CVE Tracker: vulnerabilities by vendor, severity and exploitation status

CVE Tracker

15,513 records

Every published CVE from the last 120 days with CVSS score, vendor and product, cross-referenced against CISA's Known Exploited Vulnerabilities catalog. 6 added to KEV in the last 7 days.

SeverityAll critical high medium lowExploitedIn CISA KEV

CVE	CVSS	EPSS	KEV sources	Patch window	Vendor / product	Summary	Published
CVE-2026-68118	8.2	—	—	—	—	In the Linux kernel, the following vulnerability has been resolved: tcp: challenge ACK for non-exact RST in SYN-RE	79d ago
CVE-2026-12984	8.2	—	—	—	—	Insufficiently Protected Credentials vulnerability in Zyxel Networks WAH7601 allows Retrieve Embedded Sensitive Da	79d ago
CVE-2026-16257	8.2	—	—	—	—	The Arvow AI SEO Writer WordPress plugin before 1.5.4 does not properly restrict access to one of its REST endpoin	79d ago
CVE-2026-66838	8.2	—	—	—	elixir-ecto / postgrex	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in elixir-ecto	82d ago
CVE-2026-66708	8.2	—	—	—	—	Unauthenticated Broken Access Control in Total Upkeep <= 1.17.2 versions.	83d ago
CVE-2026-16268	8.2	—	—	—	—	The Newsletters WordPress plugin before 4.16 does not authenticate or validate a bounce-processing request before	83d ago
CVE-2026-14829	8.2	—	—	—	—	The Checkimate — WooCommerce Checkout, Abandoned Cart Recovery & Order Bumps WordPress plugin through 1.0.13 does	83d ago
CVE-2026-71315	8.2	—	—	—	—	Nuxt is an open-source web development framework for Vue.js.	83d ago
CVE-2026-10025	8.2	—	—	—	ibm / qradar security information and event manager	IBM QRadar 7.6.0.0 through 7.6.0.1, and 7.5.0 through 7.5.0 UP 15 Interim Fix 005 has an XML External Entity (XXE)	84d ago
CVE-2026-71264	8.2	—	—	—	—	WLED's GET /json/cfg endpoint (registered in wled00/wled_server.cpp) calls serveJson with no settings-PIN check, u	84d ago
CVE-2026-71252	8.2	—	—	—	—	toner-management's admin state-changing handlers (add.php, edit.php, delete.php under admin/toners, admin/toner-br	84d ago
CVE-2026-6627	8.2	—	—	—	—	The WPFormify – Stripe Payments with Form and Checkout plugin for WordPress is vulnerable to unauthorized modificat	84d ago
CVE-2026-64578	8.2	—	—	—	—	In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate compound request size before r	84d ago
CVE-2026-70486	8.2	—	—	—	—	Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform.	84d ago
CVE-2026-47623	8.2	—	—	—	nvidia / dynamo	NVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause deserialization of untrusted data.	85d ago
CVE-2026-24253	8.2	—	—	—	nvidia / dynamo	NVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause an out-of-bounds write.	85d ago
CVE-2026-58080	8.2	—	—	—	eclipse / milo	In Eclipse Milo versions 1.0.0 through 1.1.4, `OpcUaServerConfig.copy()` fails to preserve a configured `RoleMappe	85d ago
CVE-2026-10849	8.2	—	—	—	zephyrproject / zephyr	The hawkBit device management client in subsys/mgmt/hawkbit accumulates the body of an HTTP response from the upda	85d ago
CVE-2026-15055	8.2	—	—	—	bouncycastle / bc-java	In Bouncy Castle for Java before 1.85, PKCS#8 / PBES2 decryptors honour unbounded KDF cost from input.	86d ago
CVE-2026-14920	8.2	—	—	—	—	## Summary	87d ago
CVE-2026-53501	8.2	—	—	—	—	Thumbor is an open-source photo thumbnail service by globo.com.	89d ago
CVE-2026-53500	8.2	—	—	—	—	Thumbor is an open-source photo thumbnail service by globo.com.	89d ago
CVE-2026-18141	8.2	—	—	—	—	A flaw was found in aap-gateway, a component of Ansible Automation Platform's Event-Driven Ansible (EDA).	89d ago
CVE-2026-56672	8.2	—	—	—	—	ComfyUI is a node-based diffusion model GUI, API, and backend.	89d ago
CVE-2026-56670	8.2	—	—	—	—	ComfyUI is a modular diffusion model GUI, api and backend with a graph/nodes interface.	89d ago
CVE-2026-12722	8.2	—	—	—	—	Missing authentication for critical function vulnerability in FTC Software IT Services FTC E-Commerce Management P	90d ago
CVE-2026-54727	8.2	—	—	—	—	proot-distro is a utility for managing proot containers.	91d ago
CVE-2026-54574	8.2	—	—	—	—	proot-distro is a utility for managing proot containers.	91d ago
CVE-2026-58188	8.2	—	—	—	apache / traffic server	Several Apache Traffic Server experimental plugins have memory-safety and limit-bypass errors.	91d ago
CVE-2026-58184	8.2	—	—	—	apache / traffic server	The Apache Traffic Server header_rewrite plugin can crash or corrupt memory during cookie operations and CIDR cond	91d ago
CVE-2026-58159	8.2	—	—	—	apache / traffic server	Apache Traffic Server can bypass IP access controls on UDS listeners and through ACL matching errors.	91d ago
CVE-2026-22068	8.2	—	—	—	apache / traffic server	Regular Expression without Anchors vulnerability in Apache Traffic Server.	91d ago
CVE-2026-54691	8.2	—	—	—	—	datamodel-code-generator generates Python data models from schema definitions.	91d ago
CVE-2026-54690	8.2	—	—	—	koxudaxi / datamodel-code-generator	datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JS	91d ago
CVE-2026-14996	8.2	—	—	—	ibm / aspera faspex	IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 has addressed a vulnerability related to session management.	91d ago
CVE-2026-48391	8.2	—	—	—	adobe / bridge	Bridge is affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the	92d ago
CVE-2026-48390	8.2	—	—	—	adobe / bridge	Bridge is affected by an Incorrect Authorization vulnerability that could result in privilege escalation.	92d ago
CVE-2026-47483	8.2	—	—	—	—	NVIDIA DCGM Exporter for all platforms contains a vulnerability in the /debug/pprof endpoints, where an attacker c	92d ago
CVE-2026-43910	8.2	—	—	—	appium / java-client	Appium Java Client is the Java language binding for writing Appium tests that conform to the W3C WebDriver protoco	92d ago
CVE-2026-64737	8.2	—	—	—	apple / macos	An authorization issue was addressed with improved state management.	92d ago
CVE-2026-43772	8.2	—	—	—	apple / macos	A path traversal issue was addressed with improved input validation.	92d ago
CVE-2026-64642	8.2	—	—	—	vercel / next.js	Next.js is a React framework for building full-stack web applications.	93d ago
CVE-2026-9830	8.2	—	—	—	—	The bookingpress-appointment-booking-pro WordPress plugin before 5.7.3 does not correctly invoke its REST permissio	93d ago
CVE-2026-64448	8.2	—	—	—	linux / linux kernel	In the Linux kernel, the following vulnerability has been resolved: smb: client: restrict implied bcc[0] exemption	95d ago
CVE-2026-64435	8.2	—	—	—	linux / linux kernel	In the Linux kernel, the following vulnerability has been resolved: audit: Fix data races of skb_queue_len() reade	95d ago
CVE-2026-64389	8.2	—	—	—	linux / linux kernel	In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate NTLMv2 response before updatin	95d ago
CVE-2026-64380	8.2	—	—	—	—	In the Linux kernel, the following vulnerability has been resolved: smb: client: harden POSIX SID length parsing p	95d ago
CVE-2026-64287	8.2	—	—	—	linux / linux kernel	In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Bound used_lrs when flushing the p	95d ago
CVE-2026-64286	8.2	—	—	—	linux / linux kernel	In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Clear __hyp_running_vcpu when flus	95d ago
CVE-2026-65604	8.2	—	—	—	—	Skipper contains an incomplete fix for CVE-2026-50197 in which oversized request bodies bypass Open Policy Agent (	96d ago
CVE-2026-16002	8.2	—	—	—	—	The affected product is vulnerable to an Out-of-bounds read, which may allow an attacker to crash the parsing proc	96d ago
CVE-2026-63765	8.2	—	—	—	—	Chatwoot before 4.16.0 contains an authentication bypass vulnerability in the direct uploads controller that allow	97d ago
CVE-2026-62456	8.2	—	—	—	oracle / human resources management system	Vulnerability in the Oracle HRMS (UK) product of Oracle E-Business Suite (component: Internal Operations).	98d ago
CVE-2026-61240	8.2	—	—	—	oracle / peoplesoft enterprise fin common objects	Vulnerability in the PeopleSoft Enterprise FIN Common Objects Argentina product of Oracle PeopleSoft (component: e	98d ago
CVE-2026-61205	8.2	—	—	—	oracle / peoplesoft enterprise scm purchasing	Vulnerability in the PeopleSoft Enterprise SCM Purchasing product of Oracle PeopleSoft (component: Purchasing).	98d ago
CVE-2026-61101	8.2	—	—	—	oracle / e-business suite	Vulnerability in the Oracle MES for Process Manufacturing product of Oracle E-Business Suite (component: Internal	98d ago
CVE-2026-61089	8.2	—	—	—	oracle / peoplesoft enterprise scm inventory	Vulnerability in the PeopleSoft Enterprise SCM Inventory product of Oracle PeopleSoft (component: Security).	98d ago
CVE-2026-60854	8.2	—	—	—	oracle / quality	Vulnerability in the Oracle Quality product of Oracle E-Business Suite (component: Internal Operations).	98d ago
CVE-2026-60810	8.2	—	—	—	oracle / e-business suite	Vulnerability in the Oracle Supply Chain Trading Connector product of Oracle E-Business Suite (component: Collabor	98d ago
CVE-2026-60674	8.2	—	—	—	oracle / business intelligence	Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Pl	98d ago

Sources: NIST National Vulnerability Database (descriptions, CVSS, CPE); CISA KEV, ENISA EUVD, CIRCL and VulnCheck (exploitation status, three catalogues counted; CIRCL shown as an aggregator); FIRST EPSS (exploitation probability). Patch window is the gap between CVE publication and the earliest KEV listing, so a negative value means a catalogue called it exploited before it was disclosed. Data refreshes every five hours.

Loading

CVE Tracker