CVE Tracker: vulnerabilities by vendor, severity and exploitation status

CVE Tracker

15,513 records

Every published CVE from the last 120 days with CVSS score, vendor and product, cross-referenced against CISA's Known Exploited Vulnerabilities catalog. 10 added to KEV in the last 7 days.

SeverityAll critical high medium lowExploitedIn CISA KEV

CVE	CVSS	EPSS	KEV sources	Patch window	Vendor / product	Summary	Published
CVE-2026-57674	7.1	—	—	—	—	Unauthenticated Cross Site Scripting (XSS) in Timetics <= 1.0.58 versions.	65d ago
CVE-2026-57673	7.1	—	—	—	—	Unauthenticated Cross Site Scripting (XSS) in Optimole <= 4.2.7 versions.	65d ago
CVE-2026-57672	7.1	—	—	—	—	Unauthenticated Cross Site Scripting (XSS) in wpDataTables <= 6.5.1.1 versions.	65d ago
CVE-2026-57671	7.1	—	—	—	—	Unauthenticated Cross Site Scripting (XSS) in perfmatters <= 2.6.4 versions.	65d ago
CVE-2026-57670	7.1	—	—	—	—	Unauthenticated Cross Site Scripting (XSS) in Google Maps CP <= 1.2.5 versions.	65d ago
CVE-2026-57426	7.1	—	—	—	—	Unauthenticated Cross Site Scripting (XSS) in Modula - PRO <= 2.10.8 versions.	65d ago
CVE-2026-57366	7.1	—	—	—	—	Unauthenticated Cross Site Scripting (XSS) in WPAdverts <= 2.3.1 versions.	65d ago
CVE-2026-57362	7.1	—	—	—	—	Unauthenticated Cross Site Scripting (XSS) in ChatBot <= 8.3.2 versions.	65d ago
CVE-2026-57361	7.1	—	—	—	—	Unauthenticated Cross Site Scripting (XSS) in Survey Maker <= 5.2.2.5 versions.	65d ago
CVE-2026-57360	7.1	—	—	—	—	Unauthenticated Cross Site Scripting (XSS) in eCommerce Product Catalog <= 3.5.4 versions.	65d ago
CVE-2026-57359	7.1	—	—	—	—	Unauthenticated Cross Site Scripting (XSS) in ReviewX <= 2.3.10 versions.	65d ago
CVE-2026-57358	7.1	—	—	—	—	Unauthenticated Cross Site Scripting (XSS) in Customize My Account for WooCommerce <= 4.3.9 versions.	65d ago
CVE-2026-57357	7.1	—	—	—	—	Unauthenticated Cross Site Scripting (XSS) in Search Atlas SEO <= 2.6.6 versions.	65d ago
CVE-2026-57356	7.1	—	—	—	—	Unauthenticated Cross Site Scripting (XSS) in MC Woocommerce Wishlist <= 1.9.19 versions.	65d ago
CVE-2026-57351	7.1	—	—	—	—	Unauthenticated Cross Site Scripting (XSS) in HandL UTM Grabber <= 2.9.2 versions.	65d ago
CVE-2026-57350	7.1	—	—	—	—	Unauthenticated Cross Site Scripting (XSS) in WP Debugging <= 2.12.2 versions.	65d ago
CVE-2026-57349	7.1	—	—	—	—	Unauthenticated Cross Site Scripting (XSS) in WPeMatico RSS Feed Fetcher <= 2.8.17 versions.	65d ago
CVE-2026-57345	7.1	—	—	—	—	Unauthenticated Cross Site Scripting (XSS) in Internal Links Manager <= 3.0.3 versions.	65d ago
CVE-2026-57344	7.1	—	—	—	—	Unauthenticated Cross Site Scripting (XSS) in Classified Listing <= 5.4.2 versions.	65d ago
CVE-2026-57343	7.1	—	—	—	—	Unauthenticated Cross Site Scripting (XSS) in Real Estate 7 <= 3.5.9 versions.	65d ago
CVE-2026-27430	7.1	—	—	—	—	Unauthenticated Cross Site Scripting (XSS) in TheFox <= 3.9.76 versions.	65d ago
CVE-2026-27426	7.1	—	—	—	—	Unauthenticated Cross Site Scripting (XSS) in Automotive Car Dealership Business <= 13.3.3 versions.	65d ago
CVE-2026-27425	7.1	—	—	—	—	Unauthenticated Cross Site Scripting (XSS) in Automotive Listings <= 18.6 versions.	65d ago
CVE-2026-27408	7.1	—	—	—	—	Unauthenticated Cross Site Scripting (XSS) in NativeChurch <= 4.8.8.2 versions.	65d ago
CVE-2026-27404	7.1	—	—	—	—	Unauthenticated Cross Site Scripting (XSS) in LMS <= 9.7 versions.	65d ago
CVE-2026-27402	7.1	—	—	—	—	Unauthenticated Cross Site Scripting (XSS) in Kids Life \| Children School WordPress <= 5.2 versions.	65d ago
CVE-2025-69156	7.1	—	—	—	—	Unauthenticated Cross Site Scripting (XSS) in Kids Zone - Children WordPress Theme <= 5.4 versions.	65d ago
CVE-2025-69155	7.1	—	—	—	—	Unauthenticated Cross Site Scripting (XSS) in Fitness Zone WordPress Theme <= 5.7 versions.	65d ago
CVE-2025-69154	7.1	—	—	—	—	Unauthenticated Cross Site Scripting (XSS) in SpaLab \| Beauty Salon WordPress Theme <= 6.7 versions.	65d ago
CVE-2025-69153	7.1	—	—	—	—	Unauthenticated Cross Site Scripting (XSS) in Trendy Travel <= 6.7 versions.	65d ago
CVE-2025-69152	7.1	—	—	—	—	Unauthenticated Cross Site Scripting (XSS) in Artale \| Wedding Photography WordPress <= 2.2.2 versions.	65d ago
CVE-2026-55153	7.1	—	—	—	—	mchange-commons-java is a Java library of shared utility classes used by mchange projects like the c3p0 connection	66d ago
CVE-2026-53346	7.1	—	—	—	linux / linux kernel	In the Linux kernel, the following vulnerability has been resolved: rust: arm64: set uwtable llvm module flag for	66d ago
CVE-2026-53330	7.1	—	—	—	linux / linux kernel	In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix out-of-bounds read in dp_	66d ago
CVE-2026-53905	7.1	—	—	—	mycomplianceoffice / mycomplianceoffice	MCO does not properly enforce authorization checks in the /customer/servlet/mco/webapi/admin-view-hierarchy/get-ac	66d ago
CVE-2026-53904	7.1	—	—	—	mycomplianceoffice / mco	MCO is vulnerable to Account Denial of Service due to improper implementation of password reset functionality.	66d ago
CVE-2026-56320	7.1	—	—	—	—	Capgo before 12.128.2 contains an authorization flaw in POST /private/create_device that accepts a caller-supplied	67d ago
CVE-2026-11546	7.1	—	—	—	ibm / websphere application server	IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is affected by a server-side request forgery	67d ago
CVE-2026-10546	7.1	—	—	—	langflow / langflow	IBM Langflow OSS 1.0.0 through 1.9.3 contains a Server-Side Request Forgery (SSRF) vulnerability in the URL compon	67d ago
CVE-2026-43725	7.1	—	—	—	apple / safari	The issue was addressed with improved input validation.	68d ago
CVE-2026-43701	7.1	—	—	—	apple / safari	The issue was addressed with improved checks.	68d ago
CVE-2026-57338	7.1	—	—	—	—	Unauthenticated Cross Site Scripting (XSS) in ARForms <= 7.1.2 versions.	68d ago
CVE-2026-57337	7.1	—	—	—	—	Unauthenticated Cross Site Scripting (XSS) in Landing Page Builder <= 1.5.3.5 versions.	68d ago
CVE-2026-57336	7.1	—	—	—	—	Unauthenticated Cross Site Scripting (XSS) in Jobify <= 4.3.2 versions.	68d ago
CVE-2026-57333	7.1	—	—	—	—	Unauthenticated Cross Site Scripting (XSS) in Link Whisper Free <= 0.9.4 versions.	68d ago
CVE-2026-57332	7.1	—	—	—	—	Subscriber Broken Access Control in Wallet System for WooCommerce <= 2.7.6 versions.	68d ago
CVE-2026-57320	7.1	—	—	—	—	Unauthenticated Cross Site Scripting (XSS) in BEAR <= 1.1.8 versions.	68d ago
CVE-2026-54371	7.1	—	—	—	—	attr before version 2.6.0 contains a symlink traversal vulnerability in the getfattr and setfattr utilities that a	68d ago
CVE-2026-54369	7.1	—	—	—	—	acl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions acl_get	68d ago
CVE-2026-40522	7.1	—	—	—	—	FrontAccounting before 2.4.20 contains a SQL injection vulnerability in the Bank Statement report handler that all	68d ago
CVE-2026-57346	7.1	—	—	—	—	Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Epiphyt Embed Priv	68d ago
CVE-2026-13601	7.1	—	—	—	redhat / enterprise linux	A flaw was found in Yelp due to an overly permissive Content Security Policy (CSP) implementation provided by yelp	68d ago
CVE-2026-49413	7.1	—	—	—	freebsd / freebsd	The Linuxulator determined whether a binary was set-user-ID or set-group-ID by checking the P_SUGID process flag.	71d ago
CVE-2026-33560	7.1	—	—	—	daktronics / dmp-5000 firmware	The DMP-5000 file service exposes authenticated arbitrary file upload functionality.	71d ago
CVE-2026-53303	7.1	—	—	—	linux / linux kernel	In the Linux kernel, the following vulnerability has been resolved: f2fs: protect extension_list reading with sb_l	71d ago
CVE-2026-47214	7.1	—	—	—	docling / docling	Docling simplifies document processing by parsing diverse formats and providing integrations with the generative A	71d ago
CVE-2026-57325	7.1	—	—	—	—	Unauthenticated Cross Site Scripting (XSS) in NanoMag <= 1.8 versions.	71d ago
CVE-2026-57322	7.1	—	—	—	—	Unauthenticated Cross Site Scripting (XSS) in weMail <= 2.1.2 versions.	71d ago
CVE-2026-57321	7.1	—	—	—	—	Contributor Arbitrary File Deletion in H5P <= 1.17.7 versions.	71d ago
CVE-2026-57319	7.1	—	—	—	—	Unauthenticated Cross Site Scripting (XSS) in FOX <= 1.4.8 versions.	71d ago

Sources: NIST National Vulnerability Database (descriptions, CVSS, CPE); CISA KEV, ENISA EUVD, CIRCL and VulnCheck (exploitation status, three catalogues counted; CIRCL shown as an aggregator); FIRST EPSS (exploitation probability). Patch window is the gap between CVE publication and the earliest KEV listing, so a negative value means a catalogue called it exploited before it was disclosed. Data refreshes every five hours.

Loading

CVE Tracker