CVE Tracker: vulnerabilities by vendor, severity and exploitation status

CVE Tracker

15,513 records

Every published CVE from the last 120 days with CVSS score, vendor and product, cross-referenced against CISA's Known Exploited Vulnerabilities catalog. 6 added to KEV in the last 7 days.

SeverityAll critical high medium lowExploitedIn CISA KEV

CVE	CVSS	EPSS	KEV sources	Patch window	Vendor / product	Summary	Published
CVE-2026-61193	8.7	—	—	—	oracle / webcenter portal	Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools).	70d ago
CVE-2026-60996	8.7	—	—	—	oracle / identity manager connector	Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Connectors	70d ago
CVE-2026-60981	8.7	—	—	—	oracle / webcenter content	Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).	70d ago
CVE-2026-60980	8.7	—	—	—	oracle / webcenter content	Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).	70d ago
CVE-2026-60954	8.7	—	—	—	oracle / webcenter content	Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).	70d ago
CVE-2026-60935	8.7	—	—	—	oracle / webcenter content	Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).	70d ago
CVE-2026-60934	8.7	—	—	—	oracle / webcenter content	Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).	70d ago
CVE-2026-60903	8.7	—	—	—	oracle / webcenter content	Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).	70d ago
CVE-2026-60860	8.7	—	—	—	oracle / service delivery platform	Vulnerability in the Service Delivery Platform product of Oracle Fusion Middleware (component: Messaging Enabler).	70d ago
CVE-2026-60707	8.7	—	—	—	oracle / identity manager	Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: Security).	70d ago
CVE-2026-54347	8.7	—	—	—	—	Froxlor is open source server administration software.	70d ago
CVE-2026-75924	8.7	—	—	—	—	A flaw was found in managed-serviceaccount.	70d ago
CVE-2026-55839	8.7	—	—	—	—	Kestra is an open-source, event-driven orchestration platform.	70d ago
CVE-2026-45116	8.7	—	—	—	—	MyBB is free and open source forum software.	70d ago
CVE-2026-45115	8.7	—	—	—	—	MyBB is free and open source forum software.	70d ago
CVE-2026-75855	8.7	—	—	—	—	ArcadeDB versions before 26.8.1 fail to sanitize database names in the POST /api/v1/server endpoint's create datab	70d ago
CVE-2026-75828	8.7	—	—	—	—	Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the detectXss() function where unpaired	70d ago
CVE-2026-74798	8.7	—	—	—	—	SiYuan kernel before v3.7.4 contains a path traversal vulnerability in the database_clean MCP tool.	71d ago
CVE-2026-49478	8.7	—	—	—	—	Fulcio is a certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity.	75d ago
CVE-2026-73332	8.7	—	—	—	—	CamaleonCMS contains a stored cross-site scripting vulnerability in the cama_contact_form plugin that allows low-p	76d ago
CVE-2026-73329	8.7	—	—	—	—	CamaleonCMS contains a stored cross-site scripting vulnerability that allows authenticated low-privileged users to	76d ago
CVE-2026-15217	8.7	—	—	—	gitlab / gitlab	GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 19.0.6, 19.1 before 19.1.4,	76d ago
CVE-2026-15216	8.7	—	—	—	gitlab / gitlab	GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 19.0.6, 19.1 before 19.1.4,	76d ago
CVE-2026-12004	8.7	—	—	—	ibm / security verify access	IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify	76d ago
CVE-2026-73031	8.7	—	—	—	—	telegram-search contains a stored cross-site scripting vulnerability that allows remote attackers to execute arbit	77d ago
CVE-2026-48413	8.7	—	—	—	—	Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-priv	77d ago
CVE-2026-21273	8.7	—	—	—	adobe / coldfusion	is affected by an Improper Input Validation vulnerability that could result in privilege escalation.	77d ago
CVE-2026-18860	8.7	—	—	—	—	Velociraptor allows multi-tenant deployments named "Orgs".	77d ago
CVE-2026-18608	8.7	—	—	—	—	A flaw was found in the Data Science Pipelines Operator (DSPO).	78d ago
CVE-2026-72730	8.7	—	—	—	—	Discourse is an open-source discussion platform.	78d ago
CVE-2026-48026	8.7	—	—	—	—	lakeFS is an open-source tool that transforms object storage into a Git-like repositories.	81d ago
CVE-2026-62836	8.7	—	—	—	microsoft / azure sql managed instance	Improper restriction of communication channel to intended endpoints in Azure SQL Managed Instance allows an unauth	81d ago
CVE-2026-3415	8.7	—	—	—	—	The XML and schema validation functionalities within the SchemaValidator Mediator process XML input as part of vali	82d ago
CVE-2026-16315	8.7	—	—	—	—	OMICRON StationGuard before version 4.10 contains a cryptographic timing side-channel vulnerability in the backend	82d ago
CVE-2026-71236	8.7	—	—	—	—	Grocy's API request-body parser (controllers/Api/BaseApiController.php, GetParsedAndFilteredRequestBody) purifies	83d ago
CVE-2026-71233	8.7	—	—	—	—	InvoiceNinja v5-stable renders an invoice or quote's "terms" field in the client portal using Laravel Blade's raw	83d ago
CVE-2026-70492	8.7	—	—	—	—	Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform.	84d ago
CVE-2026-67336	8.7	—	—	—	—	better-auth versions before 1.6.11 contain insecure cryptographic defaults in the oidcProvider and mcp plugins tha	87d ago
CVE-2026-17735	8.7	—	—	—	google / chrome	Insufficient validation of untrusted input in BFCache in Google Chrome prior to 151.0.7922.72 allowed a remote att	89d ago
CVE-2026-58157	8.7	—	—	—	apache / traffic server	Apache Traffic Server can reuse server sessions and tunnels improperly, exposing data across client connections.	90d ago
CVE-2026-15325	8.7	—	—	—	ibm / websphere application server	IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty is vulnerable to HTTP request smug	91d ago
CVE-2026-15064	8.7	—	—	—	ibm / websphere application server	IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0	91d ago
CVE-2026-66394	8.7	—	—	—	—	SiYuan before v3.7.3 contains stored and reflected cross-site scripting vulnerabilities in SVG sanitization that a	92d ago
CVE-2026-47743	8.7	—	—	—	—	Shopper is a Headless e-commerce Admin Panel.	96d ago
CVE-2026-61078	8.7	—	—	—	oracle / peoplesoft enterprise cc common application objects	Vulnerability in the PeopleSoft Enterprise CC Common Application Objects product of Oracle PeopleSoft (component:	98d ago
CVE-2026-60941	8.7	—	—	—	oracle / service fulfillment manager	Vulnerability in the Oracle Service Fulfillment Manager product of Oracle E-Business Suite (component: Fulfillment	98d ago
CVE-2026-60597	8.7	—	—	—	oracle / peoplesoft enterprise fin cash management	Vulnerability in the PeopleSoft Enterprise FIN Cash Management product of Oracle PeopleSoft (component: Cash Manag	98d ago
CVE-2026-60553	8.7	—	—	—	oracle / webcenter sites	Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites).	98d ago
CVE-2026-60523	8.7	—	—	—	oracle / webcenter content	Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).	98d ago
CVE-2026-60470	8.7	—	—	—	oracle / webcenter content	Vulnerability in the WebCenter Content: Imaging product of Oracle Fusion Middleware (component: Core).	98d ago
CVE-2026-60469	8.7	—	—	—	oracle / webcenter content	Vulnerability in the WebCenter Content: Imaging product of Oracle Fusion Middleware (component: Core).	98d ago
CVE-2026-60448	8.7	—	—	—	oracle / webcenter content	Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).	98d ago
CVE-2026-60443	8.7	—	—	—	oracle / webcenter content	Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).	98d ago
CVE-2026-60437	8.7	—	—	—	oracle / unified directory	Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD Core).	98d ago
CVE-2026-60427	8.7	—	—	—	oracle / unified directory	Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD Core).	98d ago
CVE-2026-60214	8.7	—	—	—	oracle / coherence	Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core).	98d ago
CVE-2026-47017	8.7	—	—	—	oracle / peoplesoft enterprise peopletools	Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Process Scheduler)	98d ago
CVE-2026-15724	8.7	—	—	—	progress / sharefile storage zones controller	In Progress ShareFile Storage Zones Controller versions prior to 5.12.5 and 6.0.2, an authenticated administrative	98d ago
CVE-2026-45270	8.7	—	—	—	—	CI4MS is a CodeIgniter 4-based content management system skeleton.	99d ago
CVE-2026-64104	8.7	—	—	—	linux / linux kernel	In the Linux kernel, the following vulnerability has been resolved: virt: sev-guest: Explicitly leak pages in unkn	100d ago

Sources: NIST National Vulnerability Database (descriptions, CVSS, CPE); CISA KEV, ENISA EUVD, CIRCL and VulnCheck (exploitation status, three catalogues counted; CIRCL shown as an aggregator); FIRST EPSS (exploitation probability). Patch window is the gap between CVE publication and the earliest KEV listing, so a negative value means a catalogue called it exploited before it was disclosed. Data refreshes every five hours.

Loading

CVE Tracker