CVE Tracker: vulnerabilities by vendor, severity and exploitation status

CVE Tracker

15,513 records

Every published CVE from the last 120 days with CVSS score, vendor and product, cross-referenced against CISA's Known Exploited Vulnerabilities catalog. 8 added to KEV in the last 7 days.

SeverityAll critical high medium lowExploitedIn CISA KEV

CVE	CVSS	EPSS	KEV sources	Patch window	Vendor / product	Summary	Published
CVE-2017-20267	8.2	—	—	—	joomla / calendar planner	Joomla! Component Calendar Planner 1.0.1 contains an SQL injection vulnerability that allows unauthenticated attac	131d ago
CVE-2017-20266	8.2	—	—	—	joomshaper / standard pro movie database	Joomla SP Movie Database 1.3 contains an SQL injection vulnerability that allows unauthenticated attackers to exec	131d ago
CVE-2017-20263	8.2	—	—	—	focalpointx / focalpoint	Joomla! Component FocalPoint Pro/Free 1.2.3 contains an SQL injection vulnerability that allows unauthenticated at	131d ago
CVE-2017-20262	8.2	—	—	—	webkul / ajax quiz	Joomla! Component Ajax Quiz 1.8 contains an SQL injection vulnerability that allows unauthenticated attackers to e	131d ago
CVE-2017-20261	8.2	—	—	—	weborange / bargain product vm3	Joomla! Component Bargain Product VM3 1.0 contains an SQL injection vulnerability that allows unauthenticated atta	131d ago
CVE-2017-20260	8.2	—	—	—	weborange / price alert	Joomla! Component Price Alert 3.0.2 contains an SQL injection vulnerability that allows unauthenticated attackers	131d ago
CVE-2017-20259	8.2	—	—	—	joomlashack / osdownloads	Joomla OSDownloads 1.7.4 contains an SQL injection vulnerability that allows unauthenticated attackers to execute	131d ago
CVE-2017-20258	8.2	—	—	—	extro / responsive portfolio	Joomla! Component RPC Responsive Portfolio 1.6.1 contains an SQL injection vulnerability that allows unauthenticat	131d ago
CVE-2017-20257	8.2	—	—	—	joomplace / quiz deluxe	Joomla! Component Quiz Deluxe 3.7.4 contains an SQL injection vulnerability that allows unauthenticated attackers	131d ago
CVE-2017-20256	8.2	—	—	—	joomplace / survey force deluxe	Joomla Survey Force Deluxe 3.2.4 contains an SQL injection vulnerability that allows unauthenticated attackers to	131d ago
CVE-2017-20255	8.2	—	—	—	joombooking / jb visa	Joomla! Component JB Visa 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to exe	131d ago
CVE-2017-20254	8.2	—	—	—	gegabyte / user bench	Joomla! Component User Bench 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to	131d ago
CVE-2017-20253	8.2	—	—	—	gegabyte / my projects	Joomla! Component My Projects 2.0 contains an SQL injection vulnerability that allows unauthenticated attackers to	131d ago
CVE-2017-20252	8.2	—	—	—	nextgeneditor / nextgen editor	Joomla NextGen Editor 2.1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execu	131d ago
CVE-2026-48617	8.2	—	—	—	nodejs / node.js	A flaw in Node.js Permission Model enforcement allows Bypass via `process.report.writeReport()` Path Misvalidation	132d ago
CVE-2026-48764	8.2	—	—	—	—	TypeBot is a chatbot builder tool.	132d ago
CVE-2026-50194	8.2	—	—	—	—	Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native app	132d ago
CVE-2026-55202	8.2	—	—	—	—	Tinyproxy through 1.11.3, fixed in commit 09312a1, fails to properly validate the Host header during stathost dete	133d ago
CVE-2026-30802	8.2	—	—	—	rti / connext micro	Out-of-bounds Read vulnerability in RTI Connext Micro (Core Libraries) allows Overread Buffers.This issue affects	133d ago
CVE-2026-54184	8.2	—	—	—	—	Unauthenticated Insecure Direct Object References (IDOR) in Clean Login <= 1.15 versions.	133d ago
CVE-2026-49081	8.2	—	—	—	—	Unauthenticated Broken Access Control in User Registration Stripe <= 1.3.12 versions.	133d ago
CVE-2026-48788	8.2	—	—	—	—	Remark42 is a self-hosted comment engine for blogs, articles, or any other place where readers can add comments.	133d ago
CVE-2026-40726	8.2	—	—	—	—	Unauthenticated Broken Access Control in User Registration Stripe <= 1.3.14 versions.	133d ago
CVE-2026-46866	8.2	—	—	—	oracle / enterprise manager base platform	Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Agen	133d ago
CVE-2026-46865	8.2	—	—	—	oracle / enterprise manager base platform	Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Exte	133d ago
CVE-2026-46806	8.2	—	—	—	oracle / webcenter content	Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).	133d ago
CVE-2026-35288	8.2	—	—	—	oracle / peoplesoft enterprise pt peopletools	Vulnerability in the PeopleSoft Enterprise PT PeopleTools product of Oracle PeopleSoft (component: Deployment Pack	133d ago
CVE-2026-35274	8.2	—	—	—	oracle / peoplesoft enterprise pt peopletools	Vulnerability in the PeopleSoft Enterprise PT PeopleTools product of Oracle PeopleSoft (component: Deployment Pack	133d ago
CVE-2026-48780	8.2	—	—	—	—	Forem is open source software for building communities.	134d ago
CVE-2026-49065	8.2	—	—	—	—	Unauthenticated Broken Access Control in Hippoo Mobile App for WooCommerce <= 1.9.5 versions.	134d ago
CVE-2026-42664	8.2	—	—	—	—	Unauthenticated Broken Access Control in AI Product Search for WooCommerce – Motive Commerce Search <= 1.38.	134d ago
CVE-2016-20073	8.2	—	—	—	—	Answer My Question 1.3 plugin for WordPress contains an SQL injection vulnerability that allows unauthenticated at	135d ago
CVE-2016-20072	8.2	—	—	—	—	BBS e-Franchise 1.1.1 plugin for WordPress contains an SQL injection vulnerability that allows unauthenticated att	135d ago
CVE-2016-20071	8.2	—	—	—	—	The 404 Redirection Manager plugin version 1.0 for WordPress contains an unauthenticated SQL injection vulnerabili	135d ago
CVE-2016-20069	8.2	—	—	—	—	WordPress Booking Calendar Contact Form 1.0.23 contains an unauthenticated blind SQL injection vulnerability in th	135d ago
CVE-2016-20068	8.2	—	—	—	—	WordPress Booking Calendar Contact Form version 1.0.23 contains an unauthenticated blind SQL injection vulnerabili	135d ago
CVE-2026-54413	8.2	—	—	—	—	driftregion iso14229 through 0.9.0 contains an integer underflow and downstream out-of-bounds read in the Handle_0	136d ago
CVE-2026-54412	8.2	—	—	—	—	LiamBindle MQTT-C through version 1.1.6 contains a heap-based out-of-bounds read and integer underflow in the mqtt	136d ago
CVE-2026-50088	8.2	—	—	—	aqara / developer portal	The Aqara Developer Portal (developer.aqara.com) and shared test environments (developer-test.aqara.com, aiot-test	138d ago
CVE-2026-50087	8.2	—	—	—	aqara / iam\/sso gateway	The Aqara IAM/SSO gateway (gw-builder.aqara.com) exhibits a cross-origin request sharing vulnerability, which is a	138d ago
CVE-2026-53721	8.2	—	—	—	nuxt / nuxt	Nuxt is an open-source web development framework for Vue.js.	138d ago
CVE-2026-52859	8.2	—	—	—	vim / vim	Vim is an open source, command line text editor.	139d ago
CVE-2026-49982	8.2	—	—	—	raszi / tmp	tmp is a temporary file and directory creator for node.js.	139d ago
CVE-2026-44705	8.2	—	—	—	raszi / tmp	tmp is a temporary file and directory creator for node.js.	139d ago
CVE-2026-40998	8.2	—	—	—	broadcom / spring web services	Jaxp13XPathTemplate evaluated XPath expressions for StreamSource and SAXSource inputs using a code path that parse	139d ago
CVE-2026-40994	8.2	—	—	—	broadcom / spring web services	Wss4jSecurityInterceptor initialized its BSP (WS-I Basic Security Profile) compliance flag so that inbound validat	139d ago
CVE-2026-50637	8.2	—	—	—	pevans / metrics\	Metrics::Any::Adapter::Statsd versions before 0.04 for Perl does not protect against metric injections.	140d ago
CVE-2026-49759	8.2	—	—	—	erlang / erlang\/otp	Stack-based Buffer Overflow vulnerability in Erlang OTP erts (inet_drv) allows an unauthenticated remote attacker	140d ago
CVE-2023-29146	8.2	—	—	—	—	The utility functions used by Malwarebytes EDR 1.0.11 on Linux for calculating a cryptographic hash of data bytes	141d ago
CVE-2026-47652	8.2	—	—	—	microsoft / windows 11 23h2	Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to execute code locally.	141d ago
CVE-2026-45476	8.2	—	—	—	microsoft / azure network adapter	Use after free in Linux MANA Driver allows an authorized attacker to elevate privileges locally.	141d ago
CVE-2026-44822	8.2	—	—	—	microsoft / 365 apps	Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a networ	141d ago
CVE-2017-20249	8.2	—	—	—	—	Apptha Slider Gallery 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute	141d ago
CVE-2017-20247	8.2	—	—	—	—	WordPress Plugin PICA Photo Gallery 1.0 contains an SQL injection vulnerability that allows unauthenticated attack	141d ago
CVE-2017-20246	8.2	—	—	—	—	KittyCatfish 2.2 plugin for WordPress contains an SQL injection vulnerability that allows unauthenticated attacker	141d ago
CVE-2017-20245	8.2	—	—	—	—	Wow Viral Signups 2.1 WordPress plugin contains an SQL injection vulnerability that allows unauthenticated attacke	141d ago
CVE-2017-20244	8.2	—	—	—	—	Wow Forms WordPress Plugin version 2.1 contains an SQL injection vulnerability that allows unauthenticated attacke	141d ago
CVE-2017-20243	8.2	—	—	—	—	WordPress Car Park Booking Plugin version 13 October 17 contains a time-based SQL injection vulnerability that all	141d ago
CVE-2016-20065	8.2	—	—	—	—	Product Catalog 8 1.2 plugin for WordPress contains an SQL injection vulnerability that allows unauthenticated att	141d ago
CVE-2016-20062	8.2	—	—	—	—	Simply Poll 1.4.1 plugin for WordPress contains an SQL injection vulnerability that allows unauthenticated attacke	141d ago

Sources: NIST National Vulnerability Database (descriptions, CVSS, CPE); CISA KEV, ENISA EUVD, CIRCL and VulnCheck (exploitation status, three catalogues counted; CIRCL shown as an aggregator); FIRST EPSS (exploitation probability). Patch window is the gap between CVE publication and the earliest KEV listing, so a negative value means a catalogue called it exploited before it was disclosed. Data refreshes every five hours.

Loading

CVE Tracker