CVE Tracker: vulnerabilities by vendor, severity and exploitation status

CVE Tracker

15,513 records

Every published CVE from the last 120 days with CVSS score, vendor and product, cross-referenced against CISA's Known Exploited Vulnerabilities catalog. 8 added to KEV in the last 7 days.

SeverityAll critical high medium lowExploitedIn CISA KEV

CVE	CVSS	EPSS	KEV sources	Patch window	Vendor / product	Summary	Published
CVE-2026-60668	8.2	—	—	—	oracle / peoplesoft enterprise hcm human resources	Vulnerability in the PeopleSoft Enterprise HCM Human Resources product of Oracle PeopleSoft (component: French Pub	98d ago
CVE-2026-60665	8.2	—	—	—	oracle / peoplesoft enterprise hcm global payroll switzerland	Vulnerability in the PeopleSoft Enterprise HCM Global Payroll Switzerland product of Oracle PeopleSoft (component:	98d ago
CVE-2026-60615	8.2	—	—	—	oracle / peoplesoft enterprise campus software campus community	Vulnerability in the PeopleSoft Enterprise CS Campus Community product of Oracle PeopleSoft (component: Security).	98d ago
CVE-2026-60544	8.2	—	—	—	oracle / soa suite	Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: B2B Engine).	98d ago
CVE-2026-60525	8.2	—	—	—	oracle / webcenter content	Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).	98d ago
CVE-2026-60428	8.2	—	—	—	oracle / unified directory	Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD Core).	98d ago
CVE-2026-60421	8.2	—	—	—	oracle / unified directory	Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD Core).	98d ago
CVE-2026-60315	8.2	—	—	—	oracle / mysql server	Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: X Plugin).	98d ago
CVE-2026-60284	8.2	—	—	—	oracle / coherence	Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core).	98d ago
CVE-2026-60255	8.2	—	—	—	oracle / coherence	Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core).	98d ago
CVE-2026-47046	8.2	—	—	—	oracle / database server	Vulnerability in the RDBMS component of Oracle Database Server.	98d ago
CVE-2026-46993	8.2	—	—	—	oracle / enterprise manager base platform	Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Agen	98d ago
CVE-2026-65056	8.2	—	—	—	—	mcp-webresearch 0.1.7 contains a server-side request forgery vulnerability that allows attackers to access interna	98d ago
CVE-2026-47688	8.2	—	—	—	fogproject / fogproject	FOG is a free open-source cloning/imaging/rescue suite/inventory management system.	98d ago
CVE-2026-47255	8.2	—	—	—	—	AgenticMail gives AI agents real email addresses and phone numbers.	99d ago
CVE-2026-41521	8.2	—	—	—	neutrinolabs / xrdp	xrdp is an open source RDP server.	100d ago
CVE-2026-46415	8.2	—	—	—	—	The Caddy Defender plugin is a middleware for Caddy that allows users to block or manipulate requests based on the	100d ago
CVE-2026-13577	8.2	—	—	—	—	Dancer2 versions through 2.1.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable	100d ago
CVE-2026-63913	8.2	—	—	—	—	In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: tcp: do not force CLOSE	101d ago
CVE-2026-63867	8.2	—	—	—	—	In the Linux kernel, the following vulnerability has been resolved: mptcp: close TOCTOU race while computing rcv_w	101d ago
CVE-2026-10130	8.2	—	—	—	—	QueryWeaver contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid	101d ago
CVE-2026-13410	8.2	—	—	—	—	Dancer::Plugin::Auth::Google versions before 0.08 for Perl have TLS verification disabled.	103d ago
CVE-2026-49998	8.2	—	—	—	—	Centrifugo is an open-source scalable real-time messaging server.	104d ago
CVE-2026-45325	8.2	—	—	—	—	Gestor de Oferta is a web application for managing mobility service offerings.	104d ago
CVE-2026-35149	8.2	—	—	—	hcltech / dfx server	HCL DFXServer is affected by an Authentication Bypass vulnerability via server response manipulation.	104d ago
CVE-2026-35147	8.2	—	—	—	hcltech / dfx server	HCL DFXServer is affected by a Broken Authentication vulnerability via direct API access.	104d ago
CVE-2026-46485	8.2	—	—	—	—	Dashy is a self-hostable personal dashboard.	105d ago
CVE-2026-58658	8.2	—	—	—	—	GPUStack through 2.2.1, fixed in commit 4e20551, contains an unauthenticated information disclosure vulnerability	105d ago
CVE-2026-12382	8.2	—	—	—	—	A flaw was found in the AAP Gateway Envoy proxy configuration.	105d ago
CVE-2026-60005	8.2	—	—	—	f5 / nginx gateway fabric	NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_slice_module module.	105d ago
CVE-2026-61435	8.2	—	—	—	—	PraisonAI before 4.6.78 contains an authentication bypass in the Call API agent invocation endpoints (src/praisona	105d ago
CVE-2026-49981	8.2	—	—	—	symfony / twig	Twig is a template language for PHP.	105d ago
CVE-2026-48290	8.2	—	—	—	adobe / c2pa	CAI Content Credentials is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in arb	105d ago
CVE-2026-50528	8.2	—	—	—	microsoft / .net	Incorrect authorization in .NET allows an unauthorized attacker to bypass a security feature over a network.	106d ago
CVE-2026-48345	8.2	—	—	—	adobe / animate	Animate is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection	106d ago
CVE-2026-47984	8.2	—	—	—	adobe / commerce	Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature byp	106d ago
CVE-2026-47423	8.2	—	—	—	cure53 / dompurify	DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG.	106d ago
CVE-2026-45075	8.2	—	—	—	sensiolabs / symfony	Symfony is a PHP framework for web and console applications and a set of reusable PHP components.	106d ago
CVE-2026-50680	8.2	—	—	—	microsoft / windows 10 1809	Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to elevate privileges locally.	106d ago
CVE-2026-50429	8.2	—	—	—	microsoft / windows 10 1607	Out-of-bounds read in Windows Kernel allows an unauthorized attacker to disclose information over a network.	106d ago
CVE-2026-59197	8.2	—	—	—	python / pillow	Pillow is a Python imaging library.	106d ago
CVE-2026-50338	8.2	—	—	—	microsoft / azure spring cloud	Improper authentication in Azure Spring Apps allows an authorized attacker to elevate privileges over a network.	106d ago
CVE-2026-58477	8.2	—	—	—	dan-in-ca / sustainable irrigation platform	Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a mass assignment vulnerability that allows	106d ago
CVE-2026-10672	8.2	—	—	—	zephyrproject / zephyr	subsys/net/lib/lwm2m/lwm2m_pull_context.c copied the firmware-update Package URI into a fixed static buffer (conte	106d ago
CVE-2026-9561	8.2	—	—	—	eclipse / kura	Eclipse Kura versions prior to 5.6.2 trust the client-supplied X-Forwarded-For HTTP header as the authoritative sou	106d ago
CVE-2026-44752	8.2	—	—	—	—	SAP NetWeaver Application Server Java allows an unauthenticated attacker to inject malicious JavaScript through cr	106d ago
CVE-2026-58500	8.2	—	—	—	appium / appium-mcp	MCP Appium is an MCP server that provides AI assistants with tools to automate mobile app testing on Android and i	106d ago
CVE-2026-48364	8.2	—	—	—	adobe / coldfusion	ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Uncontrolled Search Path Element vulnerability	106d ago
CVE-2026-48363	8.2	—	—	—	adobe / coldfusion	ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Uncontrolled Search Path Element vulnerability	106d ago
CVE-2026-57768	8.2	—	—	—	—	Incorrect Privilege Assignment vulnerability in favethemes Houzez Login Register houzez-login-register allows Priv	107d ago
CVE-2026-56259	8.2	—	—	—	kidocode / crawl4ai	Crawl4AI before 0.8.8 contains credential exfiltration vulnerabilities in the Docker API server that allow attacke	108d ago
CVE-2026-58499	8.2	—	—	—	—	EverOS is a memory runtime for agents.	109d ago
CVE-2026-55641	8.2	—	—	—	—	9Router is an AI router & token saver.	110d ago
CVE-2026-53657	8.2	—	—	—	—	Lima launches Linux virtual machines, typically on macOS, for running containerd.	110d ago
CVE-2026-29519	8.2	—	—	—	—	Lucee CFML Server versions across the 5.3.x, 6.1.x, 6.2.x, and 7.0.x release lines contain a reflected cross-site	110d ago
CVE-2026-54423	8.2	—	—	—	—	In OpenStack Ironic before 37.0.1, an Ironic user with the ability to deploy nodes using the IPMI management inter	110d ago
CVE-2026-44787	8.2	—	—	—	discourse / discourse	Discourse is an open-source discussion platform.	110d ago
CVE-2026-4256	8.2	—	—	—	—	Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in PEAKUP Techno	111d ago
CVE-2026-58525	8.2	—	—	—	microsoft / edge chromium	Improper access control in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security fe	111d ago
CVE-2026-59822zero day	8.2	0.84%	3/3	same day	litellm / litellm	LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format.	112d ago

Sources: NIST National Vulnerability Database (descriptions, CVSS, CPE); CISA KEV, ENISA EUVD, CIRCL and VulnCheck (exploitation status, three catalogues counted; CIRCL shown as an aggregator); FIRST EPSS (exploitation probability). Patch window is the gap between CVE publication and the earliest KEV listing, so a negative value means a catalogue called it exploited before it was disclosed. Data refreshes every five hours.

Loading

CVE Tracker