CVE Tracker: vulnerabilities by vendor, severity and exploitation status

CVE Tracker

15,513 records

Every published CVE from the last 120 days with CVSS score, vendor and product, cross-referenced against CISA's Known Exploited Vulnerabilities catalog. 6 added to KEV in the last 7 days.

SeverityAll critical high medium lowExploitedIn CISA KEV

CVE	CVSS	EPSS	KEV sources	Patch window	Vendor / product	Summary	Published
CVE-2026-49824	8.5	—	—	—	—	Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and	139d ago
CVE-2026-45549	8.5	—	—	—	—	Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers.	139d ago
CVE-2026-47201	8.5	—	—	—	goauthentik / authentik	authentik is an open-source identity provider.	147d ago
CVE-2026-49120	8.5	—	—	—	—	Medplum before 5.1.14 contains a server-side request forgery vulnerability in the subscription worker that allows	147d ago
CVE-2026-9330	8.5	—	—	—	ibm / websphere application server	IBM WebSphere Application Server 9.0, and 8.5 is affected by an improper validation of user-supplied data during de	148d ago
CVE-2026-35563	8.5	—	—	—	apache / directory ldap api	It was identified that the LDAP client implementation in version 2.1.7 does not verify if the server certificate m	148d ago
CVE-2026-49489	8.5	—	—	—	—	OpenCATS through 0.9.7.4 contains a sql injection vulnerability in the sortDirection parameter of the DataGrid com	149d ago
CVE-2026-46372	8.5	—	—	—	—	SillyTavern is a locally installed user interface that allows users to interact with text generation large languag	151d ago
CVE-2026-44850	8.5	—	—	—	portainer / portainer	Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be	152d ago
CVE-2026-46820	8.5	—	—	—	oracle / financials common modules	Vulnerability in the Oracle Financials Common Modules product of Oracle E-Business Suite (component: Common Compon	152d ago
CVE-2026-44797	8.5	—	—	—	networktocode / nautobot	Nautobot is a Network Source of Truth and Network Automation Platform.	152d ago
CVE-2026-48153	8.5	—	—	—	—	Budibase is an open-source low-code platform.	153d ago
CVE-2026-49046	8.5	—	—	—	—	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arjun Thakur	153d ago
CVE-2026-42730exploited	8.5	0.26%	1/3	+139d	—	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Stylemix Mas	153d ago
CVE-2026-44706	8.5	—	—	—	—	Chatwoot is a customer engagement suite.	154d ago
CVE-2026-48837	8.5	—	—	—	—	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Unlimited El	155d ago
CVE-2026-3515	8.5	—	—	—	—	A vulnerability in the `GitHubRepository` block of the `prefect-github` integration in Prefect version 3.6.18 allow	156d ago
CVE-2026-45401	8.5	—	—	—	openwebui / open webui	Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline.	165d ago
CVE-2026-45400	8.5	—	—	—	openwebui / open webui	Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline.	165d ago
CVE-2026-45331	8.5	—	—	—	openwebui / open webui	Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline.	165d ago
CVE-2026-43998	8.5	—	—	—	vm2 project / vm2	vm2 is an open source vm/sandbox for Node.js.	167d ago
CVE-2026-44015	8.5	—	—	—	nginxui / nginx ui	Nginx UI is a web user interface for the Nginx web server.	168d ago
CVE-2026-43989	8.5	—	—	—	—	JunoClaw is an agentic AI platform built on Juno Network.	168d ago
CVE-2026-45214	8.5	—	—	—	—	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Xpro Xpro El	168d ago
CVE-2026-45211	8.5	—	—	—	—	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Saad Iqbal A	168d ago
CVE-2026-42742	8.5	—	—	—	—	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aman Views f	168d ago
CVE-2026-42741	8.5	—	—	—	—	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aman Ninja F	168d ago
CVE-2026-42860	8.5	—	—	—	openedx / edx-enterprise	The Open edx Enterprise Service app provides enterprise features to the Open edX platform.	169d ago
CVE-2026-42858	8.5	—	—	—	openedx / openedx	Open edX Platform enables the authoring and delivery of online learning at any scale.	169d ago
CVE-2026-42612	8.5	—	—	—	getgrav / grav	Grav is a file-based Web platform.	169d ago
CVE-2026-32710	8.5	—	—	—	mariadb / mariadb	MariaDB server is a community developed fork of MySQL server.	221d ago
CVE-2026-32433	8.5	—	—	—	—	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in codepeople C	228d ago
CVE-2026-32422	8.5	—	—	—	—	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in levelfourdev	228d ago
CVE-2026-32399	8.5	—	—	—	—	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in David Lingre	228d ago
CVE-2026-32368	8.5	—	—	—	—	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in delphiknight	228d ago
CVE-2026-32366	8.5	—	—	—	—	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in robfelty Col	228d ago
CVE-2026-32365	8.5	—	—	—	—	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in robfelty Col	228d ago
CVE-2026-31922	8.5	—	—	—	—	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ays Pro Fox	228d ago
CVE-2026-31917	8.5	—	—	—	—	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in weDevs WP ER	228d ago
CVE-2026-32246	8.5	—	—	—	tinyauth / tinyauth	Tinyauth is an authentication and authorization server.	229d ago
CVE-2025-12737	8.4	—	—	—	—	The administrative operations within the Carbon Console do not adequately validate specific user-supplied input.	54d ago
CVE-2026-80753	8.4	—	—	—	—	In the Linux kernel, the following vulnerability has been resolved: ovpn: run deferred work on a module-owned work	54d ago
CVE-2026-80752	8.4	—	—	—	—	In the Linux kernel, the following vulnerability has been resolved: Input: psxpad-spi - set driver data before use	54d ago
CVE-2026-80750	8.4	—	—	—	—	In the Linux kernel, the following vulnerability has been resolved: pmdomain: mediatek: fix remaining %pOF after o	54d ago
CVE-2026-80745	8.4	—	—	—	—	In the Linux kernel, the following vulnerability has been resolved: regulator: fp9931: Fix VPOS/VNEG voltage selec	54d ago
CVE-2026-73781	8.4	—	—	—	hpe / arubaos-cx	A vulnerability in the web-based management interface of AOS-CX could allow an authenticated remote attacker to co	56d ago
CVE-2026-82862	8.4	—	—	—	—	Hulumi versions before v1.3.2 resolve the threat-model helper script from an unsafe root, allowing workspace files	57d ago
CVE-2026-80723	8.4	—	—	—	—	In the Linux kernel, the following vulnerability has been resolved: of: reserved_mem: prevent OOB when too many dy	60d ago
CVE-2026-80713	8.4	—	—	—	—	In the Linux kernel, the following vulnerability has been resolved: io_uring: preserve task restrictions across ex	60d ago
CVE-2026-80712	8.4	—	—	—	—	In the Linux kernel, the following vulnerability has been resolved: spi: spi-qpic-snand: write the feature value b	60d ago
CVE-2026-80678	8.4	—	—	—	—	In the Linux kernel, the following vulnerability has been resolved: i2c: imx: Fix slave registration race and erro	60d ago
CVE-2026-80653	8.4	—	—	—	—	In the Linux kernel, the following vulnerability has been resolved: scsi: hisi_sas: Add slave_destroy interface fo	60d ago
CVE-2026-80596	8.4	—	—	—	—	In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - only expose sysfs attributes	60d ago
CVE-2026-80593	8.4	—	—	—	—	In the Linux kernel, the following vulnerability has been resolved: hwmon: (asus_atk0110) Check package count befo	60d ago
CVE-2026-81683	8.4	—	—	—	jahlives / openssl encrypt	openssl_encrypt (pip package openssl-encrypt) versions 1.4.8 and earlier store an mTLS client private key in clear	61d ago
CVE-2026-81097	8.4	—	—	—	—	The execute_ruby tool is documented as a read-only Ruby sandbox and is enforced by a pattern denylist together wit	61d ago
CVE-2026-80427	8.4	—	—	—	—	bestzip builds the argument list for the system zip utility without separating options from operands.	62d ago
CVE-2026-80584	8.4	—	—	—	—	In the Linux kernel, the following vulnerability has been resolved: s390/qeth: validate user buffer length in SNMP	62d ago
CVE-2026-80574	8.4	—	—	—	—	In the Linux kernel, the following vulnerability has been resolved: Input: focaltech - fix array out-of-bounds in	62d ago
CVE-2026-80536	8.4	—	—	—	—	In the Linux kernel, the following vulnerability has been resolved: xfs: bounds-check buffer log item's dirty bitm	62d ago

Sources: NIST National Vulnerability Database (descriptions, CVSS, CPE); CISA KEV, ENISA EUVD, CIRCL and VulnCheck (exploitation status, three catalogues counted; CIRCL shown as an aggregator); FIRST EPSS (exploitation probability). Patch window is the gap between CVE publication and the earliest KEV listing, so a negative value means a catalogue called it exploited before it was disclosed. Data refreshes every five hours.

Loading

CVE Tracker