CVE Tracker: vulnerabilities by vendor, severity and exploitation status

CVE Tracker

15,513 records

Every published CVE from the last 120 days with CVSS score, vendor and product, cross-referenced against CISA's Known Exploited Vulnerabilities catalog. 6 added to KEV in the last 7 days.

SeverityAll critical high medium lowExploitedIn CISA KEV

CVE	CVSS	EPSS	KEV sources	Patch window	Vendor / product	Summary	Published
CVE-2026-18794	8.2	—	—	—	—	The OpenRGB network protocol allows attackers to cause memory exhaustion and out-of-bounds memory reads and writes	63d ago
CVE-2026-80236	8.2	—	—	—	—	Efence developed by Thinking Software Technology has a SQL Injection vulnerability.	63d ago
CVE-2026-55571	8.2	—	—	—	—	djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance.	64d ago
CVE-2026-47626	8.2	—	—	—	—	NVIDIA DGX Spark contains a vulnerability in the system firmware, where a privileged attacker could be able to cau	64d ago
CVE-2026-24263	8.2	—	—	—	—	NVIDIA DGX Spark contains a vulnerability in the system firmware, where a privileged attacker could be able to cau	64d ago
CVE-2026-24262	8.2	—	—	—	—	NVIDIA DGX Spark contains a vulnerability in the system firmware, where a privileged attacker could be able to cau	64d ago
CVE-2026-79674	8.2	—	—	—	nltk / nltk	NLTK versions before 3.10.3 contain a path sandbox bypass vulnerability in corpus-reader constructors that allows	64d ago
CVE-2026-55533	8.2	—	—	—	—	PraisonAI is a multi-agent teams system.	64d ago
CVE-2026-55528	8.2	—	—	—	—	PraisonAI is a multi-agent teams system.	64d ago
CVE-2026-76842	8.2	—	—	—	—	The Mercado Pago Node.js SDK interpolates caller-supplied identifiers into API request paths without percent-encod	65d ago
CVE-2026-78209	8.2	—	—	—	—	exceljs through 4.4.0 fails to neutralize leading equals, plus, minus, or at signs in cell values written to CSV o	65d ago
CVE-2026-74704	8.2	—	—	—	—	In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_cake: drop WARN_ON(1) for malfo	67d ago
CVE-2026-74697	8.2	—	—	—	—	In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Disable EOP for TPA on all chips to p	67d ago
CVE-2026-63135	8.2	—	—	—	—	YOURLS is a self-hosted, customizable URL shortener written in PHP.	67d ago
CVE-2026-61824	8.2	—	—	—	—	Defuddle cleans up HTML pages.	67d ago
CVE-2026-54682	8.2	—	—	—	—	DiscordChatExporter saves Discord chat logs to a file.	67d ago
CVE-2026-19442	8.2	—	—	—	ibm / vios	IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 has a pointer validation flaw exists in the AIX Virtual SCSI (vSCSI)	68d ago
CVE-2026-18840	8.2	—	—	—	ibm / vios	IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary code due to improp	68d ago
CVE-2026-18670	8.2	—	—	—	ibm / vios	IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service and poten	68d ago
CVE-2026-16943	8.2	—	—	—	ibm / vios	IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary code due to a heap	68d ago
CVE-2026-65842	8.2	—	—	—	—	Plate is a rich-text editor with AI and shadcn/ui.	69d ago
CVE-2026-49825	8.2	—	—	—	—	lxml is a library for processing XML and HTML in the Python language.	69d ago
CVE-2026-76402	8.2	—	—	—	splunk / connect for kafka	In Splunk Connect for Kafka versions below 2.2.7, an unauthenticated user who can reach the Kafka Connect Represen	69d ago
CVE-2026-16933	8.2	—	—	—	ibm / power system s1122 \(9824-22a\) firmware	IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, FW950.00 through F	69d ago
CVE-2026-16857	8.2	—	—	—	ibm / aix	IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to manipulate network traffic and DNS	69d ago
CVE-2026-16707	8.2	—	—	—	ibm / power system s1122 \(9824-22a\) firmware	IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through F	69d ago
CVE-2026-16661	8.2	—	—	—	ibm / power system s1122 \(9824-22a\) firmware	IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through F	69d ago
CVE-2026-17494	8.2	—	—	—	ibm / power system s1122 \(9824-22a\) firmware	IBM Power Systems Firmware FW1120.00, and FW1110.00 through FW1110.30 is affected by a vulnerability in the interf	69d ago
CVE-2026-17100	8.2	—	—	—	ibm / power system s1122 \(9824-22a\) firmware	Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, FW950.00 through FW950	69d ago
CVE-2026-17093	8.2	—	—	—	ibm / power system s1122 \(9824-22a\) firmware	IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, FW950.00 through F	69d ago
CVE-2026-16930	8.2	—	—	—	ibm / power system e1180 \(9080-heu\) firmware	IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, and FW1060.00 through FW1060.80 is affected by	69d ago
CVE-2026-19234	8.2	—	—	—	ibm / power system s1122 \(9824-22a\) firmware	Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, and FW1060.00 through FW1060.80 is affected by a vu	70d ago
CVE-2026-41424	8.2	—	—	—	—	Wazuh is a free and open source platform used for threat prevention, detection, and response.	70d ago
CVE-2026-63407	8.2	—	—	—	—	Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content.	70d ago
CVE-2026-16686	8.2	—	—	—	ibm / vios	IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to access NFS-exported filesystems due	70d ago
CVE-2026-15061	8.2	—	—	—	ibm / vios	IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 's nimesis registration service could allow a remote attacker to ove	70d ago
CVE-2026-76222	8.2	—	—	—	gitpython project / gitpython	GitPython before 3.1.58 fails to validate submodule names from .gitmodules files, allowing attackers to create Git	70d ago
CVE-2026-76208	8.2	—	—	—	phpmyfaq / phpmyfaq	phpMyFAQ versions 3.1.0 through 4.1.6 contain an authentication bypass vulnerability in AuthLdap::create().	70d ago
CVE-2026-73937	8.2	—	—	—	oracle / helidon	Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server).	70d ago
CVE-2026-73925	8.2	—	—	—	oracle / helidon	Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server).	70d ago
CVE-2026-71159	8.2	—	—	—	oracle / helidon	Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server).	70d ago
CVE-2026-71130	8.2	—	—	—	oracle / vm virtualbox	Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).	70d ago
CVE-2026-71129	8.2	—	—	—	oracle / vm virtualbox	Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).	70d ago
CVE-2026-71096	8.2	—	—	—	oracle / business intelligence	Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Pl	70d ago
CVE-2026-71024	8.2	—	—	—	oracle / commerce experience manager	Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce	70d ago
CVE-2026-71018	8.2	—	—	—	oracle / commerce experience manager	Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce	70d ago
CVE-2026-71016	8.2	—	—	—	oracle / commerce experience manager	Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce	70d ago
CVE-2026-70993	8.2	—	—	—	oracle / commerce experience manager	Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce	70d ago
CVE-2026-70964	8.2	—	—	—	oracle / hyperion infrastructure technology	Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Installation	70d ago
CVE-2026-70952	8.2	—	—	—	oracle / hyperion financial management	Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security).	70d ago
CVE-2026-70909	8.2	—	—	—	oracle / hyperion financial management	Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security).	70d ago
CVE-2026-70897	8.2	—	—	—	oracle / hyperion data relationship management	Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access an	70d ago
CVE-2026-70893	8.2	—	—	—	oracle / hyperion data relationship management	Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access an	70d ago
CVE-2026-70892	8.2	—	—	—	oracle / hyperion data relationship management	Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access an	70d ago
CVE-2026-70887	8.2	—	—	—	oracle / hyperion data relationship management	Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access an	70d ago
CVE-2026-70870	8.2	—	—	—	oracle / hyperion data relationship management	Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Web Clien	70d ago
CVE-2026-70852	8.2	—	—	—	—	Vulnerability in the Oracle Demand Planning product of Oracle Supply Chain (component: Internal Operations).	70d ago
CVE-2026-70773	8.2	—	—	—	oracle / hcm common architecture	Vulnerability in the Oracle HCM Common Architecture product of Oracle E-Business Suite (component: Knowledge Integ	70d ago
CVE-2026-70743	8.2	—	—	—	oracle / hyperion financial management	Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion (component: Server).	70d ago
CVE-2026-70722	8.2	—	—	—	oracle / advanced inbound telephony	Vulnerability in the Oracle Advanced Inbound Telephony product of Oracle E-Business Suite (component: Internal Ope	70d ago

Sources: NIST National Vulnerability Database (descriptions, CVSS, CPE); CISA KEV, ENISA EUVD, CIRCL and VulnCheck (exploitation status, three catalogues counted; CIRCL shown as an aggregator); FIRST EPSS (exploitation probability). Patch window is the gap between CVE publication and the earliest KEV listing, so a negative value means a catalogue called it exploited before it was disclosed. Data refreshes every five hours.

Loading

CVE Tracker