CVE Tracker: vulnerabilities by vendor, severity and exploitation status

CVE Tracker

15,513 records

Every published CVE from the last 120 days with CVSS score, vendor and product, cross-referenced against CISA's Known Exploited Vulnerabilities catalog. 6 added to KEV in the last 7 days.

SeverityAll critical high medium lowExploitedIn CISA KEV

CVE	CVSS	EPSS	KEV sources	Patch window	Vendor / product	Summary	Published
CVE-2026-3975	8.8	—	—	—	tenda / w3 firmware	A security flaw has been discovered in Tenda W3 1.0.0.3(2204).	229d ago
CVE-2026-3974	8.8	—	—	—	tenda / w3 firmware	A vulnerability was identified in Tenda W3 1.0.0.3(2204).	229d ago
CVE-2026-3973	8.8	—	—	—	tenda / w3 firmware	A vulnerability was determined in Tenda W3 1.0.0.3(2204).	229d ago
CVE-2026-3972	8.8	—	—	—	tenda / w3 firmware	A vulnerability was found in Tenda W3 1.0.0.3(2204).	229d ago
CVE-2026-3971	8.8	—	—	—	tenda / i3 firmware	A vulnerability has been found in Tenda i3 1.0.0.6(2204).	229d ago
CVE-2026-3970	8.8	—	—	—	tenda / i3 firmware	A flaw has been found in Tenda i3 1.0.0.6(2204).	229d ago
CVE-2023-43010	8.8	—	—	—	apple / safari	The issue was addressed with improved memory handling.	229d ago
CVE-2026-3936	8.8	—	—	—	google / chrome	Use after free in WebView in Google Chrome on Android prior to 146.0.7680.71 allowed a remote attacker to potential	230d ago
CVE-2026-3931	8.8	—	—	—	google / chrome	Heap buffer overflow in Skia in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to perform out of bo	230d ago
CVE-2026-3926	8.8	—	—	—	google / chrome	Out of bounds read in V8 in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to perform out of bounds	230d ago
CVE-2026-3923	8.8	—	—	—	google / chrome	Use after free in WebMIDI in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to potentially exploit	230d ago
CVE-2026-3922	8.8	—	—	—	google / chrome	Use after free in MediaStream in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to potentially expl	230d ago
CVE-2026-3921	8.8	—	—	—	google / chrome	Use after free in TextEncoding in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to potentially exp	230d ago
CVE-2026-3920	8.8	—	—	—	google / chrome	Out of bounds memory access in WebML in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to potential	230d ago
CVE-2026-3919	8.8	—	—	—	google / chrome	Use after free in Extensions in Google Chrome prior to 146.0.7680.71 allowed an attacker who convinced a user to in	230d ago
CVE-2026-3918	8.8	—	—	—	google / chrome	Use after free in WebMCP in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to potentially exploit h	230d ago
CVE-2026-3917	8.8	—	—	—	google / chrome	Use after free in Agents in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to potentially exploit h	230d ago
CVE-2026-3915	8.8	—	—	—	google / chrome	Heap buffer overflow in WebML in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to perform an out o	230d ago
CVE-2026-3914	8.8	—	—	—	google / chrome	Integer overflow in WebML in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to potentially exploit	230d ago
CVE-2026-3913	8.8	—	—	—	google / chrome	Heap buffer overflow in WebML in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to potentially expl	230d ago
CVE-2026-32127	8.8	—	—	—	open-emr / openemr	OpenEMR is a free and open source electronic health records and medical practice management application.	230d ago
CVE-2026-32097	8.8	—	—	—	harvard / pingpong	PingPong is a platform for using large language models (LLMs) for teaching and learning.	230d ago
CVE-2026-31979	8.8	—	—	—	himmelblau-idm / himmelblau	Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune.	230d ago
CVE-2026-31895	8.8	—	—	—	wegia / wegia	WeGIA is a web manager for charitable institutions.	230d ago
CVE-2026-31861	8.8	—	—	—	cloudcli / cloud cli	Cloud CLI (aka Claude Code UI) is a desktop and mobile UI for Claude Code, Cursor CLI, Codex, and Gemini-CLI.	230d ago
CVE-2026-31858	8.8	—	—	—	craftcms / craft cms	Craft is a content management system (CMS).	230d ago
CVE-2026-31857	8.8	—	—	—	craftcms / craft cms	Craft is a content management system (CMS).	230d ago
CVE-2026-31854	8.8	—	—	—	anysphere / cursor	Cursor is a code editor built for programming with AI.	230d ago
CVE-2026-20046	8.8	—	—	—	cisco / ios xr	A vulnerability in task group assignment for a specific CLI command in Cisco IOS XR Software could allow an authen	230d ago
CVE-2026-20040	8.8	—	—	—	cisco / ios xr	A vulnerability in the CLI of Cisco IOS XR Software could allow an authenticated, local attacker to execute arbitr	230d ago
CVE-2025-68623	8.8	—	—	—	—	In Microsoft DirectX End-User Runtime Web Installer 9.29.1974.0, a low-privilege user can replace an executable fi	230d ago
CVE-2026-0799	8.7	—	—	—	—	In BPF instructions that load/store a value from/to a scratch memory register the register index is an unsigned 32-	52d ago
CVE-2026-86123	8.7	—	—	—	—	SQL Chat contains four unauthenticated API endpoints that accept client-supplied database connection parameters an	52d ago
CVE-2026-85781	8.7	—	—	—	—	Unverified ownership of a storage access point in the volume deletion component of the Amazon EFS CSI Driver befor	53d ago
CVE-2026-71404	8.7	—	—	—	—	A flaw was found in Rancher Manager.	54d ago
CVE-2026-80465	8.7	—	—	—	—	A vulnerability has been identified in Mendix SAML (Mendix 10 compatible) (All versions < V4.2.3), Mendix SAML (Me	54d ago
CVE-2026-79679	8.7	—	—	—	—	Use of Weak Credentials vulnerability in B&R Industrial Automation GmbH mapp Audit used in mapp Services.	54d ago
CVE-2026-84695	8.7	—	—	—	—	BookStack before 26.05.4 contains a stored cross-site scripting vulnerability in the drawing upload endpoint that	55d ago
CVE-2026-82466	8.7	—	—	—	—	Rodauth before 2.46.0 contains an authentication bypass vulnerability in the webauthn_login route that allows logg	59d ago
CVE-2026-47665	8.7	—	—	—	—	Penpot is an open-source design and prototyping platform.	61d ago
CVE-2026-77693	8.7	—	—	—	—	The Order Tip for WooCommerce WordPress plugin before 1.6.0 does not check the capability of the user requesting a	62d ago
CVE-2026-59335	8.7	—	—	—	—	Improper handling of case sensitivity (CWE-178) in the identity zone authorization check in the Identity Zone Endp	63d ago
CVE-2026-40877	8.7	—	—	—	—	Combodo iTop is a web-based IT service management tool.	64d ago
CVE-2026-78213	8.7	—	—	—	—	Heptabase developed by Hepta Platforms, Inc.	64d ago
CVE-2026-60084	8.7	—	—	—	—	SiYuan versions before v3.7.4 contain an arbitrary file deletion vulnerability in the /api/search/removeTemplate e	66d ago
CVE-2026-77811	8.7	—	—	—	—	Improper input validation in the dashboards-observability plugin in OpenSearch Dashboards allows a remote authenti	67d ago
CVE-2026-13097	8.7	—	—	—	redhat / enterprise linux	A privilege escalation flaw was found in FreeIPA.	68d ago
CVE-2026-68899	8.7	—	—	—	—	Wekan is open source kanban built with Meteor.	69d ago
CVE-2026-49283	8.7	—	—	—	—	The SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality.	69d ago
CVE-2026-71050	8.7	—	—	—	oracle / product lifecycle analytics	Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply Chain (component: Installation Is	70d ago
CVE-2026-71000	8.7	—	—	—	oracle / commerce experience manager	Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce	70d ago
CVE-2026-70903	8.7	—	—	—	oracle / hyperion data relationship management	Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access an	70d ago
CVE-2026-70900	8.7	—	—	—	oracle / hyperion data relationship management	Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access an	70d ago
CVE-2026-70882	8.7	—	—	—	oracle / hyperion data relationship management	Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access an	70d ago
CVE-2026-70778	8.7	—	—	—	oracle / customer care	Vulnerability in the Oracle Customer Care product of Oracle E-Business Suite (component: Internal Operations).	70d ago
CVE-2026-62607	8.7	—	—	—	oracle / customer care	Vulnerability in the Oracle Customer Care product of Oracle E-Business Suite (component: Internal Operations).	70d ago
CVE-2026-62589	8.7	—	—	—	oracle / siebel crm	Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: Open Integration).	70d ago
CVE-2026-61332	8.7	—	—	—	oracle / siebel crm	Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager).	70d ago
CVE-2026-61219	8.7	—	—	—	oracle / webcenter portal	Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools).	70d ago
CVE-2026-61215	8.7	—	—	—	oracle / webcenter portal	Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools).	70d ago

Sources: NIST National Vulnerability Database (descriptions, CVSS, CPE); CISA KEV, ENISA EUVD, CIRCL and VulnCheck (exploitation status, three catalogues counted; CIRCL shown as an aggregator); FIRST EPSS (exploitation probability). Patch window is the gap between CVE publication and the earliest KEV listing, so a negative value means a catalogue called it exploited before it was disclosed. Data refreshes every five hours.

Loading

CVE Tracker