CVE Tracker: vulnerabilities by vendor, severity and exploitation status

CVE Tracker

15,513 records

Every published CVE from the last 120 days with CVSS score, vendor and product, cross-referenced against CISA's Known Exploited Vulnerabilities catalog. 6 added to KEV in the last 7 days.

SeverityAll critical high medium lowExploitedIn CISA KEV

CVE	CVSS	EPSS	KEV sources	Patch window	Vendor / product	Summary	Published
CVE-2026-55765	8.5	—	—	—	—	CloudNativePG is a platform designed to manage PostgreSQL databases within Kubernetes environments.	68d ago
CVE-2026-46682	8.5	—	—	—	—	BigBlueButton is an open-source virtual classroom.	68d ago
CVE-2026-17168	8.5	—	—	—	ibm / vios	IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated attacker to execute arbitrary cod	68d ago
CVE-2026-74013	8.5	—	—	—	—	Subscriber SQL Injection in eShipper Commerce <= 2.16.13 versions.	68d ago
CVE-2026-73998	8.5	—	—	—	—	Subscriber SQL Injection in WP w3all phpBB <= 3.0.5 versions.	68d ago
CVE-2026-66594	8.5	—	—	—	—	Subscriber SQL Injection in WordPress Persistent Login <= 3.1.0 versions.	68d ago
CVE-2026-68558	8.5	—	—	—	—	Wekan is open source kanban built with Meteor.	69d ago
CVE-2026-66668	8.5	—	—	—	—	Subscriber SQL Injection in Community by PeepSo <= 9.0.5.2 versions.	69d ago
CVE-2026-32552	8.5	—	—	—	—	Subscriber SQL Injection in YITH WooCommerce Membership Premium <= 2.33.0 versions.	69d ago
CVE-2026-11565exploited	8.5	1.3%	1/3	+68d	—	The Advanced File Manager WordPress plugin before 5.4.13 does not perform capability checks in several of its file	69d ago
CVE-2026-71155	8.5	—	—	—	oracle / helidon	Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server).	70d ago
CVE-2026-71062	8.5	—	—	—	oracle / database server	Vulnerability in the RDBMS component of Oracle Database Server.	70d ago
CVE-2026-71057	8.5	—	—	—	oracle / bi publisher	Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Platform Security).	70d ago
CVE-2026-71049	8.5	—	—	—	oracle / product lifecycle analytics	Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply Chain (component: Installation Is	70d ago
CVE-2026-71002	8.5	—	—	—	oracle / commerce experience manager	Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce	70d ago
CVE-2026-70885	8.5	—	—	—	oracle / hyperion data relationship management	Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access an	70d ago
CVE-2026-70859	8.5	—	—	—	oracle / siebel crm	Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: REST).	70d ago
CVE-2026-70807	8.5	—	—	—	oracle / e-business suite	Vulnerability in the Oracle Call Center Technology product of Oracle E-Business Suite (component: Internal Operati	70d ago
CVE-2026-70728	8.5	—	—	—	oracle / autonomous health framework	Vulnerability in Oracle Autonomous Health Framework (component: Trace File Analyzer).	70d ago
CVE-2026-70718	8.5	—	—	—	oracle / bills of material	Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite (component: Internal Operations).	70d ago
CVE-2026-62615	8.5	—	—	—	oracle / reports developer	Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Security and Authent	70d ago
CVE-2026-62596	8.5	—	—	—	oracle / siebel crm	Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: Open Integration).	70d ago
CVE-2026-62590	8.5	—	—	—	oracle / siebel crm	Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: Open Integration).	70d ago
CVE-2026-61326	8.5	—	—	—	oracle / siebel crm	Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager).	70d ago
CVE-2026-61212	8.5	—	—	—	oracle / webcenter portal	Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools).	70d ago
CVE-2026-60849	8.5	—	—	—	oracle / unified directory	Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD Core).	70d ago
CVE-2026-60841	8.5	—	—	—	oracle / unified directory	Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD Core).	70d ago
CVE-2026-60798	8.5	—	—	—	oracle / siebel crm	Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Migration).	70d ago
CVE-2026-60758	8.5	—	—	—	oracle / siebel artificial intelligence	Vulnerability in the Siebel Artificial Intelligence product of Oracle Siebel CRM (component: AI).	70d ago
CVE-2026-75898	8.5	—	—	—	—	RAGFlow before 0.26.3 contains a server-side request forgery vulnerability in the agent workflow "Invoke" componen	70d ago
CVE-2026-32466	8.5	—	—	—	—	Subscriber SQL Injection in Gravity Forms Bookings premium <= 2.1 versions.	70d ago
CVE-2026-73410	8.5	—	—	—	—	Budibase is an open-source low-code platform.	71d ago
CVE-2026-57485	8.5	—	—	—	—	Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files.	71d ago
CVE-2026-17179	8.5	—	—	—	ibm / db2 mirror for i	IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to cause a denial of service du	74d ago
CVE-2026-72855	8.5	—	—	—	—	Budibase before 3.40.0 contains server-side request forgery vulnerabilities in OpenAPI query import and REST query	75d ago
CVE-2026-73654	8.5	—	—	—	—	Trigger.dev is a platform for building and deploying fully managed AI agents and workflows.	75d ago
CVE-2026-16967	8.5	—	—	—	ibm / i	IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to gain unauthorized access to system obj	75d ago
CVE-2026-16908	8.5	—	—	—	ibm / i	IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to gain unauthorized access to arbitrary	75d ago
CVE-2026-57894	8.5	—	—	—	—	Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository	75d ago
CVE-2026-66658	8.5	—	—	—	—	Subscriber SQL Injection in Reviewer <= 3.14.2 versions.	75d ago
CVE-2026-66430	8.5	—	—	—	—	Subscriber SQL Injection in Visitor Traffic Real Time Statistics Pro <= 11.10 versions.	75d ago
CVE-2026-28168	8.5	—	—	—	—	Subscriber SQL Injection in CubeWP <= 1.1.30 versions.	75d ago
CVE-2026-28156	8.5	—	—	—	—	Subscriber SQL Injection in Do Lasso <= 358 versions.	75d ago
CVE-2026-28002	8.5	—	—	—	—	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arraytics Bo	75d ago
CVE-2026-73629	8.5	—	—	—	—	Serendipity before 2.6.0 contains a server-side request forgery vulnerability in the serendipity_url_allowed() fil	75d ago
CVE-2026-71473	8.5	—	—	—	—	A flaw was found in the `search-v2-operator` component.	76d ago
CVE-2026-16033	8.5	—	—	—	—	A path traversal vulnerability in LXD allows an attacker to achieve arbitrary host file read or unconstrained file	76d ago
CVE-2026-19228	8.5	—	—	—	gitlab / gitlab	GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.4 and 19.2 before 19.2.2	76d ago
CVE-2026-17418	8.5	—	—	—	ibm / i	IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to cause a denial of service due to improp	76d ago
CVE-2026-15423	8.5	—	—	—	gitlab / gitlab	GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.0 before 19.0.6, 19.1 before 19.1.4,	76d ago
CVE-2026-73079	8.5	—	—	—	—	Sub2API is an AI API gateway platform designed to distribute and manage API quotas from AI product subscriptions.	77d ago
CVE-2026-51583	8.5	—	—	—	—	An issue in usememos through v0.30.0 allows a remote authenticated attacker to perform Server-Side Request Forgery	77d ago
CVE-2026-16053	8.5	—	—	—	—	Zohocorp ManageEngine M365 Manager Plus and M365 Security Plus versions below 4820 are affected to Authenticated P	77d ago
CVE-2026-18947	8.5	—	—	—	—	A flaw was found in Feast.	78d ago
CVE-2026-71576	8.5	—	—	—	—	A flaw was found in multicluster-global-hub.	78d ago
CVE-2026-45414	8.5	—	—	—	—	Decidim is a participatory democracy framework.	82d ago
CVE-2026-18359	8.5	—	—	—	escriptorium / escriptorium	Server-side request forgery in the METS and IIIF import URI handling in Scripta eScriptorium through 26.04.1 allow	82d ago
CVE-2026-65569	8.5	—	—	—	—	Subscriber SQL Injection in WP Job Portal <= 2.5.6 versions.	82d ago
CVE-2026-65547	8.5	—	—	—	—	Subscriber SQL Injection in Creative Mail <= 1.6.9 versions.	82d ago
CVE-2026-18597	8.5	—	—	—	—	The PDF creation feature of Foxit PDF Services API supports referencing external files.	82d ago

Sources: NIST National Vulnerability Database (descriptions, CVSS, CPE); CISA KEV, ENISA EUVD, CIRCL and VulnCheck (exploitation status, three catalogues counted; CIRCL shown as an aggregator); FIRST EPSS (exploitation probability). Patch window is the gap between CVE publication and the earliest KEV listing, so a negative value means a catalogue called it exploited before it was disclosed. Data refreshes every five hours.

Loading

CVE Tracker