CVE Tracker: vulnerabilities by vendor, severity and exploitation status

CVE Tracker

15,513 records

Every published CVE from the last 120 days with CVSS score, vendor and product, cross-referenced against CISA's Known Exploited Vulnerabilities catalog. 6 added to KEV in the last 7 days.

SeverityAll critical high medium lowExploitedIn CISA KEV

CVE	CVSS	EPSS	KEV sources	Patch window	Vendor / product	Summary	Published
CVE-2026-16158	8.7	—	—	—	fastify / fastify\/reply-from	Impact: @fastify/reply-from versions from 8.3.1 up to but not including 12.6.4 build the internal URL cache key by	101d ago
CVE-2026-15631	8.7	—	—	—	fastify / fastify\/http-proxy	Impact: @fastify/http-proxy versions from 9.4.0 up to and including 11.5.0 fail to validate the resolved WebSocket	101d ago
CVE-2026-47869	8.7	—	—	—	broadcom / vmware avi load balancer	VMware Avi Load Balancer contains a remote code execution vulnerability.	101d ago
CVE-2026-47867	8.7	—	—	—	broadcom / vmware avi load balancer	VMware Avi Load Balancer contains a remote code execution vulnerability.	101d ago
CVE-2026-54498	8.7	—	—	—	viewcomponent / view component	view_component is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails.	102d ago
CVE-2026-44739	8.7	—	—	—	—	Pimcore is an Open Source Data & Experience Management Platform.	102d ago
CVE-2026-47994	8.7	—	—	—	adobe / commerce	Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-priv	105d ago
CVE-2026-55466	8.7	—	—	—	snipeitapp / snipe-it	Snipe-IT is an IT asset/license management system.	109d ago
CVE-2026-6896	8.7	—	—	—	gitlab / gitlab	GitLab has remediated an issue in GitLab EE affecting all versions from 13.11 before 18.11.7, 19.0 before 19.0.4, a	111d ago
CVE-2026-55596	8.7	—	—	—	—	Plate is a rich-text editor with AI and shadcn/ui.	111d ago
CVE-2026-60104	8.7	—	—	—	bitwarden / server	Bitwarden Server before 2026.6.0 does not verify that the email in a POST /auth-requests/admin-request body belong	111d ago
CVE-2026-14891	8.7	—	—	—	—	HashiCorp Nomad and Nomad Enterprise are vulnerable to a sandbox escape in the Docker task driver that may allow a	111d ago
CVE-2026-55429	8.7	—	—	—	coder / coder	Coder allows organizations to provision remote development environments via Terraform.	111d ago
CVE-2026-12277	8.7	—	—	—	—	The Frontend File Manager Plugin WordPress plugin through 23.6 does not validate a file path derived from user inp	112d ago
CVE-2026-57983	8.7	—	—	—	microsoft / edge chromium	Improper authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security fea	116d ago
CVE-2026-28737	8.7	—	—	—	—	Gitea versions from 1.25.0 before 1.26.0 allow stored cross-site scripting through the extensionsRequired field in	116d ago
CVE-2026-54406	8.7	—	—	—	ui / unifi network application	A malicious actor with access to the network and high privileges could exploit a Path Traversal vulnerability foun	117d ago
CVE-2026-10643	8.7	—	—	—	zephyrproject / zephyr	Zephyr's IP socket recvmsg() implementation (subsys/net/lib/sockets/sockets_inet.c, insert_pktinfo()) validated th	121d ago
CVE-2026-55069	8.7	—	—	—	kestra / kestra	Kestra is an open-source, event-driven orchestration platform.	123d ago
CVE-2026-53230	8.7	—	—	—	linux / linux kernel	In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix slab-out-of-bounds in mlx5_query	124d ago
CVE-2026-10086	8.7	—	—	—	gitlab / gitlab	GitLab has remediated an issue in GitLab EE affecting all versions from 16.4 before 18.11.6, 19.0 before 19.0.3, a	124d ago
CVE-2026-52805	8.7	—	—	—	—	Gogs is an open source self-hosted Git service.	125d ago
CVE-2026-56223	8.7	—	—	—	—	Capgo before 12.128.2 contains a cross-domain SSO account takeover vulnerability in the provision-user endpoint th	125d ago
CVE-2026-7574	8.7	—	—	—	—	Anthropic Claude Desktop Cowork VM image handling (confirmed across v1.1348.0 through v1.2278.0, including v1.1348.	125d ago
CVE-2026-54011	8.7	—	—	—	openwebui / open webui	Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline.	126d ago
CVE-2026-48716	8.7	—	—	—	—	nanobot is a personal AI assistant.	131d ago
CVE-2026-46808	8.7	—	—	—	oracle / webcenter content	Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).	132d ago
CVE-2026-46804	8.7	—	—	—	oracle / webcenter content	Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).	132d ago
CVE-2026-35271	8.7	—	—	—	oracle / peoplesoft enterprise pt peopletools	Vulnerability in the PeopleSoft Enterprise PT PeopleTools product of Oracle PeopleSoft (component: Weblogic).	132d ago
CVE-2026-35258	8.7	—	—	—	oracle / weblogic server	Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Console).	132d ago
CVE-2026-53608	8.7	—	—	—	—	ApostropheCMS is an open-source Node.js content management system.	137d ago
CVE-2026-47691	8.7	—	—	—	netty / netty	Netty is a network application framework for development of protocol servers and clients.	137d ago
CVE-2026-6211	8.7	—	—	—	—	Unrestricted upload of file with dangerous type vulnerability in Global IT Informatics Services Inc.	137d ago
CVE-2026-47135	8.7	—	—	—	—	vm2 is an open source vm/sandbox for Node.js.	137d ago
CVE-2026-45674	8.7	—	—	—	netty / netty	Netty is a network application framework for development of protocol servers and clients.	137d ago
CVE-2026-44494	8.7	—	—	—	axios / axios	Axios is a promise based HTTP client for the browser and Node.js.	138d ago
CVE-2026-10087	8.7	—	—	—	gitlab / gitlab	GitLab has remediated an issue in GitLab EE affecting all versions from 17.1 before 18.10.8, 18.11 before 18.11.5,	138d ago
CVE-2026-41031	8.7	—	—	—	—	A Stored Cross-Site Scripting vulnerability in Vinna Process Monitor Version 4.0 Service Pack 1 (Build 63255) allo	140d ago
CVE-2026-46392	8.7	—	—	—	—	HAX CMS helps manage microsite universe with PHP or NodeJs backends.	144d ago
CVE-2026-7313	8.7	—	—	—	progress / sitefinity	CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity version from 8.0.5700 to 13.3.	147d ago
CVE-2026-9024	8.7	—	—	—	—	A Stored Cross-site Scripting (XSS) vulnerability affecting Process Experience Studio in DELMIA Service Process Eng	148d ago
CVE-2026-49368	8.7	—	—	—	jetbrains / youtrack	In JetBrains YouTrack before 2026.1.13162 stored XSS in project notification templates was possible	151d ago
CVE-2026-48527	8.7	—	—	—	—	HAX CMS helps manage microsite universe with PHP or NodeJs backends.	151d ago
CVE-2026-45348	8.7	—	—	—	—	pyLoad is a free and open-source download manager written in Python.	152d ago
CVE-2026-44543	8.7	—	—	—	suse / local path provisioner	Local Path Provisioner provides a way for the Kubernetes users to utilize the local storage in each node.	152d ago
CVE-2026-47762	8.7	—	—	—	tiny / tinymce	TinyMCE is an open source rich text editor.	152d ago
CVE-2026-47761	8.7	—	—	—	tiny / tinymce	TinyMCE is an open source rich text editor.	152d ago
CVE-2026-47760	8.7	—	—	—	tiny / tinymce	TinyMCE is an open source rich text editor.	152d ago
CVE-2026-47759	8.7	—	—	—	tiny / tinymce	TinyMCE is an open source rich text editor.	152d ago
CVE-2026-42197	8.7	—	—	—	—	RELATE is a web-based courseware package.	153d ago
CVE-2026-44669	8.7	—	—	—	—	FACTION is a PenTesting Report Generation and Collaboration Framework.	154d ago
CVE-2026-44667	8.7	—	—	—	—	FACTION is a PenTesting Report Generation and Collaboration Framework.	154d ago
CVE-2026-44729	8.7	—	—	—	twenty / twenty	Twenty is an open source CRM.	154d ago
CVE-2026-41147	8.7	—	—	—	—	NukeViet CMS is a multi Content Management System.	158d ago
CVE-2026-28445	8.7	—	—	—	—	Typebot is a chatbot builder tool.	158d ago
CVE-2026-40165	8.7	—	—	—	—	authentik is an open-source identity provider.	159d ago
CVE-2026-34241	8.7	—	—	—	—	CtrlPanel is open-source billing software for hosting providers.	161d ago
CVE-2026-27173	8.7	—	—	—	apache / apache-airflow-providers-cncf-kubernetes	JWT tokens that were used by workers in Kubernetes Executors have been exposed to users who had read only access t	161d ago
CVE-2026-6346	8.7	—	—	—	mattermost / mattermost server	Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to sanitize sensitive configuratio	162d ago
CVE-2026-45315	8.7	—	—	—	openwebui / open webui	Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline.	165d ago

Sources: NIST National Vulnerability Database (descriptions, CVSS, CPE); CISA KEV, ENISA EUVD, CIRCL and VulnCheck (exploitation status, three catalogues counted; CIRCL shown as an aggregator); FIRST EPSS (exploitation probability). Patch window is the gap between CVE publication and the earliest KEV listing, so a negative value means a catalogue called it exploited before it was disclosed. Data refreshes every five hours.

Loading

CVE Tracker