CVE Tracker: vulnerabilities by vendor, severity and exploitation status

CVE Tracker

21,446 records

Every published CVE from the last 120 days with CVSS score, vendor and product, cross-referenced against CISA's Known Exploited Vulnerabilities catalog. 5 added to KEV in the last 7 days.

SeverityAll critical high medium lowExploitedIn CISA KEV

CVE	CVSS	EPSS	KEV sources	Patch window	Vendor / product	Summary	Published
CVE-2026-60598	7.5	—	—	—	oracle / peoplesoft enterprise campus software campus community	Vulnerability in the PeopleSoft Enterprise CS Student Records product of Oracle PeopleSoft (component: Research Tr	82d ago
CVE-2026-60593	7.5	—	—	—	oracle / peoplesoft enterprise fin staffing front office	Vulnerability in the PeopleSoft Enterprise FIN Staffing Front Office product of Oracle PeopleSoft (component: Staf	82d ago
CVE-2026-60581	7.5	—	—	—	oracle / enterprise command center framework	Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite (component: Cor	82d ago
CVE-2026-60554	7.5	—	—	—	oracle / webcenter sites	Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites).	82d ago
CVE-2026-60498	7.5	—	—	—	oracle / jd edwards enterpriseone human resources management	Vulnerability in the JD Edwards EnterpriseOne Human Resources Management product of Oracle JD Edwards (component:	82d ago
CVE-2026-60497	7.5	—	—	—	oracle / jd edwards enterpriseone crm foundation	Vulnerability in the JD Edwards EnterpriseOne CRM Foundation product of Oracle JD Edwards (component: CRM Foundati	82d ago
CVE-2026-60496	7.5	—	—	—	oracle / jd edwards enterpriseone advanced pricing - procurement	Vulnerability in the JD Edwards EnterpriseOne Advanced Pricing - Procurement product of Oracle JD Edwards (compone	82d ago
CVE-2026-60495	7.5	—	—	—	oracle / jd edwards enterpriseone requirements planning	Vulnerability in the JD Edwards EnterpriseOne Requirements Planning product of Oracle JD Edwards (component: Requi	82d ago
CVE-2026-60467	7.5	—	—	—	oracle / webcenter content	Vulnerability in the WebCenter Content: Imaging product of Oracle Fusion Middleware (component: Core).	82d ago
CVE-2026-60436	7.5	—	—	—	oracle / unified directory	Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD Core).	82d ago
CVE-2026-60425	7.5	—	—	—	oracle / unified directory	Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD Core).	82d ago
CVE-2026-60382	7.5	—	—	—	oracle / service delivery platform	Vulnerability in the Service Delivery Platform product of Oracle Fusion Middleware (component: Messaging Enabler).	82d ago
CVE-2026-60320	7.5	—	—	—	oracle / data integrator	Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Patchset Assistant).	82d ago
CVE-2026-60314	7.5	—	—	—	oracle / mysql router	Vulnerability in the MySQL Router product of Oracle MySQL (component: Router: General).	82d ago
CVE-2026-60301	7.5	—	—	—	oracle / coherence	Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core).	82d ago
CVE-2026-60263	7.5	—	—	—	oracle / coherence	Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core).	82d ago
CVE-2026-60252	7.5	—	—	—	oracle / coherence	Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core).	82d ago
CVE-2026-60223	7.5	—	—	—	oracle / coherence	Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core).	82d ago
CVE-2026-60180	7.5	—	—	—	oracle / mysql connector\/c\+\+	Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/C++).	82d ago
CVE-2026-60170	7.5	—	—	—	oracle / hospitality simphony	Vulnerability in the Oracle Hospitality Simphony product of Oracle Food and Beverage Applications (component: POS)	82d ago
CVE-2026-60167	7.5	—	—	—	oracle / hospitality simphony	Vulnerability in the Oracle Hospitality Simphony product of Oracle Food and Beverage Applications (component: POS)	82d ago
CVE-2026-60159	7.5	—	—	—	oracle / vm virtualbox	Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).	82d ago
CVE-2026-60155	7.5	—	—	—	oracle / vm virtualbox	Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).	82d ago
CVE-2026-56816	7.5	—	—	—	netty / netty	Netty is a network application framework for development of protocol servers and clients.	82d ago
CVE-2026-56745	7.5	—	—	—	netty / netty	Netty is a network application framework for development of protocol servers and clients.	82d ago
CVE-2026-55851	7.5	—	—	—	netty / netty	Netty is a network application framework for development of protocol servers and clients.	82d ago
CVE-2026-47247	7.5	—	—	—	struktur / libheif	libheif is a HEIF and AVIF file format decoder and encoder.	82d ago
CVE-2026-47063	7.5	—	—	—	oracle / jre	Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle J	82d ago
CVE-2026-47057	7.5	—	—	—	oracle / jre	Vulnerability in Oracle Java SE (component: Scripting).	82d ago
CVE-2026-47018	7.5	—	—	—	oracle / siebel crm	Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager).	82d ago
CVE-2026-46941	7.5	—	—	—	oracle / cost management	Vulnerability in the Oracle Cost Management product of Oracle E-Business Suite (component: Cost Maintenance).	82d ago
CVE-2026-35287	7.5	—	—	—	oracle / application testing suite	Vulnerability in Oracle Application Testing Suite.	82d ago
CVE-2026-52476	7.5	—	—	—	—	SQL Injection vulnerability in aiflowy <= 2.1.2 allows a remote attacker to obtain sensitive information via the g	82d ago
CVE-2026-52474	7.5	—	—	—	—	An issue in aiflowy <= 2.1.2 allows a remote attacker to obtain sensitive information via the JobUtil.java file.	82d ago
CVE-2026-47690	7.5	—	—	—	—	MeltanoHub is the source code for hub.meltano.com, the central place for Meltano plugins.	82d ago
CVE-2026-30633exploited	7.5	0.89%	1/3	+65d	—	Directory traversal vulnerability in knowns-dev/knowns 0.11.4 via crafted path value to the get_doc and update_doc	82d ago
CVE-2026-56852	7.5	—	—	—	—	A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.	82d ago
CVE-2026-50759	7.5	—	—	—	—	An issue in exo-explore exo 1.0.69 allows a remote attacker to escalate privileges via the GET /state and DELETE /	82d ago
CVE-2026-50756	7.5	—	—	—	—	An issue in DayuanJiang next-ai-draw-io 0.4.13 allows a remote attacker to obtain sensitive information via the x-	82d ago
CVE-2026-47667	7.5	—	—	—	—	CImg Library is a C++ library for image processing.	82d ago
CVE-2026-46600	7.5	—	—	—	—	Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.	82d ago
CVE-2026-30632	7.5	—	—	—	—	Directory traversal vulnerability in knowns-dev/knowns 0.11.4 via crafted folder name value to the create_doc tool	82d ago
CVE-2026-15957	7.5	—	—	—	—	Smithy-RS is a Rust code generation and runtime framework that generates HTTP clients and servers from Smithy inte	82d ago
CVE-2026-21579	7.5	—	—	—	atlassian / confluence data center	This High severity Information Disclosure vulnerability was introduced in versions 7.17.0, 7.19.0, 8.5.0, 8.9.0, 9	82d ago
CVE-2026-16243	7.5	—	—	—	eclipse / omr	In Eclipse OMR versions up to 0.11, the arraycmp SIMD implementation for Z and P does not check if the number of b	82d ago
CVE-2026-44907	7.5	—	—	—	—	A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function	82d ago
CVE-2026-15793	7.5	—	—	—	mobyproject / buildkit	BuildKit custom frontends or clients using the raw low-level API can set git.checkoutbundle=true when checking out	82d ago
CVE-2026-15792	7.5	—	—	—	mobyproject / buildkit	A malicious BuildKit client or frontend could craft a request that could lead to BuildKit daemon crashing with a p	82d ago
CVE-2026-15791	7.5	—	—	—	mobyproject / buildkit	A crafted message in the BuildKit low-level build API can be used to remove the contents of the /tmp directory.	82d ago
CVE-2026-15789	7.5	—	—	—	mobyproject / buildkit	A custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-	82d ago
CVE-2026-65052	7.5	—	—	—	—	Ninja Forms WordPress plugin version 3.14.8 and prior contains an improper input validation vulnerability that all	82d ago
CVE-2026-16445	7.5	—	—	—	—	A flaw was found in dracut.	82d ago
CVE-2026-16409	7.5	—	—	—	mozilla / firefox	Invalid pointer in the Security: PSM component.	82d ago
CVE-2026-16405	7.5	—	—	—	mozilla / firefox	Information disclosure in the Networking: WebSockets component.	82d ago
CVE-2026-16400	7.5	—	—	—	mozilla / firefox	Information disclosure in the DOM: Security component.	82d ago
CVE-2026-16399	7.5	—	—	—	mozilla / firefox	Site isolation issue in the DOM: Navigation component.	82d ago
CVE-2026-16398	7.5	—	—	—	mozilla / firefox	Site isolation issue in the Graphics component.	82d ago
CVE-2026-16391	7.5	—	—	—	mozilla / firefox	Information disclosure in the Storage: IndexedDB component.	82d ago
CVE-2026-16386	7.5	—	—	—	mozilla / firefox	Information disclosure due to uninitialized memory in the Graphics: WebGPU component.	82d ago
CVE-2026-16385	7.5	—	—	—	mozilla / firefox	Information disclosure due to uninitialized memory in the Graphics: WebGPU component.	82d ago

Sources: NIST National Vulnerability Database (descriptions, CVSS, CPE); CISA KEV, ENISA EUVD, CIRCL and VulnCheck (exploitation status, three catalogues counted; CIRCL shown as an aggregator); FIRST EPSS (exploitation probability). Patch window is the gap between CVE publication and the earliest KEV listing, so a negative value means a catalogue called it exploited before it was disclosed. Data refreshes every five hours.

Loading

CVE Tracker