CVE Tracker: vulnerabilities by vendor, severity and exploitation status

CVE Tracker

15,513 records

Every published CVE from the last 120 days with CVSS score, vendor and product, cross-referenced against CISA's Known Exploited Vulnerabilities catalog. 6 added to KEV in the last 7 days.

SeverityAll critical high medium lowExploitedIn CISA KEV

CVE	CVSS	EPSS	KEV sources	Patch window	Vendor / product	Summary	Published
CVE-2026-18634	8.4	—	—	—	—	An insecure handling of serialized objects vulnerability was found in the one of the service of GMS application 9.	77d ago
CVE-2026-70130	8.4	—	—	—	microsoft / 365 apps	Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.	77d ago
CVE-2026-34635	8.4	—	—	—	adobe / coldfusion	is affected by a Use of Hard-coded Cryptographic Key vulnerability that could result in a Security feature bypass.	77d ago
CVE-2026-67180	8.4	—	—	—	—	Google Turbinia allows arbitrary command execution via worker tasks.	77d ago
CVE-2026-8718	8.4	—	—	—	—	tls_opt_dtls_peer_connection_id_value_get() in subsys/net/lib/sockets/sockets_tls.c, which handles getsockopt(SOL_T	78d ago
CVE-2026-72734	8.4	—	—	—	—	Dokploy is a free, self-hostable Platform as a Service (PaaS).	78d ago
CVE-2026-68371	8.4	—	—	—	—	In the Linux kernel, the following vulnerability has been resolved: usb: musb: omap2430: Do not put borrowed of_no	78d ago
CVE-2026-68179	8.4	—	—	—	—	In the Linux kernel, the following vulnerability has been resolved: misc: nsm: only unlock nsm_dev on post-lock er	78d ago
CVE-2026-68149	8.4	—	—	—	—	In the Linux kernel, the following vulnerability has been resolved: fs: preserve ACL_DONT_CACHE state in forget_ca	78d ago
CVE-2026-59090	8.4	—	—	—	gimp / gimp	A flaw was found in GIMP's PSD file format plugin.	78d ago
CVE-2026-55978	8.4	—	—	—	—	An improper access control vulnerability in CatchPulse could allow a non-administrative local attacker to connect	82d ago
CVE-2026-17583	8.4	—	—	—	thermofisher / abi prism 310 data collection software	The affected Thermo Fisher Applied Biosystems Genetic Analyzers are vulnerable because .fsa/.hid output files can	83d ago
CVE-2026-51400	8.4	—	—	—	vim / vim	An issue in Vim Project v9.2.0389 and earlier allows a local attacker to execute arbitrary code via the vms_fixfil	84d ago
CVE-2026-67323	8.4	—	—	—	gitpython project / gitpython	GitPython before 3.1.51 fails to guard against dangerous Git options passed as keyword arguments in Repo.archive()	87d ago
CVE-2026-10535	8.4	—	—	—	ibm / db2	IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to buffer overflow in setgid helper db2flac	89d ago
CVE-2026-11885	8.4	—	—	—	ibm / power system s1122 \(9824-22a\) firmware	IBM PowerVM Hypervisor FW1110.00 through FW1110.20, FW1060.00 through FW1060.71, and FW950.00 through FW950.H1 A c	89d ago
CVE-2026-58043	8.4	—	—	—	nodejs / node.js	A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundarie	89d ago
CVE-2026-17877	8.4	—	—	—	google / chrome	Inappropriate implementation in Chromoting in Google Chrome on Linux prior to 151.0.7922.72 allowed a local attack	90d ago
CVE-2026-17716	8.4	—	—	—	google / chrome	Use after free in Updater in Google Chrome on Mac prior to 151.0.7922.72 allowed a local attacker to perform privi	90d ago
CVE-2026-12436	8.4	—	—	—	gitlab / gitlab	GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.0 before 19.0.5, 19.1 before 19.1.3,	90d ago
CVE-2026-64552	8.4	—	—	—	—	In the Linux kernel, the following vulnerability has been resolved: virtio-net: fix len check in receive_big() rec	92d ago
CVE-2026-64548	8.4	—	—	—	—	In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: reject overflowing copy + len in	92d ago
CVE-2026-66396	8.4	—	—	—	—	SiYuan before v3.7.2 fails to escape the title-img Individual Attribute List value when rendering Gallery and Kanb	92d ago
CVE-2026-59688	8.4	—	—	—	progress / connection manager for objectscale	An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connec	92d ago
CVE-2026-59687	8.4	—	—	—	progress / connection manager for objectscale	An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connec	92d ago
CVE-2026-59686	8.4	—	—	—	progress / connection manager for objectscale	An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connec	92d ago
CVE-2026-64520	8.4	—	—	—	—	In the Linux kernel, the following vulnerability has been resolved: firmware: arm_ffa: Bound PARTITION_INFO_GET_RE	94d ago
CVE-2026-64490	8.4	—	—	—	—	In the Linux kernel, the following vulnerability has been resolved: ALSA: virtio: Validate control metadata from t	94d ago
CVE-2026-64247	8.4	—	—	—	linux / linux kernel	In the Linux kernel, the following vulnerability has been resolved: KVM: x86: hyper-v: Bound the bank index when q	95d ago
CVE-2026-66140	8.4	—	—	—	exim / exim	Exim before 4.99.5 allows directory traversal to access files outside of the spool area, and consequently gain pri	95d ago
CVE-2026-64809	8.4	—	—	—	jetbrains / phpstorm	In JetBrains PhpStorm before 2026.2 arbitrary code execution was possible before granting project trust via the co	96d ago
CVE-2026-64808	8.4	—	—	—	jetbrains / phpstorm	In JetBrains PhpStorm before 2026.2 arbitrary code execution was possible before granting project trust via projec	96d ago
CVE-2026-64806	8.4	—	—	—	jetbrains / webstorm	In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via the co	96d ago
CVE-2026-64805	8.4	—	—	—	jetbrains / webstorm	In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via projec	96d ago
CVE-2026-64804	8.4	—	—	—	jetbrains / webstorm	In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via projec	96d ago
CVE-2024-58023	8.4	—	—	—	—	Information disclosure in Bosch Configuration Manager in Version 7.72.0106 allows an attacker to access sensitive	96d ago
CVE-2026-60837	8.4	—	—	—	oracle / price protection	Vulnerability in the Oracle Price Protection product of Oracle E-Business Suite (component: Internal Operations).	98d ago
CVE-2026-60763	8.4	—	—	—	oracle / applications manager	Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Command Line - Rap	98d ago
CVE-2026-60723	8.4	—	—	—	oracle / data integrator	Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Market Place).	98d ago
CVE-2026-60677	8.4	—	—	—	oracle / e-business suite	Vulnerability in the Oracle Common Application Components product of Oracle E-Business Suite (component: Oracle Co	98d ago
CVE-2026-60383	8.4	—	—	—	oracle / service delivery platform	Vulnerability in the Service Delivery Platform product of Oracle Fusion Middleware (component: Messaging Enabler).	98d ago
CVE-2026-60196	8.4	—	—	—	oracle / weblogic server	Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).	98d ago
CVE-2026-60163	8.4	—	—	—	oracle / mysql server	Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication Plu	98d ago
CVE-2026-64877	8.4	—	—	—	tenable / security center	An authenticated non-admin user can exploit a SQL injection flaw in the ticketing REST API to access sensitive dat	98d ago
CVE-2026-64824	8.4	—	—	—	—	Home Assistant Core before 2026.7.0 contains a path traversal vulnerability in the backup-restore function that al	98d ago
CVE-2026-15226	8.4	—	—	—	—	A sandbox confinement bypass vulnerability exists in Canonical snapd within its internal execution environment com	98d ago
CVE-2026-28220	8.4	—	—	—	wazuh / wazuh	Wazuh is a free and open source platform used for threat prevention, detection, and response.	99d ago
CVE-2026-64151	8.4	—	—	—	linux / linux kernel	In the Linux kernel, the following vulnerability has been resolved: iommupt: Check for missing PAGE_SIZE in the pg	100d ago
CVE-2026-64118	8.4	—	—	—	linux / linux kernel	In the Linux kernel, the following vulnerability has been resolved: qed: fix double free in qed_cxt_tables_alloc()	100d ago
CVE-2026-64081	8.4	—	—	—	linux / linux kernel	In the Linux kernel, the following vulnerability has been resolved: firmware: arm_ffa: Validate framework notifica	100d ago
CVE-2026-64045	8.4	—	—	—	linux / linux kernel	In the Linux kernel, the following vulnerability has been resolved: ovpn: tcp - use cached peer pointer in ovpn_tc	100d ago
CVE-2026-63952	8.4	—	—	—	—	In the Linux kernel, the following vulnerability has been resolved: memfd: deny writeable mappings when implying S	100d ago
CVE-2026-63926	8.4	—	—	—	—	In the Linux kernel, the following vulnerability has been resolved: bpf: sockmap: fix tail fragment offset in bpf_	100d ago
CVE-2026-63906	8.4	—	—	—	—	In the Linux kernel, the following vulnerability has been resolved: usb: musb: omap2430: Fix use-after-free in oma	100d ago
CVE-2026-63864	8.4	—	—	—	—	In the Linux kernel, the following vulnerability has been resolved: bpf: Propagate error from visit_tailcall_insn	100d ago
CVE-2026-63860	8.4	—	—	—	—	In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Prefer NLA_NUL_STRING These attribu	100d ago
CVE-2026-63828	8.4	—	—	—	—	In the Linux kernel, the following vulnerability has been resolved: apparmor: mediate the implicit connect of TCP	100d ago
CVE-2026-63818	8.4	—	—	—	—	In the Linux kernel, the following vulnerability has been resolved: f2fs: validate orphan inode entry count f2fs_r	100d ago
CVE-2026-63815	8.4	—	—	—	—	In the Linux kernel, the following vulnerability has been resolved: f2fs: bound i_inline_xattr_size for non-inline	100d ago
CVE-2026-63797	8.4	—	—	—	linux / linux kernel	In the Linux kernel, the following vulnerability has been resolved: rpmsg: char: Fix use-after-free on probe error	100d ago

Sources: NIST National Vulnerability Database (descriptions, CVSS, CPE); CISA KEV, ENISA EUVD, CIRCL and VulnCheck (exploitation status, three catalogues counted; CIRCL shown as an aggregator); FIRST EPSS (exploitation probability). Patch window is the gap between CVE publication and the earliest KEV listing, so a negative value means a catalogue called it exploited before it was disclosed. Data refreshes every five hours.

Loading

CVE Tracker