CVE Tracker: vulnerabilities by vendor, severity and exploitation status

CVE Tracker

15,513 records

Every published CVE from the last 120 days with CVSS score, vendor and product, cross-referenced against CISA's Known Exploited Vulnerabilities catalog. 6 added to KEV in the last 7 days.

SeverityAll critical high medium lowExploitedIn CISA KEV

CVE	CVSS	EPSS	KEV sources	Patch window	Vendor / product	Summary	Published
CVE-2026-72848	8.6	—	—	—	—	SitemapLoader.parse_sitemap in langchain_community/document_loaders/sitemap.py applies the documented restrict_to_	68d ago
CVE-2026-69558	8.6	—	—	—	microsoft / partner center	Authorization bypass through user-controlled key in Microsoft Partner Center allows an unauthorized attacker to di	68d ago
CVE-2026-69519	8.6	—	—	—	microsoft / azure stack hci	Observable response discrepancy in Azure Stack HCI allows an unauthorized attacker to disclose information over a	68d ago
CVE-2026-66800	8.6	—	—	—	microsoft / azure data factory	Server-side request forgery (ssrf) in Azure Data Factory allows an unauthorized attacker to disclose information o	68d ago
CVE-2026-75917	8.6	—	—	—	—	SiYuan before v3.7.4 contains a cross-site scripting vulnerability in the file-tree picker's hover-tooltip generat	69d ago
CVE-2026-75916	8.6	—	—	—	—	SiYuan through 3.7.3 contains a cross-site scripting vulnerability in the '((' block-reference autocomplete hint p	69d ago
CVE-2026-16950	8.6	—	—	—	—	The Product Shortlist WordPress plugin through 1.0.4 does not properly sanitise and escape a parameter before usin	69d ago
CVE-2026-16616	8.6	—	—	—	—	The Simple File List WordPress plugin through 6.3.11 does not validate the source path of a file-move operation re	69d ago
CVE-2026-12983	8.6	—	—	—	—	The Dinatur WordPress plugin through 1.18 does not sanitize and escape user input before using it in a SQL query,	69d ago
CVE-2026-52854	8.6	—	—	—	—	Maps is a MediaWiki extension that enables visualization of geographic data through dynamic embedded maps.	70d ago
CVE-2026-73939	8.6	—	—	—	oracle / helidon	Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server).	70d ago
CVE-2026-71131	8.6	—	—	—	oracle / vm virtualbox	Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).	70d ago
CVE-2026-70996	8.6	—	—	—	oracle / commerce experience manager	Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce	70d ago
CVE-2026-70721	8.6	—	—	—	oracle / hyperion profitability and cost management	Vulnerability in the Oracle Hyperion Profitability and Cost Management product of Oracle Hyperion (component: Depl	70d ago
CVE-2026-62636	8.6	—	—	—	oracle / reports developer	Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Security and Authent	70d ago
CVE-2026-62628	8.6	—	—	—	oracle / reports developer	Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Security and Authent	70d ago
CVE-2026-62625	8.6	—	—	—	oracle / reports developer	Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Security and Authent	70d ago
CVE-2026-62620	8.6	—	—	—	oracle / reports developer	Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Security and Authent	70d ago
CVE-2026-62599	8.6	—	—	—	oracle / trading community	Vulnerability in the Oracle Trading Community product of Oracle E-Business Suite (component: Third Party Data Inte	70d ago
CVE-2026-62586	8.6	—	—	—	oracle / siebel crm	Vulnerability in the Siebel CRM Administration product of Oracle Siebel CRM (component: Data Archival).	70d ago
CVE-2026-62535	8.6	—	—	—	oracle / hyperion infrastructure technology	Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Installation	70d ago
CVE-2026-61286	8.6	—	—	—	oracle / enterprise manager base platform	Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Even	70d ago
CVE-2026-61230	8.6	—	—	—	oracle / webcenter portal	Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools).	70d ago
CVE-2026-61228	8.6	—	—	—	oracle / webcenter portal	Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools).	70d ago
CVE-2026-61045	8.6	—	—	—	oracle / webcenter sites	Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites).	70d ago
CVE-2026-61033	8.6	—	—	—	oracle / webcenter sites	Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites).	70d ago
CVE-2026-60699	8.6	—	—	—	oracle / weblogic server	Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).	70d ago
CVE-2026-75926	8.6	—	—	—	—	Hugo 0.161.0 placed the Node asset pipelines behind the Node.js permission model so that code running through Post	70d ago
CVE-2026-75856	8.6	—	—	—	—	CodeWhale before 0.8.64 contains a server-side request forgery bypass vulnerability in DNS pinning logic that fail	70d ago
CVE-2026-74902	8.6	—	—	—	—	SiYuan before v3.7.4 contains a cross-site scripting vulnerability in the file upload validation flow that fails t	70d ago
CVE-2026-56677	8.6	—	—	—	—	9Router is an AI router & token saver.	71d ago
CVE-2026-74791	8.6	—	—	—	—	Scriban before 7.0.0 fails to clear the CachedTemplates dictionary when TemplateContext.Reset() is called, allowin	72d ago
CVE-2026-72810	8.6	—	—	—	—	SiYuan versions before v3.7.4 contain a publish-boundary bypass vulnerability in WebSocket broadcast sessions that	74d ago
CVE-2026-15205zero day	8.6	0.45%	1/3	same day	—	The Paymob for WooCommerce WordPress plugin before 4.1.9 does not properly sanitise a client-supplied identifier b	74d ago
CVE-2026-17502	8.6	—	—	—	ibm / i	IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an out-of-bounds wr	75d ago
CVE-2026-16815	8.6	—	—	—	ibm / i	IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service and potentially obtain sen	75d ago
CVE-2026-72777	8.6	—	—	—	—	Next AI Draw.io through 0.4.16 contains a server-side request forgery vulnerability in the POST /api/parse-url end	75d ago
CVE-2026-73608	8.6	—	—	—	—	SiYuan's development branch (endpoint introduced by commit 9b8e8956f, not present in v3.7.3 or master, patched in	75d ago
CVE-2026-59505	8.6	—	—	—	—	: Improper Access Control vulnerability in Priority Portal Generator addon to Priority ERP (developed by Soft Solu	75d ago
CVE-2026-59499	8.6	—	—	—	—	: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Priority Portal Generator addon to P	75d ago
CVE-2026-72804	8.6	—	—	—	—	SiYuan versions before v3.7.4 fail to validate publish-password tier in getGraph and getLocalGraph endpoints, allo	76d ago
CVE-2026-72798	8.6	—	—	—	—	SiYuan versions before v3.7.4 fail to properly filter related-database content in renderAttributeView, allowing an	76d ago
CVE-2026-72795	8.6	—	—	—	—	SiYuan versions before v3.7.4 fail to filter embedded block content by publish access in the getBlockDOMWithEmbed	76d ago
CVE-2026-72794	8.6	—	—	—	—	siyuan versions before v3.7.4 expose the session cookie signing key through the /api/system/getConf endpoint to un	76d ago
CVE-2026-72793	8.6	—	—	—	—	SiYuan versions before v3.7.4 fail to mask sensitive configuration fields in the /api/system/getConf endpoint, all	76d ago
CVE-2026-72789	8.6	—	—	—	—	SiYuan before v3.7.4 fails to properly validate publish access for encrypted notebooks, treating them as publicly	76d ago
CVE-2026-18474	8.6	—	—	—	—	The WP Directory Kit WordPress plugin before 1.5.6 does not sanitise and escape a parameter before using it in a S	76d ago
CVE-2026-68433	8.6	—	—	—	—	In the Linux kernel, the following vulnerability has been resolved: libceph: bound get_version reply decode to fro	77d ago
CVE-2026-73247	8.6	—	—	—	—	Kestra is an open-source, event-driven orchestration platform.	77d ago
CVE-2026-72742	8.6	—	—	—	—	DSPy 3.3.0b1 contains a file exfiltration vulnerability in the Image and Audio output field adapters that allows a	77d ago
CVE-2026-48441	8.6	—	—	—	adobe / lightroom	Lightroom Classic is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')	77d ago
CVE-2026-48397	8.6	—	—	—	adobe / lightroom	Lightroom Classic is affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary	77d ago
CVE-2026-24911	8.6	—	—	—	intel / proset\/wireless wifi	Stack-based buffer overflow for some Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 0: Kernel may	77d ago
CVE-2026-20776	8.6	—	—	—	intel / proset\/wireless wifi	Improper conditions check for some Intel(R) PROSet/Wireless WiFi Software within Ring 2: Device Drivers may allow	77d ago
CVE-2026-20727	8.6	—	—	—	intel / proset\/wireless wifi	Null pointer dereference for some Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 0: Kernel may all	77d ago
CVE-2026-20349zero day	8.6	1.0%	3/3	same day	cisco / adaptive security appliance software	A vulnerability in the Remote Access SSL VPN service for Cisco Secure Firewall Adaptive Security Appliance (ASA) S	77d ago
CVE-2026-72536	8.6	—	—	—	—	A missing authentication vulnerability in Chaskiq through commit 46dfdd1 allows unauthenticated remote attackers t	77d ago
CVE-2026-72535	8.6	—	—	—	—	A missing authentication vulnerability in Chaskiq through commit 46dfdd1 allows unauthenticated remote attackers t	77d ago
CVE-2026-72581	8.6	—	—	—	—	A server-side request forgery (SSRF) vulnerability in duhow/xiaoai-patch through commit fb07049 allows a remote at	78d ago
CVE-2026-64940	8.6	—	—	—	—	Tegalog -Fumy Otegaru Memo Logger- provided by Nishishi Factory contains a vulnerability due to a permissive regul	78d ago

Sources: NIST National Vulnerability Database (descriptions, CVSS, CPE); CISA KEV, ENISA EUVD, CIRCL and VulnCheck (exploitation status, three catalogues counted; CIRCL shown as an aggregator); FIRST EPSS (exploitation probability). Patch window is the gap between CVE publication and the earliest KEV listing, so a negative value means a catalogue called it exploited before it was disclosed. Data refreshes every five hours.

Loading

CVE Tracker