CVE Tracker: vulnerabilities by vendor, severity and exploitation status

CVE Tracker

15,513 records

Every published CVE from the last 120 days with CVSS score, vendor and product, cross-referenced against CISA's Known Exploited Vulnerabilities catalog. 6 added to KEV in the last 7 days.

SeverityAll critical high medium lowExploitedIn CISA KEV

CVE	CVSS	EPSS	KEV sources	Patch window	Vendor / product	Summary	Published
CVE-2026-60671	8.6	—	—	—	oracle / business intelligence	Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Pl	98d ago
CVE-2026-60559	8.6	—	—	—	oracle / access manager	Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine).	98d ago
CVE-2026-60556	8.6	—	—	—	oracle / webcenter sites	Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites).	98d ago
CVE-2026-60550	8.6	—	—	—	oracle / webcenter sites	Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites).	98d ago
CVE-2026-60536	8.6	—	—	—	oracle / identity manager connector	Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: PeopleSoft	98d ago
CVE-2026-60431	8.6	—	—	—	oracle / http server	Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: mod_proxy).	98d ago
CVE-2026-60359	8.6	—	—	—	oracle / unified directory	Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD Core).	98d ago
CVE-2026-60356	8.6	—	—	—	oracle / access manager	Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine).	98d ago
CVE-2026-60327	8.6	—	—	—	oracle / access manager	Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine).	98d ago
CVE-2026-60293	8.6	—	—	—	oracle / weblogic server	Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: WLS - Web Services).	98d ago
CVE-2026-60235	8.6	—	—	—	oracle / coherence	Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core).	98d ago
CVE-2026-63764	8.6	—	—	—	internlm / lmdeploy	LMDeploy through 0.14.0, fixed in commit 03c3130, contains a server-side request forgery (SSRF) vulnerability in t	98d ago
CVE-2026-53591	8.6	—	—	—	—	FreeScout is a free help desk and shared inbox built with PHP's Laravel framework.	99d ago
CVE-2026-63429	8.6	—	—	—	—	HeyForm is an open-source form builder.	99d ago
CVE-2026-64623	8.6	—	—	—	—	Network-AI before 5.13.4 contains an improper cryptographic signature verification vulnerability in APSAdapter whe	99d ago
CVE-2026-11349	8.6	—	—	—	—	The Modern Event Calendar Pro WordPress plugin before 7.34.0, Modern Events Calendar Lite WordPress plugin before	99d ago
CVE-2026-53727	8.6	—	—	—	premailer / css parser	css_parser is a Ruby CSS parser.	102d ago
CVE-2026-44023	8.6	—	—	—	docling / docling-core	Docling Core defines core data types and transformations for the document processing application Docling.	103d ago
CVE-2026-63088	8.6	—	—	—	—	stoatchat before 0.14.0 contains a server-side request forgery (SSRF) vulnerability that allows unauthenticated ne	103d ago
CVE-2026-63086	8.6	—	—	—	—	text-generation-inference through 3.3.7 contains a server-side request forgery (SSRF) vulnerability in the OpenAI-	103d ago
CVE-2026-57206	8.6	—	—	—	—	SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded intera	103d ago
CVE-2026-63306	8.6	—	—	—	—	stoatchat before 0.13.5 contains an unauthenticated server-side request forgery vulnerability in the /proxy and /e	103d ago
CVE-2026-48795	8.6	—	—	—	—	AdonisJS is a TypeScript-first web framework.	104d ago
CVE-2026-61836	8.6	—	—	—	monospace / directus	Directus is a real-time API and App dashboard for managing SQL database content.	104d ago
CVE-2026-61436	8.6	—	—	—	—	PraisonAI before 4.6.78 fails to verify Svix webhook signatures in AgentMail webhook mode, allowing unauthenticate	104d ago
CVE-2026-15583	8.6	—	—	—	—	A confused-deputy flaw in Grafana MCP Server allows an unauthenticated remote attacker to exfiltrate the server's	104d ago
CVE-2026-12512	8.6	—	—	—	—	The Quotes llama WordPress plugin before 3.1.6 does not properly sanitize and escape a user-supplied parameter bef	104d ago
CVE-2026-48275	8.6	—	—	—	adobe / illustrator	Illustrator is affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in	105d ago
CVE-2026-48736	8.6	—	—	—	sensiolabs / symfony	Symfony is a PHP framework for web and console applications and a set of reusable PHP components.	105d ago
CVE-2026-48350	8.6	—	—	—	adobe / animate	Animate is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerabi	105d ago
CVE-2026-48310	8.6	—	—	—	adobe / experience manager	Adobe Experience Manager is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Trav	105d ago
CVE-2026-48252	8.6	—	—	—	adobe / experience manager	Adobe Experience Manager is affected by a Missing Authentication for Critical Function vulnerability that could re	105d ago
CVE-2026-47988	8.6	—	—	—	adobe / commerce	Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature byp	105d ago
CVE-2026-15720	8.6	—	—	—	—	In Open5GS through version 2.7.7 a pre-authentication heap out-of-bounds read in the AMF NAS 5GS mobile-identity h	105d ago
CVE-2026-45077	8.6	—	—	—	sensiolabs / symfony	Symfony is a PHP framework for web and console applications and a set of reusable PHP components.	105d ago
CVE-2026-59835	8.6	—	—	—	fortinet / fortisandbox	A exposure of resource to wrong sphere vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.2, FortiSandbox 4.	105d ago
CVE-2026-62242	8.6	—	—	—	—	Spring Boot Admin Server before 4.1.2 contains a server-side request forgery vulnerability that allows unauthentic	106d ago
CVE-2026-61462	8.6	—	—	—	—	mcp-gitlab contains a path traversal vulnerability in the job_id parameter of build/index.js that allows attackers	106d ago
CVE-2026-57709	8.6	—	—	—	—	Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WP Swings Membersh	106d ago
CVE-2026-57389	8.6	—	—	—	—	Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Adrian Tobey Groun	106d ago
CVE-2026-12582	8.6	—	—	—	—	The Library Management System WordPress plugin before 3.5.8 does not sanitize and escape a user-supplied parameter	106d ago
CVE-2026-61426	8.6	—	—	—	—	PraisonAI before 1.7.3 contains an insecure default configuration that binds to all interfaces with no API key req	108d ago
CVE-2026-52747	8.6	—	—	—	owasp / modsecurity	ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx.	109d ago
CVE-2026-55638	8.6	—	—	—	—	9Router is an AI router & token saver.	109d ago
CVE-2026-56261	8.6	—	—	—	kidocode / crawl4ai	Crawl4AI before 0.8.7 contains a server-side request forgery (SSRF) vulnerability in the Docker API server's /craw	109d ago
CVE-2026-55604	8.6	—	—	—	—	DeepSeek MCP Server is an MCP server for DeepSeek V4.	110d ago
CVE-2026-60105exploited	8.6	1.5%	1/3	+61d	—	Monsta FTP before 2.14.5 contains a server-side request forgery vulnerability in the fetchRemoteFile action caused	111d ago
CVE-2026-58192	8.6	—	—	—	appium / appium\/storage-plugin	Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDriver protocol.	111d ago
CVE-2026-55418	8.6	—	—	—	—	FastGPT is an open source AI knowledge base platform.	112d ago
CVE-2026-59707	8.6	—	—	—	—	LocalAI contains an unauthenticated server-side request forgery vulnerability in the POST /models/apply endpoint t	112d ago
CVE-2026-57573	8.6	—	—	—	kidocode / crawl4ai	Crawl4AI is an open-source LLM-friendly web crawler and scraper.	113d ago
CVE-2026-4249	8.6	—	—	—	wso2 / api control plane	The throttling event handling mechanism in multiple WSO2 products accepts user-supplied JSON payloads without suffi	113d ago
CVE-2026-55117	8.6	—	—	—	ui / unifi access	A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi Access Ap	117d ago
CVE-2026-54408	8.6	—	—	—	ui / unifi protect	A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi	117d ago
CVE-2026-54407	8.6	—	—	—	ui / unifi protect	A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi	117d ago
CVE-2026-54403	8.6	—	—	—	ui / unifi os server	A malicious actor with access to the network could exploit a Path Traversal vulnerability found in certain devices	117d ago
CVE-2026-13849	8.6	—	—	—	google / chrome	Insufficient validation of untrusted input in Chromoting in Google Chrome on Windows prior to 150.0.7871.47 allowe	119d ago
CVE-2026-48285	8.6	—	—	—	adobe / coldfusion	ColdFusion versions 2025.9, 2023.20 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability	119d ago
CVE-2026-11590	8.6	—	—	—	—	The WP Support Plus Responsive Ticket System WordPress plugin through 9.1.2 does not sanitize user-supplied array	119d ago
CVE-2026-56285	8.6	—	—	—	—	Nitter's /video media proxy endpoint fails to validate target URLs against Twitter/X domains and uses a hardcoded	120d ago

Sources: NIST National Vulnerability Database (descriptions, CVSS, CPE); CISA KEV, ENISA EUVD, CIRCL and VulnCheck (exploitation status, three catalogues counted; CIRCL shown as an aggregator); FIRST EPSS (exploitation probability). Patch window is the gap between CVE publication and the earliest KEV listing, so a negative value means a catalogue called it exploited before it was disclosed. Data refreshes every five hours.

Loading

CVE Tracker