CVE Tracker: vulnerabilities by vendor, severity and exploitation status

CVE Tracker

15,513 records

Every published CVE from the last 120 days with CVSS score, vendor and product, cross-referenced against CISA's Known Exploited Vulnerabilities catalog. 6 added to KEV in the last 7 days.

SeverityAll critical high medium lowExploitedIn CISA KEV

CVE	CVSS	EPSS	KEV sources	Patch window	Vendor / product	Summary	Published
CVE-2026-53369	8.4	—	—	—	linux / linux kernel	In the Linux kernel, the following vulnerability has been resolved: udf: reject descriptors with oversized CRC len	100d ago
CVE-2026-61446	8.4	—	—	—	—	PraisonAI (praisonaiagents) before 1.6.78 contains a remote code execution vulnerability in the plugin manager, wh	104d ago
CVE-2026-24233	8.4	—	—	—	—	NVIDIA TensorRT-LLM for Linux contains a vulnerability in the restricted unpickler used for model weight deseriali	105d ago
CVE-2026-55045	8.4	—	—	—	microsoft / 365 apps	Out-of-bounds read in Microsoft Office allows an unauthorized attacker to execute code locally.	105d ago
CVE-2026-54128	8.4	—	—	—	microsoft / windows 10 1607	Use after free in Windows DHCP Client allows an unauthorized attacker to execute code locally.	105d ago
CVE-2026-54992	8.4	—	—	—	microsoft / windows 10 1607	Heap-based buffer overflow in Windows Message Queuing Queue Manager allows an unauthorized attacker to execute cod	105d ago
CVE-2026-54122	8.4	—	—	—	microsoft / windows 10 1607	Heap-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code locally.	105d ago
CVE-2026-50520	8.4	—	—	—	microsoft / visual studio code	Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows a	105d ago
CVE-2026-49184	8.4	—	—	—	microsoft / windows 10 1607	Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code locally.	105d ago
CVE-2026-0487	8.4	—	—	—	—	SAProuter on Microsoft Windows allows an unauthenticated attacker to load library (DLL) files from an untrusted loc	106d ago
CVE-2026-57432	8.4	—	—	—	perl / perl	Perl versions through 5.43.10 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read i	106d ago
CVE-2026-54424	8.4	—	—	—	—	An Incorrect Use of Privileged APIs vulnerability in Unity Parsec on Windows hosts leads to a potential Elevation	116d ago
CVE-2026-44941	8.4	—	—	—	opensuse / libzypp	A relative path traversal in the "keyhint" option in repomd.xml parsing of libzypp before 17.38.12 can be used by	117d ago
CVE-2026-58302	8.4	—	—	—	—	rtapi_app in linuxcnc-uspace in LinuxCNC before 2.9.9 allows privilege escalation.	120d ago
CVE-2026-12411	8.4	—	—	—	canonical / lxd	Broken Access Control in the devLXDInstancePatchHandler component of Canonical LXD allows an untrusted guest to mo	123d ago
CVE-2026-54096	8.4	—	—	—	—	File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within	124d ago
CVE-2026-53091	8.4	—	—	—	linux / linux kernel	In the Linux kernel, the following vulnerability has been resolved: net: pull headers in qdisc_pkt_len_segs_init()	125d ago
CVE-2026-54320	8.4	—	—	—	—	Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows.	126d ago
CVE-2026-55255exploited	8.4	0.89%	3/3	+3d	langflow / langflow	Langflow is a tool for building and deploying AI-powered agents and workflows.	126d ago
CVE-2025-26240	8.4	—	—	—	—	In JazzCore python-pdfkit 1.0.0, the from_string method enables the execution of JavaScript code within the contex	132d ago
CVE-2026-46788	8.4	—	—	—	oracle / webcenter content	Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).	132d ago
CVE-2026-35272	8.4	—	—	—	oracle / peoplesoft enterprise pt peopletools	Vulnerability in the PeopleSoft Enterprise PT PeopleTools product of Oracle PeopleSoft (component: Deployment Pack	132d ago
CVE-2026-39118	8.4	—	—	—	—	An issue in Iru, Inc Kandji Agent before v.4.7.5(5374) allows a local attacker to escalate privileges via a client	134d ago
CVE-2026-24067	8.4	—	—	—	—	Slate Digital Connect 1.37.0 for macOS installs a privileged helper tool, com.slatedigital.connect.privileged.help	139d ago
CVE-2026-24066	8.4	—	—	—	—	Slate Digital Connect 1.37.0 for macOS installs a privileged helper tool, com.slatedigital.connect.privileged.help	139d ago
CVE-2026-47931	8.4	—	—	—	adobe / coldfusion	ColdFusion versions 2023.19, 2025.8 and earlier are affected by an Improper Input Validation vulnerability that co	140d ago
CVE-2026-47929	8.4	—	—	—	adobe / coldfusion	ColdFusion versions 2023.19, 2025.8 and earlier are affected by an Incorrect Authorization vulnerability that coul	140d ago
CVE-2026-47635	8.4	—	—	—	microsoft / office 2024	Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.	140d ago
CVE-2026-45641	8.4	—	—	—	microsoft / windows 10 21h2	Access of resource using incompatible type ('type confusion') in Windows Hyper-V allows an unauthorized attacker t	140d ago
CVE-2026-45607	8.4	—	—	—	microsoft / windows 10 1607	Out-of-bounds read in Windows Hyper-V allows an unauthorized attacker to execute code locally.	140d ago
CVE-2026-45482	8.4	—	—	—	microsoft / visual studio code	Improper limitation of a pathname to a restricted directory ('path traversal') in GitHub Copilot and Visual Studio	140d ago
CVE-2026-45474	8.4	—	—	—	microsoft / 365 apps	Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.	140d ago
CVE-2026-45472	8.4	—	—	—	microsoft / 365 apps	Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.	140d ago
CVE-2026-45463	8.4	—	—	—	microsoft / 365 apps	Integer underflow (wrap or wraparound) in Microsoft Office allows an unauthorized attacker to execute code locally	140d ago
CVE-2026-45461	8.4	—	—	—	microsoft / 365 apps	Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.	140d ago
CVE-2026-45458	8.4	—	—	—	microsoft / 365 apps	Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.	140d ago
CVE-2026-45456	8.4	—	—	—	microsoft / 365 apps	Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker	140d ago
CVE-2026-44810	8.4	—	—	—	microsoft / windows 11 23h2	Improper authentication in Windows Cryptographic Services allows an unauthorized attacker to elevate privileges lo	140d ago
CVE-2026-41098	8.4	—	—	—	microsoft / azure stack edge	Improper neutralization of input during web page generation ('cross-site scripting') in Azure Stack Edge allows an	140d ago
CVE-2026-46326	8.4	—	—	—	linux / linux kernel	In the Linux kernel, the following vulnerability has been resolved: iio: pressure: mprls0025pa: fix spi_transfer s	140d ago
CVE-2026-46288	8.4	—	—	—	linux / linux kernel	In the Linux kernel, the following vulnerability has been resolved: of: unittest: fix use-after-free in of_unittes	141d ago
CVE-2026-26422	8.4	—	—	—	—	clash-verge-service-ipc before 2.3.0 has a world-reachable IPC endpoint, leading to local privilege escalation.	143d ago
CVE-2019-25736	8.4	—	—	—	—	LabF nfsAxe 3.7 Ping Client contains a buffer overflow vulnerability that allows local attackers to execute arbitr	145d ago
CVE-2019-25735	8.4	—	—	—	—	AllPlayer 7.4 contains a local buffer overflow vulnerability in URL handling that allows attackers to overwrite st	145d ago
CVE-2019-25733	8.4	—	—	—	—	NetShareWatcher 1.5.8.0 contains a structured exception handler buffer overflow vulnerability that allows local at	145d ago
CVE-2026-46270	8.4	—	—	—	linux / linux kernel	In the Linux kernel, the following vulnerability has been resolved: power: supply: rt9455: Fix use-after-free in p	146d ago
CVE-2026-46251	8.4	—	—	—	linux / linux kernel	In the Linux kernel, the following vulnerability has been resolved: btrfs: fix block_group_tree dirty_list corrupt	146d ago
CVE-2019-25718	8.4	—	—	—	draeger / infinity explorer c700 firmware	Dräger Infinity Explorer C700 contains a privilege escalation vulnerability that allows attackers to break out of	148d ago
CVE-2025-48595zero day	8.4	1.9%	3/3	same day	google / android	In multiple locations, there is a possible way to achieve code execution due to an integer overflow.	148d ago
CVE-2018-25432	8.4	—	—	—	—	Arm Whois 3.11 contains a buffer overflow vulnerability that allows local attackers to execute arbitrary code by o	148d ago
CVE-2026-6824	8.4	—	—	—	—	A stored cross-site scripting (XSS) vulnerability exists in certain 1xxx series NVR devices due to insufficient san	151d ago
CVE-2018-25383	8.4	—	—	—	—	Free MP3 CD Ripper 2.8 contains a stack-based buffer overflow vulnerability in WMA file processing that allows loc	151d ago
CVE-2026-49238	8.4	—	—	—	canonical / multipass	An issue was discovered in Canonical Multipass before version 1.16.3.	152d ago
CVE-2026-45108	8.4	—	—	—	—	Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune.	153d ago
CVE-2026-7365	8.4	—	—	—	ibm / operations analytics log analysis	IBM Operations Analytics - Log Analysis and IBM SmartCloud Analytics - Log Analysis uses default passwords default	153d ago
CVE-2026-40851	8.4	—	—	—	—	A local attacker can perform a confusion attack on the cfgparser via a specially crafted file on an USB stick lead	153d ago
CVE-2018-25377	8.4	—	—	—	—	Flash Slideshow Maker Professional 5.20 contains a buffer overflow vulnerability in the registration dialog that a	155d ago
CVE-2018-25376	8.4	—	—	—	—	Socusoft 3GP Photo Slideshow 8.05 contains a buffer overflow vulnerability in the registration dialog that allows	155d ago
CVE-2018-25375	8.4	—	—	—	—	SocuSoft iPod Photo Slideshow 8.05 contains a buffer overflow vulnerability in the registration dialog that allows	155d ago
CVE-2018-25373	8.4	—	—	—	—	SocuSoft DVD Photo Slideshow Professional 8.07 contains a stack-based buffer overflow vulnerability in the registr	155d ago

Sources: NIST National Vulnerability Database (descriptions, CVSS, CPE); CISA KEV, ENISA EUVD, CIRCL and VulnCheck (exploitation status, three catalogues counted; CIRCL shown as an aggregator); FIRST EPSS (exploitation probability). Patch window is the gap between CVE publication and the earliest KEV listing, so a negative value means a catalogue called it exploited before it was disclosed. Data refreshes every five hours.

Loading

CVE Tracker