CVE Tracker: vulnerabilities by vendor, severity and exploitation status

CVE Tracker

210 records

Every published CVE from the last 120 days with CVSS score, vendor and product, cross-referenced against CISA's Known Exploited Vulnerabilities catalog. 8 added to KEV in the last 7 days.

SeverityAll critical high medium lowExploitedIn CISA KEV

CVE	CVSS	EPSS	KEV sources	Patch window	Vendor / product	Summary	Published
CVE-2026-53561	7.4	—	—	—	apache / hive	An improper authentication vulnerability in HiveServer2 SAML bearer-token validation in Apache Hive 4.0.0 through	59d ago
CVE-2026-50631	7.4	—	—	—	apache / cxf	A race condition in AbstractOAuthDataProvider allows concurrent requests using the same Refresh Token to bypass si	133d ago
CVE-2026-67260	7.3	—	—	—	apache / airflow	Apache Airflow 3.3.0 moved human-in-the-loop tasks from the triggerer to a new `awaiting_input` task state swept b	72d ago
CVE-2026-65948	7.3	—	—	—	apache / ranger	UnixAuth lacks brute-force protection in Apache Ranger versions <= 2.8.0.	74d ago
CVE-2026-23904	7.3	—	—	—	apache / kyuubi	Kyuubi Engine UI proxy accepts a host and port from the request path and proxies HTTP requests to that destination	86d ago
CVE-2026-60080	7.3	—	—	—	apache / fory	Use After Free vulnerability in the Rust deserialization logic of Apache Fory.	94d ago
CVE-2026-56624	7.3	—	—	—	apache / mina sshd	Improper certificate validation in Apache MINA SSHD (server-side).	95d ago
CVE-2026-43825	7.3	—	—	—	apache / opennlp	Untrusted Java Deserialization in Apache OpenNLP SvmDoccatModel Versions Affected: before 3.0.0-M4 (libsvm documen	109d ago
CVE-2026-49042	7.3	—	—	—	apache / camel	Improper Input Validation vulnerability in Apache Camel.	109d ago
CVE-2026-46588	7.3	—	—	—	apache / camel	Improper Input Validation vulnerability in Apache Camel.	109d ago
CVE-2026-46587	7.3	—	—	—	apache / camel	Improper Input Validation vulnerability in Apache Camel.	109d ago
CVE-2026-43866	7.3	—	—	—	apache / camel	Deserialization of Untrusted Data vulnerability in Apache Camel, Apache Camel JMS component.	109d ago
CVE-2026-55957	7.3	—	—	—	apache / tomcat	Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authen	116d ago
CVE-2026-53404	7.3	—	—	—	apache / tomcat	Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat's rewrite valve meant that if the firs	116d ago
CVE-2026-48913	7.3	—	—	—	apache / http server	Use After Free vulnerability in Apache HTTP Server module mod_http2 when file handles are already exhausted.	137d ago
CVE-2026-44186	7.3	—	—	—	apache / http server	Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in the mod_proxy_ftp module in Apache HTTP Se	137d ago
CVE-2026-44185	7.3	—	—	—	apache / http server	Buffer Over-read vulnerability in Apache HTTP Server via outbound OCSP requests to an attacker controlled OCSP ser	137d ago
CVE-2026-45360	7.3	—	—	—	apache / airflow	Apache Airflow's scheduler-side deadline-reference decoder (`SerializedCustomReference.deserialize_reference`) imp	144d ago
CVE-2026-29226	7.3	—	—	—	apache / ofbiz	Server-Side Request Forgery (SSRF) vulnerability in Apache OFBiz via Content component operations.	157d ago
CVE-2026-42498	7.3	—	—	—	apache / tomcat	Exposure of HTTP Authentication Header to unexpected hosts during WebSocket authentication vulnerability in Apache	164d ago
CVE-2026-66722	7.2	—	—	—	apache / cloudstack	Improper authorization for CRUD operations on Project Roles and Project Role permissions for domain admins in Clou	63d ago
CVE-2026-24033	7.2	—	—	—	apache / traffic server	Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Traffic S	86d ago
CVE-2026-44914	7.2	—	—	—	apache / nifi	Apache NiFi 1.12.0 through 2.9.0 are missing authorization when replacing Process Groups that include extension co	123d ago
CVE-2026-44913	7.2	—	—	—	apache / nifi	Improper escaping of database table names in the CaptureChangeMySQL Processor included with Apache NiFi 1.2.0 thro	123d ago
CVE-2026-48895	7.2	—	—	—	apache / apisix	URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache APISIX.	126d ago
CVE-2026-25700	7.2	—	—	—	apache / answer	Improper Restriction of Security Token Assignment vulnerability in Apache Answer.	135d ago
CVE-2026-40961	7.2	—	—	—	apache / airflow	A bug in the login redirect route in Apache Airflow allowed authenticated users to craft URLs that bypassed the `i	144d ago
CVE-2026-42782	7.2	—	—	—	apache / syncope	Improper Isolation or Compartmentalization vulnerability in Apache Syncope.	151d ago
CVE-2026-56623	7.1	—	—	—	apache / mina sshd	Path traversal on Windows in Apache MINA SSHD component sshd-git.	95d ago
CVE-2026-48827	7.1	—	—	—	apache / mina sshd	Path traversal vulnerability in Apache MINA SSHD bundle sshd-git.	144d ago

Sources: NIST National Vulnerability Database (descriptions, CVSS, CPE); CISA KEV, ENISA EUVD, CIRCL and VulnCheck (exploitation status, three catalogues counted; CIRCL shown as an aggregator); FIRST EPSS (exploitation probability). Patch window is the gap between CVE publication and the earliest KEV listing, so a negative value means a catalogue called it exploited before it was disclosed. Data refreshes every five hours.

Loading

CVE Tracker