CVE Tracker: vulnerabilities by vendor, severity and exploitation status

CVE Tracker

21,446 records

Every published CVE from the last 120 days with CVSS score, vendor and product, cross-referenced against CISA's Known Exploited Vulnerabilities catalog. 6 added to KEV in the last 7 days.

SeverityAll critical high medium lowExploitedIn CISA KEV

CVE	CVSS	EPSS	KEV sources	Patch window	Vendor / product	Summary	Published
CVE-2019-25738	9.8	—	—	—	—	WordPress Hybrid Composer 1.4.6 contains an unauthenticated settings change vulnerability that allows unauthentica	127d ago
CVE-2019-25729	9.8	—	—	—	—	PDF Signer 3.0 contains a server-side template injection vulnerability that allows unauthenticated attackers to ex	127d ago
CVE-2019-25727	9.8	—	—	—	—	WordPress Plugin ad manager wd 1.0.11 contains an arbitrary file download vulnerability that allows unauthenticate	127d ago
CVE-2026-4104	9.8	—	—	—	—	Authorization bypass through User-Controlled SQL primary key vulnerability in Akmer Informatics Automation Industry	127d ago
CVE-2026-50214	9.8	—	—	—	acer / connect m6e 5g firmware	The /v1/Plan service relies entirely on a shared global API token for full administrative management, allowing arb	127d ago
CVE-2026-50211	9.8	—	—	—	acer / connect m6e 5g firmware	Leftover engineering diagnostics and factory-level diagnostic software remain exposed on retail builds, giving mal	127d ago
CVE-2026-49191	9.8	—	—	—	acer / connect m6e 5g firmware	The production build of the M3WebServer hard-codes its backend API keys, which can be easily intercepted through v	127d ago
CVE-2026-49188	9.8	—	—	—	acer / connect m6e 5g firmware	The ai_cmd utility executes with full root permissions.	127d ago
CVE-2026-49186	9.8	—	—	—	acer / connect m6e 5g firmware	The local MQTT broker does not enforce topic-level Access Control Lists (ACLs).	127d ago
CVE-2026-49185	9.8	—	—	—	acer / connect m6e 5g firmware	The FieldX MDM adb messaging topic passes unverified payloads directly into Runtime.exec(), allowing command/instr	127d ago
CVE-2026-36576	9.8	—	—	—	—	An OS command injection vulnerability in the app.py component of openlabs docker-wkhtmltopdf-aas up to commit 9f50	128d ago
CVE-2026-35075	9.8	—	—	—	mbs-solutions / universal gateway firmware	An unauthenticated remote attacker can recover a default, hard coded password from a firmware image and thus gain	128d ago
CVE-2026-47065	9.8	—	—	—	apache / mina	ZDRES-232: resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via java.lang.reflect.Proxy Assessment:	128d ago
CVE-2026-49448	9.8	—	—	—	goauthentik / authentik	authentik is an open-source identity provider.	128d ago
CVE-2026-5076	9.8	—	—	—	—	The ARMember Premium plugin for WordPress is vulnerable to an insecure password reset mechanism in all versions up	128d ago
CVE-2026-38967	9.8	—	—	—	—	CrowCpp Crow through v1.3.1 HTTP is vulnerable to response header injection via unvalidated response header values	128d ago
CVE-2026-42074	9.8	—	—	—	gitlawb / openclaude	OpenClaude is an open-source coding-agent command line interface for cloud and local model providers.	129d ago
CVE-2026-0611	9.8	—	—	—	—	Spacelabs Healthcare Sentinel versions 10.5.x and higher and 11.x.x before 11.6.0 contain an unauthenticated remote	129d ago
CVE-2026-47117	9.8	—	—	—	—	OpenMed before 1.5.2 contains a remote code execution vulnerability in the PII privacy-filter model loading path.	129d ago
CVE-2026-7198	9.8	—	—	—	progress / sitefinity	CWE-284: Improper Access Control in web services in Progress Sitefinity 15.4.8623 before 15.4.8630 allows a remote	129d ago
CVE-2025-53209	9.8	—	—	—	—	Incorrect Privilege Assignment vulnerability in Themeisle Masteriyo LMS PRO allows Privilege Escalation.	129d ago
CVE-2026-8206zero day	9.8	0.77%	1/3	same day	—	The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to privilege esc	129d ago
CVE-2026-25879	9.8	—	—	—	—	Langroid is a framework for building large-language-model-powered applications.	129d ago
CVE-2018-25427	9.8	—	—	—	—	Arm Whois 3.11 contains a stack-based buffer overflow vulnerability that allows remote attackers to execute arbitr	129d ago
CVE-2026-48879	9.8	—	—	—	—	Incorrect Privilege Assignment vulnerability in Sergey AIWU allows Privilege Escalation.	130d ago
CVE-2026-42680	9.8	—	—	—	—	Incorrect Privilege Assignment vulnerability in Wasiliy Strecker / ContestGallery developer Contest Gallery Pro al	130d ago
CVE-2026-7858	9.8	—	—	—	—	A Deserialization of Untrusted Data vulnerability affecting Teamwork Cloud from No Magic Release 2022x through No M	130d ago
CVE-2026-10187	9.8	—	—	—	—	A vulnerability was detected in Totolink N300RH 6.1c.1353_B20190305.	131d ago
CVE-2018-25412	9.8	—	—	—	deltasql project / deltasql	Delta Sql 1.8.2 contains an arbitrary file upload vulnerability that allows unauthenticated attackers to upload ma	132d ago
CVE-2026-45700	9.8	—	—	—	freerdp / freerdp	FreeRDP is a free implementation of the Remote Desktop Protocol.	132d ago
CVE-2026-45697	9.8	—	—	—	—	Formie is a Craft CMS plugin for creating forms.	132d ago
CVE-2026-44649	9.8	—	—	—	—	SillyTavern is a locally installed user interface that allows users to interact with text generation large languag	132d ago
CVE-2026-7786	9.8	—	—	—	—	Jinan USR IOT Technology Limited (PUSR) USR-W610 RS232/485 to Wi-Fi/Ethernet Converter device firmware contains pla	133d ago
CVE-2026-10042	9.8	—	—	—	—	manga-image-translator contains a remote code execution vulnerability in the shared API server mode due to unsafe	133d ago
CVE-2026-46376	9.8	—	—	—	sangoma / freepbx	FreePBX is an open source IP PBX.	133d ago
CVE-2026-10071	9.8	—	—	—	—	DreamMaker developed by Interinfo has an Arbitrary File Upload vulnerability, allowing unauthenticated remote atta	133d ago
CVE-2025-41277	9.8	—	—	—	waterfall-security / wf-500 firmware	Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS C	133d ago
CVE-2025-41276	9.8	—	—	—	waterfall-security / wf-500 firmware	Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS C	133d ago
CVE-2025-41275	9.8	—	—	—	waterfall-security / wf-500 firmware	Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS C	133d ago
CVE-2025-41274	9.8	—	—	—	waterfall-security / wf-500 firmware	Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS C	133d ago
CVE-2025-41273	9.8	—	—	—	waterfall-security / wf-500 firmware	Nozomi Networks Labs identified a CWE-288: Authentication Bypass Using an Alternate Path or Channel in the Console	133d ago
CVE-2025-41272	9.8	—	—	—	waterfall-security / wf-500 firmware	Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS C	133d ago
CVE-2025-41270	9.8	—	—	—	waterfall-security / wf-500 firmware	Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS C	133d ago
CVE-2025-41269	9.8	—	—	—	waterfall-security / wf-500 firmware	Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS C	133d ago
CVE-2026-49201	9.8	—	—	—	acer / wave 7 firmware	The upload.cgi binary, responsible for processing device backups, contains a hardcoded AES encryption key.	133d ago
CVE-2026-49200	9.8	—	—	—	acer / wave 7 firmware	The acer_cgi.log file in the device firmware is accessible without authentication via the web interface.	133d ago
CVE-2026-49199	9.8	—	—	—	acer / predator connect w6x firmware	Crafted MQTT messages can trigger command injection, resulting in root-level code execution on the target device.	133d ago
CVE-2026-49197	9.8	—	—	—	acer / predator connect w6x firmware	Web endpoints intended for the Acer Connect app improperly validate the HTTP Authorization header, failing to bloc	133d ago
CVE-2026-3655	9.8	—	—	—	—	The OTP Login With Phone Number, OTP Verification plugin for WordPress is vulnerable to authentication bypass in ve	133d ago
CVE-2026-8732zero day	9.8	1.9%	1/3	same day	—	The WP Maps Pro plugin for WordPress is vulnerable to Privilege Escalation via Administrator Account Creation in al	133d ago
CVE-2026-8809	9.8	—	—	—	—	The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Privilege Escalation via Validation Bypa	133d ago
CVE-2026-46817exploited	9.8	0.81%	3/3	+32d	oracle / e-business suite	Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission).	133d ago
CVE-2026-45288	9.8	—	—	—	—	Marten is a .NET Transactional Document DB and Event Store on PostgreSQL.	133d ago
CVE-2026-34311	9.8	—	—	—	oracle / hospitality opera 5 property services	Vulnerability in the Oracle Hospitality OPERA 5 Property Services product of Oracle Hospitality Applications (comp	133d ago
CVE-2026-45039	9.8	—	—	—	—	RustFS is a distributed object storage system built in Rust.	133d ago
CVE-2026-9097	9.8	—	—	—	—	Casdoor versions 2.362.0 and earlier do not verify that a JWT used for token exchange is still active.	134d ago
CVE-2026-9094	9.8	—	—	—	—	Casdoor versions 2.362.0 and earlier contain a vulnerability enabling cross-organization token exchange.	134d ago
CVE-2026-9093	9.8	—	—	—	—	In Casdoor versions 2.362.0 and earlier, the SAML service provider implementation does not validate the AudienceRes	134d ago
CVE-2026-38707	9.8	—	—	—	inhandnetworks / ir315 firmware	A command injection vulnerability exists in the IPSec VPN feature of InHand Networks IR302 firmware V3.5.108, IR30	134d ago
CVE-2026-38704	9.8	—	—	—	inhandnetworks / ir315 firmware	A command injection vulnerability exists in the WireGuard VPN feature of InHand Networks IR302 firmware V3.5.108,	134d ago

Sources: NIST National Vulnerability Database (descriptions, CVSS, CPE); CISA KEV, ENISA EUVD, CIRCL and VulnCheck (exploitation status, three catalogues counted; CIRCL shown as an aggregator); FIRST EPSS (exploitation probability). Patch window is the gap between CVE publication and the earliest KEV listing, so a negative value means a catalogue called it exploited before it was disclosed. Data refreshes every five hours.

Loading

CVE Tracker