CVE Tracker: vulnerabilities by vendor, severity and exploitation status

CVE Tracker

15,513 records

Every published CVE from the last 120 days with CVSS score, vendor and product, cross-referenced against CISA's Known Exploited Vulnerabilities catalog. 6 added to KEV in the last 7 days.

SeverityAll critical high medium lowExploitedIn CISA KEV

CVE	CVSS	EPSS	KEV sources	Patch window	Vendor / product	Summary	Published
CVE-2026-70703	8.2	—	—	—	oracle / agile engineering data management product of oracle supply chain	Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Engineeri	70d ago
CVE-2026-70702	8.2	—	—	—	oracle / payments	Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission).	70d ago
CVE-2026-62605	8.2	—	—	—	oracle / partner management	Vulnerability in the Oracle Partner Management product of Oracle E-Business Suite (component: Internal Operations)	70d ago
CVE-2026-62598	8.2	—	—	—	oracle / hyperion calculation manager	Vulnerability in the Oracle Hyperion Calculation Manager product of Oracle Hyperion (component: Security).	70d ago
CVE-2026-62485	8.2	—	—	—	oracle / hyperion infrastructure technology	Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Common Event	70d ago
CVE-2026-62448	8.2	—	—	—	oracle / email center	Vulnerability in the Oracle Email Center product of Oracle E-Business Suite (component: Message Component).	70d ago
CVE-2026-61340	8.2	—	—	—	oracle / mes for process manufacturing	Vulnerability in the Oracle MES for Process Manufacturing product of Oracle E-Business Suite (component: Internal	70d ago
CVE-2026-61302	8.2	—	—	—	oracle / business intelligence	Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Pod A	70d ago
CVE-2026-61222	8.2	—	—	—	oracle / webcenter portal	Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools).	70d ago
CVE-2026-61054	8.2	—	—	—	oracle / webcenter sites	Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites).	70d ago
CVE-2026-61038	8.2	—	—	—	oracle / webcenter sites	Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites).	70d ago
CVE-2026-61016	8.2	—	—	—	oracle / webcenter sites	Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites).	70d ago
CVE-2026-61011	8.2	—	—	—	oracle / webcenter sites	Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites).	70d ago
CVE-2026-60955	8.2	—	—	—	oracle / webcenter content	Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).	70d ago
CVE-2026-60944	8.2	—	—	—	oracle / webcenter content	Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).	70d ago
CVE-2026-60796	8.2	—	—	—	oracle / siebel crm	Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: REST).	70d ago
CVE-2026-60592	8.2	—	—	—	oracle / mysql cluster	Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: NDB Operator).	70d ago
CVE-2026-47719	8.2	—	—	—	—	FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software.	70d ago
CVE-2026-73356	8.2	—	—	—	—	Unauthenticated Arbitrary Content Deletion in Breeze <= 2.5.12 versions.	71d ago
CVE-2026-73350	8.2	—	—	—	—	Unauthenticated Broken Authentication in SupportCandy <= 3.5.1 versions.	71d ago
CVE-2026-65832	8.2	—	—	—	—	Deskflow is a keyboard and mouse sharing app.	71d ago
CVE-2026-63409	8.2	—	—	—	—	Deskflow is a keyboard and mouse sharing app.	71d ago
CVE-2026-75048	8.2	—	—	—	—	In JetBrains YouTrack before 2026.2.18068 stored XSS via the fenced code-block language label was possible	72d ago
CVE-2026-74802	8.2	—	—	—	—	SiYuan versions before 3.7.4 contain a cross-site WebSocket hijacking vulnerability in the admin-only /ws/network/	72d ago
CVE-2026-74801	8.2	—	—	—	—	SiYuan before 3.7.4 fails to properly escape workspace directory paths when constructing command-line arguments fo	72d ago
CVE-2026-74516	8.2	—	—	—	—	In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Update x2APIC MSR intercepts if AVIC	74d ago
CVE-2026-74355	8.2	—	—	—	—	In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Fix RB-tree corruption in probe er	74d ago
CVE-2026-72057	8.2	—	—	—	—	In the Linux kernel, the following vulnerability has been resolved: net/sched: act_ct: preserve tc_skb_cb across d	74d ago
CVE-2026-72035	8.2	—	—	—	—	In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_taprio: Replace direct dequeue	74d ago
CVE-2026-72021	8.2	—	—	—	—	In the Linux kernel, the following vulnerability has been resolved: ipvs: use parsed transport offset in SCTP stat	74d ago
CVE-2026-17081	8.2	—	—	—	ibm / db2 mirror for i	IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to write arbitrary files due to improper limi	74d ago
CVE-2026-73666	8.2	—	—	—	—	OpenChoreo is a developer platform for Kubernetes.	75d ago
CVE-2026-73658	8.2	—	—	—	—	Trigger.dev is a platform for building and deploying fully managed AI agents and workflows.	75d ago
CVE-2026-18509	8.2	—	—	—	ibm / i	IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to gain privilege escalation via the Navig	75d ago
CVE-2026-17272	8.2	—	—	—	ibm / i	IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to a buffer overflow.	75d ago
CVE-2026-73650	8.2	—	—	—	—	SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files.	76d ago
CVE-2026-17220	8.2	—	—	—	ibm / i	IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service and modify authentication	76d ago
CVE-2026-13048	8.2	—	—	—	—	Data::MuForm::Localizer versions through 0.05 for Perl execute Perl from a message catalog header, reached at an a	76d ago
CVE-2026-70461	8.2	—	—	—	samba / rsync	rsync 3.2.5 before 3.5.0 contains a heap out-of-bounds write vulnerability that allows remote unauthenticated atta	76d ago
CVE-2026-70458	8.2	—	—	—	—	rsync 3.0.0 before 3.5.0 contains an out-of-bounds write vulnerability that allows attackers to corrupt memory by	76d ago
CVE-2026-70456	8.2	—	—	—	—	rsync 3.0.1 before 3.5.0 contains an out-of-bounds write vulnerability in the read_args() function that allows a m	76d ago
CVE-2026-14679	8.2	—	—	—	postgresql / postgresql	Stack buffer overflow in PostgreSQL argument name matching allows an object creator to achieve unknown impacts via	76d ago
CVE-2026-73613	8.2	—	—	—	—	filebrowser versions before 2.63.19 contain an out-of-scope file deletion vulnerability in the TUS upload cache ev	76d ago
CVE-2026-59501	8.2	—	—	—	—	: Improper Access Control vulnerability in Priority Portal Generator addon to Priority ERP (developed by Soft Solu	76d ago
CVE-2026-18945	8.2	—	—	—	—	The WP Helper Premium WordPress plugin before 4.7.6 does not verify the order key when rendering its custom order	76d ago
CVE-2026-17485	8.2	—	—	—	ibm / i	IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service and obtain sensitive infor	76d ago
CVE-2026-10543	8.2	—	—	—	ibm / db2	IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to privilege escalation with a specially cr	76d ago
CVE-2026-73303	8.2	—	—	—	—	Budibase is an open-source low-code platform.	76d ago
CVE-2026-17445	8.2	—	—	—	ibm / i	IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to im	76d ago
CVE-2026-19426	8.2	—	—	—	—	POS System developed by FitSoft has a Missing Authentication vulnerability.	77d ago
CVE-2026-13171	8.2	—	—	—	—	The Eventin WordPress plugin before 4.1.20 does not perform an authorization check on its waiting-list registratio	77d ago
CVE-2026-64954	8.2	—	—	—	—	Velociraptor allows scheduling new collections via VQL queries in notebooks.	77d ago
CVE-2026-6484	8.2	—	—	—	—	In an UEFI, Lack of verified boot to certain FV may cause arbitrary code execution.	77d ago
CVE-2026-48763	8.2	—	—	—	—	TypeBot is a chatbot builder tool.	77d ago
CVE-2026-19550	8.2	—	—	—	redhat / enterprise linux	A flaw was found in FreeIPA.	77d ago
CVE-2026-48771	8.2	—	—	—	—	ishankportfolio is a portfolio website.	78d ago
CVE-2026-69306	8.2	—	—	—	microsoft / visual studio code	Not failing securely ('failing open') in Visual Studio Code allows an unauthorized attacker to bypass a security f	78d ago
CVE-2026-21279	8.2	—	—	—	adobe / coldfusion	is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass.	78d ago
CVE-2026-72922	8.2	—	—	—	—	AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence	78d ago
CVE-2026-14886	8.2	—	—	—	—	Vault Enterprise's identity entity batch-delete endpoint is vulnerable to a cross-namespace authorization bypass t	78d ago

Sources: NIST National Vulnerability Database (descriptions, CVSS, CPE); CISA KEV, ENISA EUVD, CIRCL and VulnCheck (exploitation status, three catalogues counted; CIRCL shown as an aggregator); FIRST EPSS (exploitation probability). Patch window is the gap between CVE publication and the earliest KEV listing, so a negative value means a catalogue called it exploited before it was disclosed. Data refreshes every five hours.

Loading

CVE Tracker