CVE Tracker: vulnerabilities by vendor, severity and exploitation status

CVE Tracker

15,513 records

Every published CVE from the last 120 days with CVSS score, vendor and product, cross-referenced against CISA's Known Exploited Vulnerabilities catalog. 4 added to KEV in the last 7 days.

SeverityAll critical high medium lowExploitedIn CISA KEV

CVE	CVSS	EPSS	KEV sources	Patch window	Vendor / product	Summary	Published
CVE-2026-6898	8.8	—	—	—	—	The Wishlist Member plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capabi	157d ago
CVE-2026-6897	8.8	—	—	—	—	The Wishlist Member plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capabi	157d ago
CVE-2026-6895exploited	8.8	0.25%	1/3	+143d	—	The WishList Member plugin for WordPress is vulnerable to Missing Authorization leading to Sensitive Information Di	157d ago
CVE-2026-6419	8.8	—	—	—	—	The WishList Member plugin for WordPress is vulnerable to Privilege Escalation via Missing Authorization in version	157d ago
CVE-2026-45659exploited	8.8	80.2%	3/3	+40d	microsoft / sharepoint server	Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code ove	157d ago
CVE-2026-35430	8.8	—	—	—	microsoft / azure privileged identity management	Authorization bypass through user-controlled key in Azure Privileged Identity Management (PIM) allows an authorize	157d ago
CVE-2026-41075	8.8	—	—	—	—	RT is an open source, enterprise-grade issue and ticket tracking system.	157d ago
CVE-2026-3294	8.8	—	—	—	tp-link / re305 firmware	An authentication logic vulnerability in multiple TP-Link range extenders allows an unauthenticated attacker on an	157d ago
CVE-2026-6406	8.8	—	—	—	docker / docker desktop	The Docker CLI --use-api-socket flag bypasses Enhanced Container Isolation (ECI) restrictions in Docker Desktop.	158d ago
CVE-2026-8992	8.8	—	—	—	ivanti / secure access client	An improper certificate validation vulnerability in Ivanti Secure Access Client before 22.8R6 allows a remote unaut	158d ago
CVE-2026-9018	8.8	—	—	—	—	The Easy Elements for Elementor – Addons & Website Templates plugin for WordPress is vulnerable to Privilege Escala	158d ago
CVE-2026-8434	8.8	—	—	—	concretecms / concrete cms	Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file	158d ago
CVE-2026-8433	8.8	—	—	—	concretecms / concrete cms	Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file	158d ago
CVE-2026-8432	8.8	—	—	—	concretecms / concrete cms	Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file	158d ago
CVE-2026-8427	8.8	—	—	—	concretecms / concrete cms	Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file	158d ago
CVE-2026-8416	8.8	—	—	—	concretecms / concrete cms	Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file	158d ago
CVE-2026-8415	8.8	—	—	—	concretecms / concrete cms	Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/expre	158d ago
CVE-2026-8414	8.8	—	—	—	concretecms / concrete cms	Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/event	158d ago
CVE-2026-8413	8.8	—	—	—	concretecms / concrete cms	Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/	158d ago
CVE-2026-8412	8.8	—	—	—	concretecms / concrete cms	Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/	158d ago
CVE-2026-8411	8.8	—	—	—	concretecms / concrete cms	Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/	158d ago
CVE-2026-8410	8.8	—	—	—	concretecms / concrete cms	Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/logs/	158d ago
CVE-2026-8409	8.8	—	—	—	concretecms / concrete cms	Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/logs/	158d ago
CVE-2026-8428	8.8	—	—	—	concretecms / concrete cms	Concrete CMS 9.5.0 and below emits a CSRF token in the local_available_update.php view ($token->output('do_update')	158d ago
CVE-2026-8426	8.8	—	—	—	concretecms / concrete cms	Concrete CMS 9.5.0 and below does not validate a CSRF token before processing requests to /dashboard/extend/update/	158d ago
CVE-2026-8421	8.8	—	—	—	concretecms / concrete cms	Concrete CMS 9.5.0 and below contains a CSRF vulnerability in the install_package() method of concrete/controllers/	158d ago
CVE-2026-8417	8.8	—	—	—	concretecms / concrete cms	Concrete CMS 9.5.0 and below does not validate a CSRF token before processing requests to /dashboard/extend/update/	158d ago
CVE-2026-8350	8.8	—	—	—	concretecms / concrete cms	Concrete CMS 9.5.0 and below is vulnerable to missing authorization in the bulk_user_assignment.php which can lead	158d ago
CVE-2026-47102	8.8	—	—	—	litellm / litellm	LiteLLM prior to 1.83.10 allows a user to modify their own user_role via the /user/update endpoint.	158d ago
CVE-2026-47101	8.8	—	—	—	litellm / litellm	LiteLLM prior to 1.83.14 allows an authenticated internal_user to create API keys with access to routes that their	158d ago
CVE-2026-47114	8.8	—	—	—	—	IINA before 1.4.3 contains a user-assisted command execution vulnerability that allows remote attackers to execute	158d ago
CVE-2026-9089	8.8	—	—	—	connectwise / automate	The ConnectWise Automate™ Agent does not fully verify the authenticity of components obtained during plugin loading	159d ago
CVE-2026-43495	8.8	—	—	—	linux / linux kernel	In the Linux kernel, the following vulnerability has been resolved: net: wwan: t7xx: validate port_count against m	159d ago
CVE-2026-39461	8.8	—	—	—	freebsd / freebsd	libcasper(3) communicates with helper processes via UNIX domain sockets, and uses the select(2) system call to wai	159d ago
CVE-2026-44048	8.8	—	—	—	—	A stack-based buffer overflow via UCS-2 type confusion in convert_charset() in Netatalk 2.0.4 through 4.4.2 allows	159d ago
CVE-2026-44047	8.8	—	—	—	—	An SQL injection vulnerability in the MySQL CNID backend in Netatalk 3.1.0 through 4.4.2 allows a remote authentic	159d ago
CVE-2026-9126	8.8	—	—	—	google / chrome	Use after free in DOM in Google Chrome on prior to 148.0.7778.179 allowed a remote attacker to execute arbitrary co	159d ago
CVE-2026-9121	8.8	—	—	—	google / chrome	Out of bounds read in GPU in Google Chrome on prior to 148.0.7778.179 allowed a remote attacker to potentially expl	159d ago
CVE-2026-9120	8.8	—	—	—	google / chrome	Use after free in WebRTC in Google Chrome prior to 148.0.7778.179 allowed a remote attacker to execute arbitrary co	159d ago
CVE-2026-9119	8.8	—	—	—	google / chrome	Heap buffer overflow in WebRTC in Google Chrome on prior to 148.0.7778.179 allowed a remote attacker to execute arb	159d ago
CVE-2026-9118	8.8	—	—	—	google / chrome	Use after free in XR in Google Chrome on Windows prior to 148.0.7778.179 allowed a remote attacker to execute arbit	159d ago
CVE-2026-9114	8.8	—	—	—	google / chrome	Use after free in QUIC in Google Chrome on prior to 148.0.7778.179 allowed a remote attacker to execute arbitrary c	159d ago
CVE-2026-9112	8.8	—	—	—	google / chrome	Use after free in GPU in Google Chrome on Windows prior to 148.0.7778.179 allowed a remote attacker to execute arbi	159d ago
CVE-2026-9111	8.8	—	—	—	google / chrome	Use after free in WebRTC in Google Chrome on Linux prior to 148.0.7778.179 allowed a remote attacker to execute arb	159d ago
CVE-2026-24217	8.8	—	—	—	nvidia / bionemo framework	NVIDIA BioNeMo Core for Linux contains a vulnerability where a user could cause a path traversal by loading a mali	159d ago
CVE-2026-44926	8.8	—	—	—	—	InfoScale CmdServer before 7.4.2 mishandles access control.	160d ago
CVE-2026-44925	8.8	—	—	—	veritas / infoscale operations manager	Cross-Site Request Forgery (CSRF) vulnerability in InfoScale v.9.1.3 Operations Manager (VIOM) allows an attacker	160d ago
CVE-2026-24425	8.8	—	—	—	symfony / twig	Twig versions 2.16.x and 3.9.0 through 3.25.x contain a sandbox bypass vulnerability when using a SourcePolicyInte	160d ago
CVE-2026-5200	8.8	—	—	—	—	The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress	160d ago
CVE-2026-7522	8.8	—	—	—	—	The Advanced Database Cleaner – Premium plugin for WordPress is vulnerable to Local File Inclusion in versions up t	160d ago
CVE-2026-7467exploited	8.8	1.3%	1/3	+160d	—	The Read More & Accordion plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and inc	160d ago
CVE-2026-6456	8.8	—	—	—	—	The Account Switcher plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and includin	160d ago
CVE-2026-32740	8.8	—	—	—	struktur / libheif	libheif is a HEIF and AVIF file format decoder and encoder.	160d ago
CVE-2026-8604	8.8	—	—	—	scadabr / scadabr	In ScadaBR version 1.2.0, a CSRF vulnerability could allow an attacker to trigger any authenticated action through	161d ago
CVE-2026-36828	8.8	—	—	—	—	A command injection vulnerability exists in the /cgi-bin/tools/ajax_cmd endpoint of Panabit PAP-XM320 up to and in	161d ago
CVE-2026-31069	8.8	—	—	—	—	BillaBear (all versions prior to Jan 2026) contains a SQL Injection vulnerability in the EventRepository.	161d ago
CVE-2026-8975	8.8	—	—	—	mozilla / firefox	Memory safety bugs present in Firefox ESR 115.35, Firefox ESR 140.10 and Firefox 150.	161d ago
CVE-2026-8974	8.8	—	—	—	mozilla / firefox	Memory safety bugs present in Firefox ESR 140.10 and Firefox 150.	161d ago
CVE-2026-8973	8.8	—	—	—	mozilla / firefox	Memory safety bugs present in Firefox 150.	161d ago
CVE-2026-8972	8.8	—	—	—	mozilla / firefox	Privilege escalation in the WebRTC: Audio/Video component.	161d ago

Sources: NIST National Vulnerability Database (descriptions, CVSS, CPE); CISA KEV, ENISA EUVD, CIRCL and VulnCheck (exploitation status, three catalogues counted; CIRCL shown as an aggregator); FIRST EPSS (exploitation probability). Patch window is the gap between CVE publication and the earliest KEV listing, so a negative value means a catalogue called it exploited before it was disclosed. Data refreshes every five hours.

Loading

CVE Tracker