CVE Tracker: vulnerabilities by vendor, severity and exploitation status

CVE Tracker

15,513 records

Every published CVE from the last 120 days with CVSS score, vendor and product, cross-referenced against CISA's Known Exploited Vulnerabilities catalog. 6 added to KEV in the last 7 days.

SeverityAll critical high medium lowExploitedIn CISA KEV

CVE	CVSS	EPSS	KEV sources	Patch window	Vendor / product	Summary	Published
CVE-2026-55999	8.5	—	—	—	x.org / x server	Local attackers with a X connection able to provide PCX fonts to the X server xorg-server before 21.2.24 and xwayl	111d ago
CVE-2026-54765	8.5	—	—	—	traefik / traefik	Traefik is an open source HTTP reverse proxy and load balancer.	113d ago
CVE-2025-53828	8.5	—	—	—	—	SharePoint for ownCloud is an application for using SharePoint with the file storage, synchronization, and sharing	113d ago
CVE-2026-26231	8.5	—	—	—	—	Gitea versions up to and including 1.26.1 allow the Allow edits from maintainers permission path to authorize comm	116d ago
CVE-2026-10055	8.5	—	—	—	—	In Eclipse Theia since version 1.26.0, the backend /services/request-service RPC accepts an attacker-controlled UR	116d ago
CVE-2026-57765	8.5	—	—	—	—	Contributor SQL Injection in WP EasyCart <= 5.9.0 versions.	117d ago
CVE-2026-57756	8.5	—	—	—	—	Contributor SQL Injection in nicen-localize-image <= 1.4.9 versions.	117d ago
CVE-2026-57752	8.5	—	—	—	—	Contributor SQL Injection in iNET Webkit 1.2.4 versions.	117d ago
CVE-2026-57687	8.5	—	—	—	—	Contributor SQL Injection in Custom Field Template <= 2.7.8 versions.	117d ago
CVE-2025-69094	8.5	—	—	—	—	Subscriber SQL Injection in Unicamp <= 2.2.2 versions.	117d ago
CVE-2026-24260	8.5	—	—	—	—	NVIDIA Container Toolkit for Linux contains a vulnerability where an attacker could cause a time-of-check time-of-	118d ago
CVE-2026-11594	8.5	—	—	—	ibm / websphere application server	IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site scripting vulnerability in the administr	119d ago
CVE-2026-11714	8.5	—	—	—	ibm / websphere application server	IBM WebSphere Application Server Liberty is affected by a server-side request forgery vulnerability with the apiDi	119d ago
CVE-2026-10129	8.5	—	—	—	langflow / langflow	IBM Langflow OSS 1.0.0 through 1.9.3 contains a Server-Side Request Forgery (SSRF) protection bypass vulnerability	119d ago
CVE-2026-57955	8.5	—	—	—	—	SigNoz through 0.130.1 contains a SQL injection vulnerability that allows authenticated attackers to execute arbit	120d ago
CVE-2026-57947	8.5	—	—	—	—	Pinpoint through 3.1.0 contains a server-side request forgery vulnerability in the webhook registration endpoint t	120d ago
CVE-2026-54353	8.5	—	—	—	budibase / budibase	Budibase is an open-source low-code platform.	123d ago
CVE-2026-56663	8.5	—	—	—	—	AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence	123d ago
CVE-2026-57667	8.5	—	—	—	—	Sales Representative SQL Injection in Groundhogg <= 4.5 versions.	123d ago
CVE-2026-57663	8.5	—	—	—	—	Contributor SQL Injection in Recipe Maker For Your Food Blog from Zip Recipes <= 8.2.7 versions.	123d ago
CVE-2026-57662	8.5	—	—	—	—	Contributor SQL Injection in Contest Gallery <= 30.0.0 versions.	123d ago
CVE-2026-57653	8.5	—	—	—	—	Contributor SQL Injection in WP Job Portal <= 2.5.2 versions.	123d ago
CVE-2026-57644	8.5	—	—	—	—	Contributor SQL Injection in Restaurant Menu by MotoPress <= 2.4.10 versions.	123d ago
CVE-2026-57643	8.5	—	—	—	—	Contributor SQL Injection in WP Post Author <= 3.9.1 versions.	123d ago
CVE-2026-57642	8.5	—	—	—	—	Contributor SQL Injection in Gallery <= 4.7.8 versions.	123d ago
CVE-2026-57636	8.5	—	—	—	—	Contributor SQL Injection in wpForo Forum <= 3.0.9 versions.	123d ago
CVE-2026-57315	8.5	—	—	—	—	Contributor Remote Code Execution (RCE) in Blocksy Companion Pro <= 2.1.45 versions.	123d ago
CVE-2026-56064	8.5	—	—	—	—	Subscriber SQL Injection in Tourfic <= 2.22.5 versions.	123d ago
CVE-2026-12975	8.5	—	—	—	redhat / build of apicurio registry	A flaw was found in Apicurio Registry.	124d ago
CVE-2026-56771	8.5	—	—	—	—	NewsBlur before version 14.5.0 contains a server-side request forgery vulnerability in the add_url endpoint that a	124d ago
CVE-2026-56769	8.5	—	—	—	—	Huly Platform through 0.7.423, fixed in commit 68cbf8a contains an authenticated server-side request forgery vulne	124d ago
CVE-2026-56049	8.5	—	—	—	—	Contributor Remote Code Execution (RCE) in Post Snippets <= 4.0.19 versions.	124d ago
CVE-2026-54838	8.5	—	—	—	—	Subscriber SQL Injection in WC Vendors Marketplace <= 2.6.8 versions.	124d ago
CVE-2026-54822	8.5	—	—	—	—	Subscriber SQL Injection in SALESmanago & Leadoo <= 3.11.2 versions.	124d ago
CVE-2026-52797	8.5	—	—	—	—	Gogs is an open source self-hosted Git service.	125d ago
CVE-2026-45687	8.5	—	—	—	—	Rocket.Chat is an open-source, secure, fully customizable communications platform.	125d ago
CVE-2026-54008	8.5	—	—	—	openwebui / open webui	Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline.	126d ago
CVE-2026-49444	8.5	—	—	—	n8n / n8n	n8n is an open source workflow automation platform.	126d ago
CVE-2026-54312	8.5	—	—	—	n8n / n8n	n8n is an open source workflow automation platform.	126d ago
CVE-2026-56012	8.5	—	—	—	—	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in David Lingre	131d ago
CVE-2026-54818	8.5	—	—	—	—	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VeronaLabs S	132d ago
CVE-2026-54813	8.5	—	—	—	—	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Brainstorm F	132d ago
CVE-2026-54185	8.5	—	—	—	—	Subscriber SQL Injection in Cornerstone < 7.8.8 versions.	132d ago
CVE-2026-49113	8.5	—	—	—	—	Subscriber Arbitrary Code Execution in Cornerstone < 7.8.8 versions.	132d ago
CVE-2026-49073	8.5	—	—	—	—	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpWax Direct	132d ago
CVE-2026-48967	8.5	—	—	—	—	Subscriber SQL Injection in Geo Mashup <= 1.13.19 versions.	132d ago
CVE-2026-22335	8.5	—	—	—	—	Subscriber SQL Injection in WooCommerce Frontend Manager – Ultimate < 6.7.7 versions.	132d ago
CVE-2025-69135	8.5	—	—	—	—	Subscriber SQL Injection in Events Schedule - WordPress Events Calendar Plugin <= 2.7.2 versions.	132d ago
CVE-2026-46915	8.5	—	—	—	oracle / complex maintenance repair and overhaul	Vulnerability in the Oracle Complex Maintenance, Repair and Overhaul product of Oracle E-Business Suite (component	132d ago
CVE-2026-46870	8.5	—	—	—	oracle / mysql shell	Vulnerability in the MySQL Shell product of Oracle MySQL (component: Shell for VS Code).	132d ago
CVE-2026-39581	8.5	—	—	—	—	Subscriber SQL Injection in WP Sessions Time Monitoring Full Automatic <= 1.1.4 versions.	133d ago
CVE-2026-52700	8.5	—	—	—	—	Subscriber SQL Injection in WCMultiShipping <= 3.0.2 versions.	134d ago
CVE-2026-52697	8.5	—	—	—	—	Subscriber SQL Injection in Taskbuilder <= 5.0.7 versions.	134d ago
CVE-2026-48964	8.5	—	—	—	—	Subscriber SQL Injection in ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.6 versions.	134d ago
CVE-2026-48882	8.5	—	—	—	—	Subscriber SQL Injection in WP Time Slots Booking Form <= 1.2.50 versions.	134d ago
CVE-2026-48874	8.5	—	—	—	—	Subscriber SQL Injection in GamiPress <= 7.8.7 versions.	134d ago
CVE-2026-40766	8.5	—	—	—	—	Subscriber SQL Injection in MasterStudy LMS <= 3.7.25 versions.	134d ago
CVE-2026-24637	8.5	—	—	—	—	Contributor SQL Injection in PowerPress Podcasting <= 11.15.10 versions.	134d ago
CVE-2026-54420zero day	8.5	1.4%	3/3	13d before	litespeedtech / litespeed cpanel plugin	LiteSpeed cPanel plugin before 2.4.8 (as distributed in LiteSpeed WHM PlugIn before 5.3.2.0) mishandles symlinks p	135d ago
CVE-2026-50570	8.5	—	—	—	—	Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and	139d ago

Sources: NIST National Vulnerability Database (descriptions, CVSS, CPE); CISA KEV, ENISA EUVD, CIRCL and VulnCheck (exploitation status, three catalogues counted; CIRCL shown as an aggregator); FIRST EPSS (exploitation probability). Patch window is the gap between CVE publication and the earliest KEV listing, so a negative value means a catalogue called it exploited before it was disclosed. Data refreshes every five hours.

Loading

CVE Tracker