainstorm Force SureForms version, less than 2.12.3, does not enforce adequate limits on	55d ago
CVE-2026-73997	7.5	—	—	—	—	Unauthenticated Denial of Service Attack in Starter Templates by Kadence WP <= 2.3.3 versions.	55d ago
CVE-2026-73994	7.5	—	—	—	—	Unauthenticated Broken Access Control in Charitable <= 1.8.11.3 versions.	55d ago
CVE-2026-73377	7.5	—	—	—	—	Unauthenticated Broken Access Control in Ultimate Maps by Supsystic < 1.5.0 versions.	55d ago
CVE-2026-73181	7.5	—	—	—	—	Unauthenticated Arbitrary File Download in Extra Product Options & Add-Ons for WooCommerce < 7.6 versions.	55d ago
CVE-2026-66622	7.5	—	—	—	—	Unauthenticated SQL Injection in Depicter Slider <= 4.8.0 versions.	55d ago
CVE-2026-66046	7.5	—	—	—	—	Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the s	55d ago
CVE-2026-56684	7.5	—	—	—	—	Valkey is a distributed key-value database.	55d ago
CVE-2026-32549	7.5	—	—	—	—	Unauthenticated Broken Access Control in ThumbPress < 6.5 versions.	55d ago
CVE-2026-32481	7.5	—	—	—	—	Unauthenticated Broken Authentication in Ezoic <= 2.22.11 versions.	55d ago
CVE-2026-32472	7.5	—	—	—	—	Unauthenticated Broken Access Control in Online Contact Widget <= 1.3.0 versions.	55d ago
CVE-2026-32468	7.5	—	—	—	—	Unauthenticated Sensitive Data Exposure in Duitku Payment Gateway <= 2.11.14 versions.	55d ago
CVE-2026-28571	7.5	—	—	—	—	Unauthenticated Broken Access Control in FormyChat <= 2.15.7 versions.	55d ago
CVE-2026-28567	7.5	—	—	—	—	Unauthenticated Broken Access Control in WP Sort Order <= 1.3.5 versions.	55d ago
CVE-2026-74982	7.5	—	—	—	mozilla / firefox	Denial-of-service in the Widget component.	55d ago
CVE-2026-74977	7.5	—	—	—	mozilla / firefox	Integer overflow in the Graphics component.	55d ago
CVE-2026-74966	7.5	—	—	—	mozilla / firefox	Information disclosure in the Form Autofill component.	55d ago
CVE-2026-74958	7.5	—	—	—	mozilla / firefox	Information disclosure in the WebRTC component.	55d ago
CVE-2026-74954	7.5	—	—	—	mozilla / firefox	Information disclosure due to side-channel in the Storage: Cache API component.	55d ago
CVE-2026-74934	7.5	—	—	—	mozilla / firefox	Site isolation issue in the Graphics: CanvasWebGL component.	55d ago
CVE-2026-75840	7.5	—	—	—	—	ArcadeDB before 26.8.1 contains an arbitrary file read vulnerability in the GraalVM JavaScript sandbox allowlist e	55d ago
CVE-2026-74906	7.5	—	—	—	—	SiYuan before v3.7.4 contains an incorrect authorization vulnerability in eight publish-mode reader-facing endpoin	55d ago
CVE-2026-74904	7.5	—	—	—	—	SiYuan before v3.7.4 is missing authorization checks in 17 block metadata/content endpoints in kernel/api/block.go	55d ago
CVE-2026-15585	7.5	—	—	—	—	Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in AKIN Software Comp	55d ago
CVE-2026-11801	7.5	—	—	—	—	The WPAdverts – Classifieds Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up t	56d ago
CVE-2026-67918	7.5	—	—	—	—	Directory Traversal vulnerability in hermes-studio v.0.6.26 allows a remote attacker to obtain sensitive informati	56d ago
CVE-2026-65343	7.5	—	—	—	apple / ipados	A use after free issue was addressed with improved memory management.	56d ago
CVE-2026-75482	7.5	—	—	—	—	SWE-agent's trajectory inspector (sweagent inspector), confirmed in v1.1.0, is an HTTP server that joins request p	56d ago

Sources: NIST National Vulnerability Database (descriptions, CVSS, CPE); CISA KEV, ENISA EUVD, CIRCL and VulnCheck (exploitation status, three catalogues counted; CIRCL shown as an aggregator); FIRST EPSS (exploitation probability). Patch window is the gap between CVE publication and the earliest KEV listing, so a negative value means a catalogue called it exploited before it was disclosed. Data refreshes every five hours.

Loading

CVE Tracker