CVE Tracker: vulnerabilities by vendor, severity and exploitation status

CVE Tracker

15,513 records

Every published CVE from the last 120 days with CVSS score, vendor and product, cross-referenced against CISA's Known Exploited Vulnerabilities catalog. 8 added to KEV in the last 7 days.

SeverityAll critical high medium lowExploitedIn CISA KEV

CVE	CVSS	EPSS	KEV sources	Patch window	Vendor / product	Summary	Published
CVE-2026-62477	8.1	—	—	—	oracle / hyperion infrastructure technology	Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Common Secur	71d ago
CVE-2026-62471	8.1	—	—	—	oracle / hyperion infrastructure technology	Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Common Event	71d ago
CVE-2026-62442	8.1	—	—	—	oracle / siebel crm	Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager).	71d ago
CVE-2026-61321	8.1	—	—	—	oracle / siebel crm	Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager).	71d ago
CVE-2026-61307	8.1	—	—	—	oracle / peoplesoft enterprise cc common application objects	Vulnerability in the PeopleSoft Enterprise CC Common Application Objects product of Oracle PeopleSoft (component:	71d ago
CVE-2026-61293	8.1	—	—	—	oracle / hyperion calculation manager	Vulnerability in the Oracle Hyperion Calculation Manager product of Oracle Hyperion (component: Security).	71d ago
CVE-2026-61281	8.1	—	—	—	oracle / hyperion calculation manager	Vulnerability in the Oracle Hyperion Calculation Manager product of Oracle Hyperion (component: Security).	71d ago
CVE-2026-61270	8.1	—	—	—	oracle / jd edwards enterpriseone orchestrator	Vulnerability in the JD Edwards EnterpriseOne Orchestrator product of Oracle JD Edwards (component: E1 IOT Orchest	71d ago
CVE-2026-61268	8.1	—	—	—	oracle / jd edwards enterpriseone tools	Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Business Logic Infra	71d ago
CVE-2026-61265	8.1	—	—	—	oracle / jd edwards enterpriseone orchestrator	Vulnerability in the JD Edwards EnterpriseOne Orchestrator product of Oracle JD Edwards (component: E1 IOT Orchest	71d ago
CVE-2026-61229	8.1	—	—	—	oracle / webcenter portal	Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools).	71d ago
CVE-2026-61177	8.1	—	—	—	oracle / webcenter portal	Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools).	71d ago
CVE-2026-60992	8.1	—	—	—	oracle / identity manager connector	Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core).	71d ago
CVE-2026-60831	8.1	—	—	—	oracle / peoplesoft enterprise peopletools	Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Integration Broker	71d ago
CVE-2026-60791	8.1	—	—	—	oracle / siebel crm	Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Application Interface).	71d ago
CVE-2026-60779	8.1	—	—	—	oracle / siebel apps - marketing	Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing).	71d ago
CVE-2026-60757	8.1	—	—	—	oracle / siebel crm	Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Search).	71d ago
CVE-2026-60742	8.1	—	—	—	oracle / peoplesoft enterprise peopletools	Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: PIA Core Technolog	71d ago
CVE-2026-60680	8.1	—	—	—	oracle / weblogic server	Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).	71d ago
CVE-2026-60415	8.1	—	—	—	oracle / weblogic server	Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).	71d ago
CVE-2026-52793	8.1	—	—	—	—	Froxlor is open source server administration software.	71d ago
CVE-2026-71308	8.1	—	—	—	—	Lemur manages TLS certificate creation.	71d ago
CVE-2025-9210	8.1	—	—	—	—	Missing signature validation in JSON Web Tokens in Otalio Ship Property Management System versions before 2.22.0 al	71d ago
CVE-2026-67262	8.1	—	—	—	—	Dell PowerStore contains a Missing Authorization vulnerability.	71d ago
CVE-2026-50143	8.1	—	—	—	—	The Apify MCP server enables AI agents to extract data from websites using ready-made scrapers, crawlers, and auto	71d ago
CVE-2026-44472	8.1	—	—	—	—	Saleor is an e-commerce platform.	71d ago
CVE-2026-70415	8.1	—	—	—	—	Dell PowerStore SDNAS contains a Buffer Copy without Checking Size of Input vulnerability in NFS/RPC.	71d ago
CVE-2026-73400zero day	8.1	0.47%	1/3	same day	—	Unauthenticated Local File Inclusion in Restaurant Menu by MotoPress <= 2.4.11 versions.	71d ago
CVE-2026-50138	8.1	—	—	—	—	goshs is a SimpleHTTPServer written in Go.	71d ago
CVE-2026-32464	8.1	—	—	—	—	Unauthenticated Local File Inclusion in Theme Test Drive <= 2.9.1 versions.	71d ago
CVE-2026-28570	8.1	—	—	—	—	Unauthenticated Local File Inclusion in Vavo Core <= 2.3.0 versions.	71d ago
CVE-2026-74983	8.1	—	—	—	mozilla / firefox	Mitigation bypass in the Data Loss Prevention component.	71d ago
CVE-2026-74981	8.1	—	—	—	mozilla / firefox	Site isolation issue in the Audio/Video: Web Codecs component.	71d ago
CVE-2026-74978	8.1	—	—	—	mozilla / firefox	Clickjacking issue in the Widget component.	71d ago
CVE-2026-74962	8.1	—	—	—	mozilla / firefox	Site isolation issue in the Networking: Cookies component.	71d ago
CVE-2026-74960	8.1	—	—	—	mozilla / firefox	Site isolation issue in the WebExtensions component.	71d ago
CVE-2026-74957	8.1	—	—	—	mozilla / firefox	Mitigation bypass in the Safe Browsing component.	71d ago
CVE-2026-75829	8.1	—	—	—	—	grav-plugin-api versions before 1.0.15 fail to validate Twig content in the translate() endpoint, allowing attacke	71d ago
CVE-2026-15371	8.1	—	—	—	—	Velociraptor's web GUI allows specifying a custom type for columns in tables.	71d ago
CVE-2026-57233	8.1	—	—	—	—	Notepad++ is a free and open-source source code editor.	72d ago
CVE-2026-33437	8.1	—	—	—	—	Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files.	72d ago
CVE-2026-75051	8.1	—	—	—	—	In JetBrains YouTrack before 2026.2.17917 unauthorised project transfer between organisations was possible	72d ago
CVE-2026-75044	8.1	—	—	—	—	In JetBrains YouTrack before 2025.3.156085, 2026.1.13914, 2026.2.18095 missing authorisation allowed an authentica	72d ago
CVE-2026-19693	8.1	—	—	—	—	extract-zip through 2.0.1 containment-checks only the parent directory of each archive entry and never the entry's	72d ago
CVE-2026-19901	8.1	—	—	—	—	A security flaw has been discovered in LB-LINK X-PRO 1.0.22-20231206.	74d ago
CVE-2026-19900	8.1	—	—	—	—	A vulnerability was identified in LB-LINK X-PRO 1.0.22-20231206.	74d ago
CVE-2026-18500	8.1	—	—	—	fastify / fastify\/jwt	@fastify/jwt is a JSON Web Token plugin for Fastify.	74d ago
CVE-2026-74410	8.1	—	—	—	—	In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: fix OOB read from firmware RX des	74d ago
CVE-2026-74340	8.1	—	—	—	—	In the Linux kernel, the following vulnerability has been resolved: wifi: wcn36xx: fix OOB read from firmware coun	74d ago
CVE-2026-72310	8.1	—	—	—	—	In the Linux kernel, the following vulnerability has been resolved: smb: client: fix overflow in passthrough ioctl	74d ago
CVE-2026-72227	8.1	—	—	—	—	In the Linux kernel, the following vulnerability has been resolved: batman-adv: mcast: avoid OOB read of num_dests	74d ago
CVE-2026-72115	8.1	—	—	—	—	In the Linux kernel, the following vulnerability has been resolved: can: bcm: track a single source interface for	74d ago
CVE-2026-68472	8.1	—	—	—	—	In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: validate EHT MLE before MLD ID	74d ago
CVE-2026-73683	8.1	—	—	—	—	Laravel Socialite's Facebook provider contains an authentication bypass vulnerability that allows unauthenticated	75d ago
CVE-2026-19629	8.1	—	—	—	tenable / security center	A privilege escalation vulnerability exists in Tenable Security Center that allows a user with "Security Manager"	75d ago
CVE-2026-16772	8.1	—	—	—	—	In Akaunting versions <= 3.1.21, low‑privileged authenticated users can modify their own account to assign themsel	75d ago
CVE-2026-19768	8.1	—	—	—	—	Improper control of generation of code ('Code Injection') in the settings feature in Devolutions PowerShell Univer	75d ago
CVE-2026-72836	8.1	—	—	—	—	FileBrowser before 2.63.19 does not account for case-insensitive filesystems when checking home directory ownershi	75d ago
CVE-2026-18039exploited	8.1	0.38%	1/3	+60d	—	The Essential Addons for Elementor WordPress plugin before 6.7.2 does not prevent user-supplied registration field	75d ago
CVE-2026-73659	8.1	—	—	—	—	Trigger.dev is the open-source platform for building AI workflows in TypeScript.	76d ago

Sources: NIST National Vulnerability Database (descriptions, CVSS, CPE); CISA KEV, ENISA EUVD, CIRCL and VulnCheck (exploitation status, three catalogues counted; CIRCL shown as an aggregator); FIRST EPSS (exploitation probability). Patch window is the gap between CVE publication and the earliest KEV listing, so a negative value means a catalogue called it exploited before it was disclosed. Data refreshes every five hours.

Loading

CVE Tracker