CVE Tracker: vulnerabilities by vendor, severity and exploitation status

CVE Tracker

21,446 records

Every published CVE from the last 120 days with CVSS score, vendor and product, cross-referenced against CISA's Known Exploited Vulnerabilities catalog. 8 added to KEV in the last 7 days.

SeverityAll critical high medium lowExploitedIn CISA KEV

CVE	CVSS	EPSS	KEV sources	Patch window	Vendor / product	Summary	Published
CVE-2026-4745	—	—	—	—	—	Improper Control of Generation of Code ('Code Injection') vulnerability in dendibakh perf-ninja (labs/misc/pgo/lua	198d ago
CVE-2026-3260	—	—	—	—	—	Rejected reason: The Undertow web server enforces a default maximum HTTP request entity size limit.	198d ago
CVE-2026-4744	—	—	—	—	—	Out-of-bounds Read vulnerability in rizonesoft Notepad3 (‎scintilla/oniguruma/src modules).	198d ago
CVE-2026-4743	—	—	—	—	—	NULL Pointer Dereference vulnerability in taurusxin ncmdump (‎src/utils‎ modules).	198d ago
CVE-2026-4742	—	—	—	—	—	Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in visualfc liteide	198d ago
CVE-2026-4741	—	—	—	—	—	Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in TeamJCD JoyConDroid	198d ago
CVE-2026-4739	—	—	—	—	—	Integer Overflow or Wraparound vulnerability in InsightSoftwareConsortium ITK (‎Modules/ThirdParty/Expat/src/expat	198d ago
CVE-2026-4738	—	—	—	—	—	Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in OSGeo gdal (frmts/zlib/con	198d ago
CVE-2026-4737	—	—	—	—	—	Use After Free vulnerability in No-Chicken Echo-Mate (‎SDK/rv1106-sdk/sysdrv/source/kernel/mm modules).	198d ago
CVE-2026-4736	—	—	—	—	—	Improper Handling of Values vulnerability in No-Chicken Echo-Mate (SDK/rv1106-sdk/sysdrv/source/kernel/include/net/	198d ago
CVE-2026-4735	—	—	—	—	—	Deserialization of Untrusted Data vulnerability in DTStack chunjun (‎chunjun-core/src/main/java/com/dtstack/chunjun	198d ago
CVE-2026-4734	—	—	—	—	—	Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in yoyofr modizer (libs/libop	198d ago
CVE-2026-4732	—	—	—	—	—	Out-of-bounds Read vulnerability in tildearrow furnace (‎extern/libsndfile-modified/src modules).	198d ago
CVE-2026-4731	—	—	—	—	—	Integer Overflow or Wraparound vulnerability in artraweditor ART (‎rtengine‎ modules).	198d ago
CVE-2026-33168	—	—	—	—	—	Action View provides conventions and helpers for building web pages with the Rails framework.	198d ago
CVE-2026-4681	—	—	—	—	—	A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM.	198d ago
CVE-2026-32912	—	—	—	—	—	Rejected reason: This CVE ID has been rejected.	198d ago
CVE-2026-32911	—	—	—	—	—	Rejected reason: This CVE ID has been rejected.	198d ago
CVE-2026-32910	—	—	—	—	—	Rejected reason: This CVE ID has been rejected.	198d ago
CVE-2026-32909	—	—	—	—	—	Rejected reason: This CVE ID has been rejected.	198d ago
CVE-2026-32908	—	—	—	—	—	Rejected reason: This CVE ID has been rejected.	198d ago
CVE-2026-32907	—	—	—	—	—	Rejected reason: This CVE ID has been rejected.	198d ago
CVE-2026-32904	—	—	—	—	—	Rejected reason: This CVE ID has been rejected.	198d ago
CVE-2026-32903	—	—	—	—	—	Rejected reason: This CVE ID has been rejected.	198d ago
CVE-2026-32902	—	—	—	—	—	Rejected reason: This CVE ID has been rejected.	198d ago
CVE-2026-32901	—	—	—	—	—	Rejected reason: This CVE ID has been rejected.	198d ago
CVE-2026-32900	—	—	—	—	—	Rejected reason: This CVE ID has been rejected.	198d ago
CVE-2026-32066	—	—	—	—	—	Rejected reason: This CVE ID has been rejected.	198d ago
CVE-2026-32047	—	—	—	—	—	Rejected reason: This CVE ID has been rejected.	198d ago
CVE-2026-32012	—	—	—	—	—	Rejected reason: This CVE ID has been rejected.	198d ago
CVE-2026-28483	—	—	—	—	—	Rejected reason: This CVE ID has been rejected.	198d ago
CVE-2026-28455	—	—	—	—	—	Rejected reason: This CVE ID has been rejected.	198d ago
CVE-2026-22173	—	—	—	—	—	Rejected reason: This CVE ID has been rejected.	198d ago
CVE-2026-4368	—	—	—	—	—	Race Condition in NetScaler ADC and NetScaler Gateway when appliance is configured as Gateway (SSL VPN, ICA Proxy,	198d ago
CVE-2026-0898	—	—	—	—	—	An arbitrary file-write vulnerability in Pega Browser Extension (PBE) affects Pega Robot Studio developers who are	199d ago
CVE-2026-4645	—	—	—	—	—	Rejected reason: Duplicate of CVE-2026-32287	199d ago
CVE-2025-41008	—	—	—	—	—	SQL injection vulnerability in Sinturno.	199d ago
CVE-2026-1958	—	—	—	—	—	Use of hard-coded credentials in Klinika XP and KlinikaXP Insertino allowed an unauthorized attacker access to seve	199d ago
CVE-2025-41007	—	—	—	—	—	SQL Injection in Cuantis.	199d ago
CVE-2026-4606	—	—	—	—	—	GV Edge Recording Manager (ERM) v2.3.1 improperly runs application components with SYSTEM-level privileges, allowin	199d ago
CVE-2026-2598	—	—	—	—	—	Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.	201d ago
CVE-2026-32765	—	—	—	—	—	Rejected reason: This repository is no longer public.	202d ago
CVE-2026-32764	—	—	—	—	—	Rejected reason: This repository is no longer public.	202d ago
CVE-2026-3948	—	—	—	—	—	Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.	202d ago
CVE-2026-4427	—	—	—	—	—	Rejected reason: Duplicate of CVE-2026-32286	203d ago
CVE-2026-32843	—	—	—	—	—	Location Aware Sensor System by Linkit ONE, up to commit f06bd20 (2023-04-26), contains a reflected cross-site scr	203d ago
CVE-2026-3181	—	—	—	—	—	Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.	203d ago
CVE-2026-32735	—	—	—	—	—	openapi-to-java-records-mustache-templates allows users to generate Java Records from OpenAPI specifications.	203d ago
CVE-2026-4407	—	—	—	—	—	Out-of-bounds array write in Xpdf 4.06 and earlier, due to incorrect validation of the "N" field in ICCBased color	203d ago
CVE-2026-0866	—	—	—	—	—	Rejected reason: After the publication of the PoC by the researcher and further analysis, we have determined that t	203d ago
CVE-2026-3479	—	—	—	—	—	DISPUTED: The project has clarified that the documentation was incorrect, and that pkgutil.get_data() has the same	204d ago
CVE-2025-12518	—	—	—	—	—	beefree.io SDK is vulnerable to Stored XSS in Social Media icon URL parameter in email builder functionality.	204d ago
CVE-2025-31703	—	—	—	—	—	A vulnerability found in Dahua NVR/XVR device.	204d ago
CVE-2026-32268	—	—	—	—	—	The Azure Blob Storage for Craft CMS plugin provides an Azure Blob Storage integration for Craft CMS.	204d ago
CVE-2026-33189	—	—	—	—	—	Rejected reason: Further research determined the issue originates from a different product.	204d ago
CVE-2026-33188	—	—	—	—	—	Rejected reason: Further research determined the issue originates from a different product.	204d ago
CVE-2026-33187	—	—	—	—	—	Rejected reason: Further research determined the issue originates from a different product.	204d ago
CVE-2026-32266	—	—	—	—	—	The Google Cloud Storage for Craft CMS plugin provides a Google Cloud Storage integration for Craft CMS.	204d ago
CVE-2026-32265	—	—	—	—	—	The Amazon S3 for Craft CMS plugin provides an Amazon S3 integration for Craft CMS.	204d ago
CVE-2026-2809	—	—	—	—	—	Netskope was notified about a potential gap in its Endpoint DLP Module for Netskope Client on Windows systems.	204d ago

Sources: NIST National Vulnerability Database (descriptions, CVSS, CPE); CISA KEV, ENISA EUVD, CIRCL and VulnCheck (exploitation status, three catalogues counted; CIRCL shown as an aggregator); FIRST EPSS (exploitation probability). Patch window is the gap between CVE publication and the earliest KEV listing, so a negative value means a catalogue called it exploited before it was disclosed. Data refreshes every five hours.

Loading

CVE Tracker