CVE Tracker: vulnerabilities by vendor, severity and exploitation status

CVE Tracker

15,513 records

Every published CVE from the last 120 days with CVSS score, vendor and product, cross-referenced against CISA's Known Exploited Vulnerabilities catalog. 8 added to KEV in the last 7 days.

SeverityAll critical high medium lowExploitedIn CISA KEV

CVE	CVSS	EPSS	KEV sources	Patch window	Vendor / product	Summary	Published
CVE-2026-59802	8.2	—	—	—	—	PasswordPusher before 2.8.1 accepts data URI schemes in URL push payloads due to insufficient validation in the va	112d ago
CVE-2026-59731	8.2	—	—	—	—	Astro is a web framework for content-driven websites.	112d ago
CVE-2026-29009	8.2	—	—	—	denx / u-boot	U-Boot before 2026.07-rc2 contains a buffer overflow vulnerability in nfs_readlink_reply() (net/nfs-common.c) when	112d ago
CVE-2026-57239	8.2	—	—	—	foxit / pdf editor	The user-controllable executable files will be directly executed by high-privilege processes, allowing low-privile	112d ago
CVE-2026-55428	8.2	—	—	—	coder / coder	Coder allows organizations to provision remote development environments via Terraform.	112d ago
CVE-2026-8377	8.2	—	—	—	—	Missing Authorization vulnerability in Armiya Information Technologies Ltd.	113d ago
CVE-2025-53831	8.2	—	—	—	—	DrawIO for ownCloud is an application for using DrawIO with the file storage, synchronization, and sharing applica	114d ago
CVE-2026-59195	8.2	—	—	—	pnpm / pnpm	pnpm is a package manager.	114d ago
CVE-2026-44937	8.2	—	—	—	suse / rancher fleet	Potential forgery of webhook requests when using a unauthenticated webhook in SUSE Rancher Fleet 0.15 before 0.15.	114d ago
CVE-2026-46591	8.2	—	—	—	apache / camel	Improper Neutralization of Special Elements in Data Query Logic vulnerability in Apache Camel Neo4J component.	114d ago
CVE-2026-14637	8.2	—	—	—	—	A security vulnerability has been detected in kirilkirkov Ecommerce-CodeIgniter-Bootstrap up to 13fd582aaf49aeab74	116d ago
CVE-2026-27771	8.2	—	—	—	—	Gitea versions up to and including 1.26.1 have insufficient permission checks for Composer package source links, w	116d ago
CVE-2026-57688	8.2	—	—	—	—	Unauthenticated Broken Access Control in POS Entegratör <= 3.7.103 versions.	118d ago
CVE-2026-14336	8.2	—	—	—	—	PIA's OIDC issuer allowlist for Jenkins tokens uses a bare string-prefix check (issuer.startswith(' https://ci.ecl	118d ago
CVE-2026-53906	8.2	—	—	—	mycomplianceoffice / mycomplianceoffice	MCO is vulnerable to Path Disclosure and Path Traversal in file handling functionality related to data export and	119d ago
CVE-2026-52868	8.2	—	—	—	—	An unauthenticated attacker can read worklist records from a directory outside the intended per-AE worklist storag	119d ago
CVE-2026-10564	8.2	—	—	—	langflow / langflow	IBM Langflow OSS 1.0.0 through 1.9.6 contains a Server-Side Request Forgery (SSRF).	120d ago
CVE-2026-10560	8.2	—	—	—	langflow / langflow	IBM Langflow OSS 1.0.0 through 1.9.6 contains a missing authentication vulnerability in /api/v1/build_public_tmp/	120d ago
CVE-2026-54351	8.2	—	—	—	budibase / budibase	Budibase is an open-source low-code platform.	123d ago
CVE-2026-55188	8.2	—	—	—	—	RustFS is a distributed object storage system built in Rust.	124d ago
CVE-2026-52783	8.2	—	—	—	—	OpenProject is open-source, web-based project management software.	124d ago
CVE-2026-57655	8.2	—	—	—	—	Unauthenticated Cross Site Request Forgery (CSRF) in Child Theme Wizard <= 1.4 versions.	124d ago
CVE-2026-12473	8.2	—	—	—	—	Two data sources (DICOMWebProxy and DICOMJSON) shipped in the default configuration fetch an arbitrary URL paramet	124d ago
CVE-2026-55667	8.2	—	—	—	—	File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within	125d ago
CVE-2026-57236	8.2	—	—	—	nokogiri / nokogiri	Nokogiri is an open source XML and HTML library for the Ruby programming language.	125d ago
CVE-2026-57235	8.2	—	—	—	nokogiri / nokogiri	Nokogiri is an open source XML and HTML library for the Ruby programming language.	125d ago
CVE-2026-53268	8.2	—	—	—	linux / linux kernel	In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack_irc: fix possible out-of-	125d ago
CVE-2026-44016	8.2	—	—	—	docling / docling	Docling simplifies document processing by parsing diverse formats and providing integrations with the generative A	126d ago
CVE-2026-56351	8.2	—	—	—	n8n / n8n	n8n before version 2.4.0 contains a sql injection vulnerability in MySQL, PostgreSQL, and Microsoft SQL nodes that	126d ago
CVE-2026-56245	8.2	—	—	—	—	Supabase Capgo before 12.128.2 contains an authorization bypass vulnerability in the SECURITY DEFINER record_build	126d ago
CVE-2026-56785	8.2	—	—	—	—	FlatPress contains a stored cross-site scripting vulnerability in comment and contact forms where name, URL, and e	126d ago
CVE-2026-56324	8.2	—	—	—	—	Capgo before 12.128.2 contains a rate limit bypass vulnerability in the channel_self endpoint that allows attacker	127d ago
CVE-2026-48109	8.2	—	—	—	messagepack / messagepack	MessagePack for C# is a MessagePack serializer for C#.	127d ago
CVE-2026-54271	8.2	—	—	—	protobufjs project / protobufjs-cli	protobufjs-cli is the command line add-on for protobuf.js.	128d ago
CVE-2026-50168	8.2	—	—	—	angular / angular	Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and	128d ago
CVE-2026-56104	8.2	—	—	—	—	Chainlit before 2.10.1 contains a session hijacking vulnerability that allows unauthenticated attackers to restore	128d ago
CVE-2019-25756	8.2	—	—	—	wdmtech / vaccount	Joomla! Component vAccount 2.0.2 contains an SQL injection vulnerability that allows unauthenticated attackers to	131d ago
CVE-2019-25755	8.2	—	—	—	wdmtech / vreview	Joomla Component vReview 1.9.11 contains an SQL injection vulnerability that allows unauthenticated attackers to e	131d ago
CVE-2019-25754	8.2	—	—	—	wdmtech / vrestaurant	Joomla Component vRestaurant 1.9.4 contains an SQL injection vulnerability that allows unauthenticated attackers t	131d ago
CVE-2019-25753	8.2	—	—	—	wdmtech / vmap	Joomla! Component VMap 1.9.6 contains an SQL injection vulnerability that allows unauthenticated attackers to exec	131d ago
CVE-2019-25752	8.2	—	—	—	cmsjunkie / j-businessdirectory	Joomla! Component J-BusinessDirectory 4.9.7 contains an SQL injection vulnerability that allows unauthenticated at	131d ago
CVE-2019-25751	8.2	—	—	—	cmsjunkie / classifiedsmanager	Joomla Component J-ClassifiedsManager 3.0.5 contains an SQL injection vulnerability that allows unauthenticated at	131d ago
CVE-2019-25750	8.2	—	—	—	cmsjunkie / multiplehotelreservation	Joomla Component J-MultipleHotelReservation 6.0.7 contains an SQL injection vulnerability that allows unauthentica	131d ago
CVE-2026-49260	8.2	—	—	—	—	PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page.	131d ago
CVE-2019-25748	8.2	—	—	—	cmsjunkie / jhotelreservation	Joomla JHotelReservation 6.0.7 contains an SQL injection vulnerability that allows unauthenticated attackers to ex	131d ago
CVE-2017-20282	8.2	—	—	—	soft-php / jcart for opencart	Joomla! Component jCart for OpenCart 2.0 contains an SQL injection vulnerability that allows unauthenticated attac	131d ago
CVE-2017-20281	8.2	—	—	—	joomlaboat / extra search	Joomla! Component Extra Search 2.2.8 contains an SQL injection vulnerability that allows unauthenticated attackers	131d ago
CVE-2017-20280	8.2	—	—	—	myportfolio / myportfolio	Joomla Component Myportfolio 3.0.2 contains an SQL injection vulnerability that allows unauthenticated attackers t	131d ago
CVE-2017-20279	8.2	—	—	—	extensions / joomla payage	Joomla Payage 2.05 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate dat	131d ago
CVE-2017-20278	8.2	—	—	—	joomboost / joomrecipe	Joomla Component JoomRecipe 1.0.3 contains an SQL injection vulnerability that allows unauthenticated attackers to	131d ago
CVE-2017-20277	8.2	—	—	—	joomboost / joomla joomrecipe	Joomla JoomRecipe 1.0.4 component contains a blind SQL injection vulnerability in the search_author parameter on t	131d ago
CVE-2017-20276	8.2	—	—	—	simbunch / simgenealogy	Joomla! Component SIMGenealogy 2.1.5 contains an SQL injection vulnerability that allows unauthenticated attackers	131d ago
CVE-2017-20275	8.2	—	—	—	henryschorradt / bridge	Joomla! Component PHP-Bridge 1.2.3 contains an SQL injection vulnerability that allows unauthenticated attackers t	131d ago
CVE-2017-20274	8.2	—	—	—	king-products / learning management system king	Joomla LMS King Professional 3.2.4.0 contains an SQL injection vulnerability that allows unauthenticated attackers	131d ago
CVE-2017-20273	8.2	—	—	—	joomalshowroom / event registration pro calendar	Joomla Event Registration Pro Calendar 4.1.3 contains an SQL injection vulnerability that allows unauthenticated a	131d ago
CVE-2017-20272	8.2	—	—	—	faboba / ultimate property listing	Joomla Ultimate Property Listing 1.0.2 contains an SQL injection vulnerability that allows unauthenticated attacke	131d ago
CVE-2017-20271	8.2	—	—	—	nordmograph / streetguessr game	Joomla StreetGuessr Game 1.1.8 contains an SQL injection vulnerability that allows unauthenticated attackers to ex	131d ago
CVE-2017-20270	8.2	—	—	—	raindropsinfotech / twitch tv	Joomla! Component Twitch Tv 1.1 contains an SQL injection vulnerability that allows unauthenticated attackers to e	131d ago
CVE-2017-20269	8.2	—	—	—	terrywcarter / kissgallery	Joomla! Component KissGallery 1.0.0 contains an SQL injection vulnerability that allows unauthenticated attackers	131d ago
CVE-2017-20268	8.2	—	—	—	zcontent / zap calendar lite	Joomla! Component Zap Calendar Lite 4.3.4 contains an SQL injection vulnerability that allows unauthenticated atta	131d ago

Sources: NIST National Vulnerability Database (descriptions, CVSS, CPE); CISA KEV, ENISA EUVD, CIRCL and VulnCheck (exploitation status, three catalogues counted; CIRCL shown as an aggregator); FIRST EPSS (exploitation probability). Patch window is the gap between CVE publication and the earliest KEV listing, so a negative value means a catalogue called it exploited before it was disclosed. Data refreshes every five hours.

Loading

CVE Tracker