CVE Tracker: vulnerabilities by vendor, severity and exploitation status

CVE Tracker

21,446 records

Every published CVE from the last 120 days with CVSS score, vendor and product, cross-referenced against CISA's Known Exploited Vulnerabilities catalog. 6 added to KEV in the last 7 days.

SeverityAll critical high medium lowExploitedIn CISA KEV

CVE	CVSS	EPSS	KEV sources	Patch window	Vendor / product	Summary	Published
CVE-2026-12476	7.2	—	—	—	—	The Easy Digital Downloads plugin for WordPress is vulnerable to Arbitrary File Upload in versions up to and inclu	72d ago
CVE-2026-54605	7.2	—	—	—	—	OAuth is a Ruby wrapper for the OAuth 1.0 and 1.0a protocols, providing clients and servers.	73d ago
CVE-2026-13440	7.2	—	—	—	—	The StoreGrowth: Smart Sales Booster for WooCommerce \| BOGO, Upsells, Direct Checkout, Quick View, Side Cart plugi	73d ago
CVE-2026-61376	7.2	—	—	—	—	ELECOM wireless LAN routers and access points devices contain an OS Command Injection vulnerability in Restore Set	73d ago
CVE-2026-59764	7.2	—	—	—	—	ELECOM wireless LAN routers and access points devices contain an OS Command Injection vulnerability in WebUI.	73d ago
CVE-2026-16585	7.2	—	—	—	—	The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable t	73d ago
CVE-2026-65442exploited	7.2	0.58%	1/3	+7d	—	Unauthenticated Server Side Request Forgery (SSRF) in FormCraft <= 3.9.15 versions.	73d ago
CVE-2026-61953	7.2	—	—	—	—	Unauthenticated Server Side Request Forgery (SSRF) in Simple Link Directory Pro <= 15.0.6 versions.	73d ago
CVE-2026-66015	7.2	—	—	—	jfrog / artifactory	An authenticated privilege-escalation vulnerability in JFrog Platform may be exploited under admin-provisioned acc	74d ago
CVE-2026-59552	7.2	—	—	—	—	Unauthenticated Server Side Request Forgery (SSRF) in 3D Flipbook PDF Viewer & Embedder <= 1.4.2 versions.	74d ago
CVE-2026-65711	7.2	—	—	—	—	sysPass through version 3.2.11 contains an OS command injection vulnerability that allows authenticated administra	77d ago
CVE-2026-65693	7.2	—	—	—	—	Microweber CMS through 2.0.20 contains a server-side template injection vulnerability that allows authenticated ad	77d ago
CVE-2026-15401	7.2	—	—	—	—	The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via th	77d ago
CVE-2026-66138	7.2	—	—	—	—	In OpenStack Ironic Python Agent through 11.6.0, a project-scoped user with the manager role can achieve arbitrary	77d ago
CVE-2026-65898	7.2	—	—	—	cure53 / dompurify	DOMPurify before 3.4.11 fails to clone the ALLOWED_ATTR allowlist when setConfig() is used with an uponSanitizeAtt	78d ago
CVE-2026-65516	7.2	—	—	—	—	Unauthenticated Server Side Request Forgery (SSRF) in PeproDev Ultimate Invoice <= 2.2.6 versions.	78d ago
CVE-2026-65497	7.2	—	—	—	—	Administrator PHP Object Injection in Complianz <= 7.5.0 versions.	78d ago
CVE-2026-12421	7.2	—	—	—	—	The ARforms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'password' Field Values in all v	78d ago
CVE-2026-7534	7.2	—	—	—	—	The SUMO Reward Points plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via the RE	78d ago
CVE-2026-7232	7.2	—	—	—	—	The FormCraft plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '[parameter name]' paramete	78d ago
CVE-2026-40714	7.2	—	—	—	dell / powerprotect data manager	Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contain(s) an Improper Input Validation vulnerability.	79d ago
CVE-2026-61391	7.2	—	—	—	—	There is a stack-based buffer overflow vulnerability in some Hikvision cameras, which may allow authenticated atta	79d ago
CVE-2026-62548	7.2	—	—	—	oracle / human resources management system	Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: Internal Operations).	80d ago
CVE-2026-62466	7.2	—	—	—	oracle / human resources	Vulnerability in the Oracle Human Resources product of Oracle E-Business Suite (component: Data Removal Tool).	80d ago
CVE-2026-61336	7.2	—	—	—	oracle / lease and finance management	Vulnerability in the Oracle Lease and Finance Management product of Oracle E-Business Suite (component: Internal O	80d ago
CVE-2026-61314	7.2	—	—	—	oracle / e-business suite	Vulnerability in the Oracle EDI Gateway product of Oracle E-Business Suite (component: All Miscellaneous EDI Issue	80d ago
CVE-2026-61285	7.2	—	—	—	oracle / process manufacturing systems	Vulnerability in the Oracle Process Manufacturing Systems product of Oracle E-Business Suite (component: Internal	80d ago
CVE-2026-61115	7.2	—	—	—	oracle / order management	Vulnerability in the Oracle Order Management product of Oracle E-Business Suite (component: Product Diagnostic Too	80d ago
CVE-2026-61107	7.2	—	—	—	oracle / applications dba	Vulnerability in the Oracle Applications DBA product of Oracle E-Business Suite (component: Internal Operations).	80d ago
CVE-2026-61094	7.2	—	—	—	oracle / mysql server	Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).	80d ago
CVE-2026-61068	7.2	—	—	—	oracle / peoplesoft enterprise fin billing argentina	Vulnerability in the PeopleSoft Enterprise FIN Billing Argentina product of Oracle PeopleSoft (component: Billing)	80d ago
CVE-2026-61039	7.2	—	—	—	oracle / advanced supply chain planning	Vulnerability in the Oracle Advanced Supply Chain Planning product of Oracle E-Business Suite (component: Core).	80d ago
CVE-2026-61035	7.2	—	—	—	oracle / e-business suite	Vulnerability in the Oracle Financials for the Americas product of Oracle E-Business Suite (component: Internal Op	80d ago
CVE-2026-61027	7.2	—	—	—	oracle / cost management	Vulnerability in the Oracle Cost Management product of Oracle E-Business Suite (component: Inventory Costing).	80d ago
CVE-2026-61025	7.2	—	—	—	oracle / irecruitment	Vulnerability in the Oracle iRecruitment product of Oracle E-Business Suite (component: Internal Operations).	80d ago
CVE-2026-61006	7.2	—	—	—	oracle / e-business suite	Vulnerability in the Oracle Process Manufacturing Logistics product of Oracle E-Business Suite (component: Interna	80d ago
CVE-2026-60926	7.2	—	—	—	oracle / e-business suite	Vulnerability in the Oracle Public Sector Payroll product of Oracle E-Business Suite (component: Internal Operatio	80d ago
CVE-2026-60925	7.2	—	—	—	oracle / e-business suite	Vulnerability in the Oracle Public Sector Payroll product of Oracle E-Business Suite (component: Internal Operatio	80d ago
CVE-2026-60918	7.2	—	—	—	oracle / shipping execution	Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (component: Internal Operations)	80d ago
CVE-2026-60910	7.2	—	—	—	oracle / property manager	Vulnerability in the Oracle Property Manager product of Oracle E-Business Suite (component: Internal Operations).	80d ago
CVE-2026-60900	7.2	—	—	—	oracle / human capital management configuration workbench	Vulnerability in the Oracle HCM Configuration Workbench product of Oracle E-Business Suite (component: Rapid Imple	80d ago
CVE-2026-60845	7.2	—	—	—	oracle / e-business suite	Vulnerability in the Oracle Mobile Application Server product of Oracle E-Business Suite (component: MWA General B	80d ago
CVE-2026-60836	7.2	—	—	—	oracle / hcm common architecture	Vulnerability in the Oracle HCM Common Architecture product of Oracle E-Business Suite (component: Internal Operat	80d ago
CVE-2026-60828	7.2	—	—	—	oracle / interaction blending	Vulnerability in the Oracle Interaction Blending product of Oracle E-Business Suite (component: Internal Operation	80d ago
CVE-2026-60813	7.2	—	—	—	oracle / istore	Vulnerability in the Oracle iStore product of Oracle E-Business Suite (component: Shopping Cart).	80d ago
CVE-2026-60787	7.2	—	—	—	oracle / receivables	Vulnerability in the Oracle Receivables product of Oracle E-Business Suite (component: Internal Operations).	80d ago
CVE-2026-60786	7.2	—	—	—	oracle / receivables	Vulnerability in the Oracle Receivables product of Oracle E-Business Suite (component: Internal Operations).	80d ago
CVE-2026-60755	7.2	—	—	—	oracle / e-business suite	Vulnerability in the Oracle Assets product of Oracle E-Business Suite (component: Internal Operations).	80d ago
CVE-2026-60734	7.2	—	—	—	oracle / trading community	Vulnerability in the Oracle Trading Community product of Oracle E-Business Suite (component: Party Search UI).	80d ago
CVE-2026-60645	7.2	—	—	—	oracle / webcenter content	Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Web Content Manageme	80d ago
CVE-2026-60576	7.2	—	—	—	oracle / enterprise command center framework	Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite (component: Cor	80d ago
CVE-2026-60546	7.2	—	—	—	oracle / soa suite	Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Integration Business Insight	80d ago
CVE-2026-60529	7.2	—	—	—	oracle / weblogic server	Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console).	80d ago
CVE-2026-60519	7.2	—	—	—	oracle / unified directory	Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD Core).	80d ago
CVE-2026-60502	7.2	—	—	—	oracle / webcenter content	Vulnerability in the WebCenter Content: Imaging product of Oracle Fusion Middleware (component: Core).	80d ago
CVE-2026-60466	7.2	—	—	—	oracle / webcenter content	Vulnerability in the WebCenter Content: Imaging product of Oracle Fusion Middleware (component: Core).	80d ago
CVE-2026-60418	7.2	—	—	—	oracle / unified directory	Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD Core).	80d ago
CVE-2026-60396	7.2	—	—	—	oracle / goldengate	Vulnerability in Oracle GoldenGate (component: Distribution Server executable).	80d ago
CVE-2026-60345	7.2	—	—	—	oracle / jdeveloper	Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: ADF Shared Components).	80d ago
CVE-2026-60340	7.2	—	—	—	oracle / e-business suite	Vulnerability in the Oracle Project Costing product of Oracle E-Business Suite (component: Enterprise Command Cent	80d ago

Sources: NIST National Vulnerability Database (descriptions, CVSS, CPE); CISA KEV, ENISA EUVD, CIRCL and VulnCheck (exploitation status, three catalogues counted; CIRCL shown as an aggregator); FIRST EPSS (exploitation probability). Patch window is the gap between CVE publication and the earliest KEV listing, so a negative value means a catalogue called it exploited before it was disclosed. Data refreshes every five hours.

Loading

CVE Tracker