CVE Tracker: vulnerabilities by vendor, severity and exploitation status

CVE Tracker

21,446 records

Every published CVE from the last 120 days with CVSS score, vendor and product, cross-referenced against CISA's Known Exploited Vulnerabilities catalog. 6 added to KEV in the last 7 days.

SeverityAll critical high medium lowExploitedIn CISA KEV

CVE	CVSS	EPSS	KEV sources	Patch window	Vendor / product	Summary	Published
CVE-2026-14372	7.1	—	—	—	—	The Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder plugin for WordPres	92d ago
CVE-2026-31982	7.1	—	—	—	nozominetworks / cmc	An Open Redirect vulnerability was discovered in the SAML Single Sign-On functionality due to insufficient validat	92d ago
CVE-2026-54528	7.1	—	—	—	jupyter / jupyterlab-git	JupyterLab Git is a Git extension for JupyterLab.	92d ago
CVE-2026-35210	7.1	—	—	—	citeum / opencti	OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables.	92d ago
CVE-2026-58213	7.1	—	—	—	linuxfoundation / nats-server	NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system.	92d ago
CVE-2026-59261	7.1	—	—	—	openclaw / openclaw	OpenClaw before 2026.5.28 contains a credential exposure vulnerability where workspace dotenv files can override p	92d ago
CVE-2026-41122	7.1	—	—	—	dell / data domain operating system	Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS	92d ago
CVE-2026-59704	7.1	—	—	—	—	Cap's GET /api/video/ai endpoint fails to validate user ownership or membership before returning private video AI	93d ago
CVE-2026-58583	7.1	—	—	—	—	FluxInk (formerly Sunia SPB Peripheral) Color Management Driver (TcnPeripheral64.sys) 1.0.7.2 allows local privile	93d ago
CVE-2026-7017	7.1	—	—	—	—	HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets.	93d ago
CVE-2026-21383	7.1	—	—	—	qualcomm / fastconnect 6900 firmware	Cryptographic Issue when using a static initialization vector for AES-GCM key wrapping, which requires a unique va	94d ago
CVE-2026-59196	7.1	—	—	—	pnpm / pnpm	pnpm is a package manager.	94d ago
CVE-2026-59194	7.1	—	—	—	pnpm / pnpm	pnpm is a package manager.	94d ago
CVE-2026-13705	7.1	—	—	—	—	Imager versions before 1.032 for Perl have a heap out-of-bounds read in the bundled Imager::File::SGI reader via a	94d ago
CVE-2026-53361	7.1	—	—	—	linux / linux kernel	In the Linux kernel, the following vulnerability has been resolved: af_unix: Set gc_in_progress to true in unix_gc	97d ago
CVE-2026-58297	7.1	—	—	—	microsoft / edge chromium	Exposure of private personal information to an unauthorized actor in Microsoft Edge for Android allows an unauthor	97d ago
CVE-2026-58296	7.1	—	—	—	microsoft / edge chromium	Exposure of private personal information to an unauthorized actor in Microsoft Edge for Android allows an unauthor	97d ago
CVE-2026-57988	7.1	—	—	—	microsoft / edge chromium	Relative path traversal in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a	97d ago
CVE-2026-57977	7.1	—	—	—	microsoft / edge chromium	Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Edge (Chromium-b	97d ago
CVE-2026-28740	7.1	—	—	—	—	Gitea versions up to and including 1.26.2 allow Git LFS object reuse to authorize private source objects for users	97d ago
CVE-2026-20779	7.1	—	—	—	—	Gitea versions from 1.5.0 before 1.26.3 have a TOTP single-use enforcement defect that allows a valid TOTP code to	97d ago
CVE-2026-57761	7.1	—	—	—	—	Unauthenticated Cross Site Request Forgery (CSRF) in SEOWP <= 3.12.2 versions.	99d ago
CVE-2026-57758	7.1	—	—	—	—	Unauthenticated Cross Site Request Forgery (CSRF) in Permalink Manager for WooCommerce <= 1.0.8.2 versions.	99d ago
CVE-2026-57757	7.1	—	—	—	—	Unauthenticated Cross Site Request Forgery (CSRF) in pCloud WP Backup <= 2.0.2 versions.	99d ago
CVE-2026-57746	7.1	—	—	—	—	Subscriber Broken Access Control in Booked <= 3.0.0 versions.	99d ago
CVE-2026-57686	7.1	—	—	—	—	Unauthenticated Cross Site Scripting (XSS) in WowAddons <= 1.6.14 versions.	99d ago
CVE-2026-57682	7.1	—	—	—	—	Unauthenticated Cross Site Scripting (XSS) in Simple Link Directory <= 15.0.5 versions.	99d ago
CVE-2026-57678	7.1	—	—	—	—	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemePunch S	99d ago
CVE-2026-57675	7.1	—	—	—	—	Unauthenticated Cross Site Scripting (XSS) in WP Photo Album Plus <= 9.2.02.004 versions.	99d ago
CVE-2026-57674	7.1	—	—	—	—	Unauthenticated Cross Site Scripting (XSS) in Timetics <= 1.0.58 versions.	99d ago
CVE-2026-57673	7.1	—	—	—	—	Unauthenticated Cross Site Scripting (XSS) in Optimole <= 4.2.7 versions.	99d ago
CVE-2026-57672	7.1	—	—	—	—	Unauthenticated Cross Site Scripting (XSS) in wpDataTables <= 6.5.1.1 versions.	99d ago
CVE-2026-57671	7.1	—	—	—	—	Unauthenticated Cross Site Scripting (XSS) in perfmatters <= 2.6.4 versions.	99d ago
CVE-2026-57670	7.1	—	—	—	—	Unauthenticated Cross Site Scripting (XSS) in Google Maps CP <= 1.2.5 versions.	99d ago
CVE-2026-57426	7.1	—	—	—	—	Unauthenticated Cross Site Scripting (XSS) in Modula - PRO <= 2.10.8 versions.	99d ago
CVE-2026-57366	7.1	—	—	—	—	Unauthenticated Cross Site Scripting (XSS) in WPAdverts <= 2.3.1 versions.	99d ago
CVE-2026-57362	7.1	—	—	—	—	Unauthenticated Cross Site Scripting (XSS) in ChatBot <= 8.3.2 versions.	99d ago
CVE-2026-57361	7.1	—	—	—	—	Unauthenticated Cross Site Scripting (XSS) in Survey Maker <= 5.2.2.5 versions.	99d ago
CVE-2026-57360	7.1	—	—	—	—	Unauthenticated Cross Site Scripting (XSS) in eCommerce Product Catalog <= 3.5.4 versions.	99d ago
CVE-2026-57359	7.1	—	—	—	—	Unauthenticated Cross Site Scripting (XSS) in ReviewX <= 2.3.10 versions.	99d ago
CVE-2026-57358	7.1	—	—	—	—	Unauthenticated Cross Site Scripting (XSS) in Customize My Account for WooCommerce <= 4.3.9 versions.	99d ago
CVE-2026-57357	7.1	—	—	—	—	Unauthenticated Cross Site Scripting (XSS) in Search Atlas SEO <= 2.6.6 versions.	99d ago
CVE-2026-57356	7.1	—	—	—	—	Unauthenticated Cross Site Scripting (XSS) in MC Woocommerce Wishlist <= 1.9.19 versions.	99d ago
CVE-2026-57351	7.1	—	—	—	—	Unauthenticated Cross Site Scripting (XSS) in HandL UTM Grabber <= 2.9.2 versions.	99d ago
CVE-2026-57350	7.1	—	—	—	—	Unauthenticated Cross Site Scripting (XSS) in WP Debugging <= 2.12.2 versions.	99d ago
CVE-2026-57349	7.1	—	—	—	—	Unauthenticated Cross Site Scripting (XSS) in WPeMatico RSS Feed Fetcher <= 2.8.17 versions.	99d ago
CVE-2026-57345	7.1	—	—	—	—	Unauthenticated Cross Site Scripting (XSS) in Internal Links Manager <= 3.0.3 versions.	99d ago
CVE-2026-57344	7.1	—	—	—	—	Unauthenticated Cross Site Scripting (XSS) in Classified Listing <= 5.4.2 versions.	99d ago
CVE-2026-57343	7.1	—	—	—	—	Unauthenticated Cross Site Scripting (XSS) in Real Estate 7 <= 3.5.9 versions.	99d ago
CVE-2026-27430	7.1	—	—	—	—	Unauthenticated Cross Site Scripting (XSS) in TheFox <= 3.9.76 versions.	99d ago
CVE-2026-27426	7.1	—	—	—	—	Unauthenticated Cross Site Scripting (XSS) in Automotive Car Dealership Business <= 13.3.3 versions.	99d ago
CVE-2026-27425	7.1	—	—	—	—	Unauthenticated Cross Site Scripting (XSS) in Automotive Listings <= 18.6 versions.	99d ago
CVE-2026-27408	7.1	—	—	—	—	Unauthenticated Cross Site Scripting (XSS) in NativeChurch <= 4.8.8.2 versions.	99d ago
CVE-2026-27404	7.1	—	—	—	—	Unauthenticated Cross Site Scripting (XSS) in LMS <= 9.7 versions.	99d ago
CVE-2026-27402	7.1	—	—	—	—	Unauthenticated Cross Site Scripting (XSS) in Kids Life \| Children School WordPress <= 5.2 versions.	99d ago
CVE-2025-69156	7.1	—	—	—	—	Unauthenticated Cross Site Scripting (XSS) in Kids Zone - Children WordPress Theme <= 5.4 versions.	99d ago
CVE-2025-69155	7.1	—	—	—	—	Unauthenticated Cross Site Scripting (XSS) in Fitness Zone WordPress Theme <= 5.7 versions.	99d ago
CVE-2025-69154	7.1	—	—	—	—	Unauthenticated Cross Site Scripting (XSS) in SpaLab \| Beauty Salon WordPress Theme <= 6.7 versions.	99d ago
CVE-2025-69153	7.1	—	—	—	—	Unauthenticated Cross Site Scripting (XSS) in Trendy Travel <= 6.7 versions.	99d ago
CVE-2025-69152	7.1	—	—	—	—	Unauthenticated Cross Site Scripting (XSS) in Artale \| Wedding Photography WordPress <= 2.2.2 versions.	99d ago

Sources: NIST National Vulnerability Database (descriptions, CVSS, CPE); CISA KEV, ENISA EUVD, CIRCL and VulnCheck (exploitation status, three catalogues counted; CIRCL shown as an aggregator); FIRST EPSS (exploitation probability). Patch window is the gap between CVE publication and the earliest KEV listing, so a negative value means a catalogue called it exploited before it was disclosed. Data refreshes every five hours.

Loading

CVE Tracker