CVE Tracker: vulnerabilities by vendor, severity and exploitation status

CVE Tracker

15,513 records

Every published CVE from the last 120 days with CVSS score, vendor and product, cross-referenced against CISA's Known Exploited Vulnerabilities catalog. 6 added to KEV in the last 7 days.

SeverityAll critical high medium lowExploitedIn CISA KEV

CVE	CVSS	EPSS	KEV sources	Patch window	Vendor / product	Summary	Published
CVE-2026-17633	8.5	—	—	—	langflow / langflow	IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary code due to	83d ago
CVE-2026-17624	8.5	—	—	—	langflow / langflow	IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 thr	83d ago
CVE-2026-9077	8.5	—	—	—	langflow / langflow	IBM Langflow OSS 1.0.0 through 1.10.3 Langflow allows remote authenticated attackers to bypass localhost-only restr	83d ago
CVE-2026-17617	8.5	—	—	—	ibm / application gateway operator	IBM Application Gateway Operator 22.2 through 26.06 is vulnerable to Server-Side Request Forgery (SSRF) due to ins	83d ago
CVE-2026-9203	8.5	—	—	—	progress / marklogic server	A server-side request forgery vulnerability in Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authent	83d ago
CVE-2026-71280	8.5	—	—	—	—	go-shiori's DownloadBookmark (internal/core/download.go) fetches a caller-supplied bookmark URL using a plain http	83d ago
CVE-2026-71274	8.5	—	—	—	—	OpenBK7231T's CHANNEL_SetLabel (src/cmnds/cmd_channels.c) stores channel labels received via the MQTT SetChannelLa	83d ago
CVE-2026-71272	8.5	—	—	—	—	Memos' webhook dispatch function safeDialContext (internal/webhook/webhook.go) resolves the target hostname via ne	83d ago
CVE-2026-71271	8.5	—	—	—	—	Memos' webhook URL validation, isReservedIP (internal/webhook/validate.go), checks a candidate IP against a reserv	83d ago
CVE-2026-10079	8.5	—	—	—	—	A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS).	88d ago
CVE-2026-62246	8.5	—	—	—	—	Kamaji is the Hosted Control Plane Manager for Kubernetes.	89d ago
CVE-2026-11536	8.5	—	—	—	ibm / websphere application server	IBM WebSphere Application Server 9.0, and 8.5 is affected by a remote code execution vulnerability in the SOAP/JMX	89d ago
CVE-2026-66415	8.5	—	—	—	—	Leantime 3.6.2 contains a server-side request forgery and local file inclusion vulnerability that allows authentic	89d ago
CVE-2026-57862	8.5	—	—	—	—	Kanboard 1.2.52 and prior contains a server-side request forgery vulnerability that allows authenticated users to	89d ago
CVE-2026-6267	8.5	—	—	—	gitlab / gitlab	GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1.0 before 19.0.5, 19.1 before 19.1.3	90d ago
CVE-2026-67428	8.5	—	—	—	—	Flyto2 Core is an execution kernel for automation and AI-agent workflows.	90d ago
CVE-2026-67424	8.5	—	—	—	—	Flyto2 Core is an execution kernel for automation and AI-agent workflows.	90d ago
CVE-2026-49332	8.5	—	—	—	—	A flaw was found in openshift/oauth-proxy.	91d ago
CVE-2026-17192	8.5	—	—	—	—	A VCO feature does not sufficiently validate caller-supplied input, allowing requests to be made on behalf of auth	92d ago
CVE-2026-59551	8.5	—	—	—	—	Subscriber SQL Injection in rtMedia for WordPress, BuddyPress and bbPress <= 4.7.10 versions.	92d ago
CVE-2026-17107	8.5	—	—	—	—	A flaw was found in the cluster-proxy service-proxy component used in Red Hat Advanced Cluster Management for Kube	95d ago
CVE-2026-56167	8.5	—	—	—	microsoft / azure ai search	Server-side request forgery (ssrf) in Azure AI Search allows an authorized attacker to elevate privileges over a n	96d ago
CVE-2026-65895	8.5	—	—	—	—	Grav API Plugin versions before 1.0.10 fail to restrict write access to security-critical plugin configuration sco	96d ago
CVE-2026-65526	8.5	—	—	—	—	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeisle Vi	96d ago
CVE-2026-65454	8.5	—	—	—	—	Contributor SQL Injection in Quiz And Survey Master <= 11.2.0 versions.	96d ago
CVE-2026-65451	8.5	—	—	—	—	Contributor SQL Injection in MapSVG <= 8.14.0 versions.	96d ago
CVE-2026-65450	8.5	—	—	—	—	Contributor SQL Injection in MapSVG <= 8.14.0 versions.	96d ago
CVE-2026-25405	8.5	—	—	—	—	Contributor SQL Injection in eRoom <= 1.7.1 versions.	96d ago
CVE-2026-24552	8.5	—	—	—	—	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in John-Michael	96d ago
CVE-2026-62513	8.5	—	—	—	oracle / e-business suite	Vulnerability in the Oracle Process Manufacturing Regulatory Management product of Oracle E-Business Suite (compon	98d ago
CVE-2026-61312	8.5	—	—	—	oracle / product hub	Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations).	98d ago
CVE-2026-60452	8.5	—	—	—	oracle / webcenter content	Vulnerability in the WebCenter Content: Imaging product of Oracle Fusion Middleware (component: Core).	98d ago
CVE-2026-60444	8.5	—	—	—	oracle / webcenter content	Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).	98d ago
CVE-2026-60426	8.5	—	—	—	oracle / unified directory	Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD Core).	98d ago
CVE-2026-60420	8.5	—	—	—	oracle / unified directory	Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD Core).	98d ago
CVE-2026-60330	8.5	—	—	—	oracle / identity manager	Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI).	98d ago
CVE-2026-60295	8.5	—	—	—	oracle / coherence	Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core).	98d ago
CVE-2026-60193	8.5	—	—	—	oracle / mysql connector\/net	Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Net).	98d ago
CVE-2026-47033	8.5	—	—	—	oracle / e-business suite	Vulnerability in the Oracle Contracts Integration product of Oracle E-Business Suite (component: Internal Operatio	98d ago
CVE-2026-47198	8.5	—	—	—	—	Paymenter is a free and open-source webshop solution for management of hosting services.	99d ago
CVE-2024-58366	8.5	—	—	—	delskayn / rquickjs	SurrealDB before 1.1.1 contains a format string vulnerability in the rquickjs Exception::throw_type function when	101d ago
CVE-2026-62226	8.5	—	—	—	openclaw / openclaw	OpenClaw 2026.3.28 before 2026.5.19 contain an authorization bypass vulnerability in the browser act route that fa	103d ago
CVE-2026-55234	8.5	—	—	—	—	Wekan is open source kanban built with Meteor.	104d ago
CVE-2026-61430	8.5	—	—	—	—	PraisonAI before 1.6.78 contains a server-side request forgery vulnerability in the web_crawl tool that validates	104d ago
CVE-2026-48320	8.5	—	—	—	adobe / coldfusion	ColdFusion is affected by a reflected Cross-Site Scripting (XSS) vulnerability.	105d ago
CVE-2026-15738	8.5	—	—	—	—	Incorrect behavior order in the Gateway API listener-rule generation in Amazon AWS Load Balancer Controller before	105d ago
CVE-2026-50340	8.5	—	—	—	microsoft / windows 11 24h2	Use after free in Windows Runtime allows an authorized attacker to elevate privileges over a network.	105d ago
CVE-2026-62197	8.5	—	—	—	openclaw / openclaw	OpenClaw before 2026.6.6 contains a policy bypass vulnerability in browser CDP discovery that accepts blocked WebS	106d ago
CVE-2026-57810	8.5	—	—	—	—	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Saad Iqbal A	106d ago
CVE-2026-57787	8.5	—	—	—	—	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CreativeWS C	106d ago
CVE-2026-57772	8.5	—	—	—	—	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Inventory	106d ago
CVE-2026-57771	8.5	—	—	—	—	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Milan Petrov	106d ago
CVE-2026-57385	8.5	—	—	—	—	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in appsbd Vitep	106d ago
CVE-2026-61429	8.5	—	—	—	—	PraisonAI versions before 1.6.78 contain a server-side request forgery vulnerability in the Crawl4AI/Chromium back	108d ago
CVE-2026-55789	8.5	—	—	—	—	Logto is the modern, open-source auth infrastructure for SaaS and AI apps.	109d ago
CVE-2026-54329	8.5	—	—	—	snipeitapp / snipe-it	Snipe-IT is an IT asset/license management system.	109d ago
CVE-2026-56690	8.5	—	—	—	dell / powerflex manager	Dell PowerFlex Manager, Version prior to 5.1.0.1, contain(s) an Improper Neutralization of Special Elements used i	109d ago
CVE-2026-56003	8.5	—	—	—	x / libxfont	A heap buffer overflow due to missing size checking in the property buffer when parsing PCF files in libXfont2 Com	111d ago
CVE-2026-56002	8.5	—	—	—	x / libxfont	A heap bufferflow in pcfReadFont() due to missing glyph bounds checking in libXfont2 before 2.0.8 allows attackers	111d ago
CVE-2026-56001	8.5	—	—	—	x / libxfont	A heap buffer overflow in BitmapScaleBitmaps in libXfont2 before 2.0.8 due to an overflowing 32bit size could be u	111d ago

Sources: NIST National Vulnerability Database (descriptions, CVSS, CPE); CISA KEV, ENISA EUVD, CIRCL and VulnCheck (exploitation status, three catalogues counted; CIRCL shown as an aggregator); FIRST EPSS (exploitation probability). Patch window is the gap between CVE publication and the earliest KEV listing, so a negative value means a catalogue called it exploited before it was disclosed. Data refreshes every five hours.

Loading

CVE Tracker