CVE Tracker: vulnerabilities by vendor, severity and exploitation status

CVE Tracker

15,513 records

Every published CVE from the last 120 days with CVSS score, vendor and product, cross-referenced against CISA's Known Exploited Vulnerabilities catalog. 8 added to KEV in the last 7 days.

SeverityAll critical high medium lowExploitedIn CISA KEV

CVE	CVSS	EPSS	KEV sources	Patch window	Vendor / product	Summary	Published
CVE-2026-13308	8.1	—	—	—	—	Autel MaxiCharger AC Elite Home WebSockets Integer Underflow Remote Code Execution Vulnerability.	91d ago
CVE-2026-67192	8.1	—	—	—	—	Xlight FTP Server before 3.9.5 contains a pre-authentication stack buffer overflow vulnerability that allows unaut	91d ago
CVE-2026-58179	8.1	—	—	—	apache / traffic server	The Apache Traffic Server regex_remap plugin overflows the stack and integers from substitution input.	91d ago
CVE-2026-58177	8.1	—	—	—	apache / traffic server	The Apache Traffic Server Cripts framework has out-of-bounds writes, path traversal, and use-after-free errors.	91d ago
CVE-2026-63231	8.1	—	—	—	—	A post-authentication SQL injection vulnerability in Koollab LMS allowed an authenticated attacker to use an error	91d ago
CVE-2026-14300	8.1	—	—	—	—	The miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) WordPress plugin before 7.8.0 does n	91d ago
CVE-2026-14974	8.1	—	—	—	ibm / websphere application server	IBM WebSphere Application Server 8.5, and 9.0 traditional could allow a remote attacker to execute arbitrary code	92d ago
CVE-2026-48060	8.1	—	—	—	—	Litestar is an Asynchronous Server Gateway Interface (ASGI) framework.	92d ago
CVE-2026-7769	8.1	—	—	—	ibm / sterling b2b integrator	IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.5_2, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 and	92d ago
CVE-2026-54593	8.1	—	—	—	—	Pterodactyl is a free, open-source game server management panel.	92d ago
CVE-2026-14169	8.1	—	—	—	—	Due to incorrect behavior order a low privileged remote attacker could trigger account inconsistent state via craf	92d ago
CVE-2026-64768	8.1	—	—	—	apple / ipados	An out-of-bounds read issue was addressed with improved input validation.	93d ago
CVE-2026-64719	8.1	—	—	—	apple / safari	An out-of-bounds access issue was addressed with improved bounds checking.	93d ago
CVE-2026-64713	8.1	—	—	—	apple / safari	This issue was addressed with improved checks.	93d ago
CVE-2026-64547	8.1	—	—	—	—	In the Linux kernel, the following vulnerability has been resolved: net: usb: net1080: validate packet_len before	93d ago
CVE-2026-64540	8.1	—	—	—	—	In the Linux kernel, the following vulnerability has been resolved: usbnet: gl620a: fix out-of-bounds read in gene	93d ago
CVE-2026-42016exploited	8.1	8.6%	3/3	+45d	jfrog / artifactory	JFrog Artifactory (Self Hosted) versions before 7.133.11 are vulnerable to a privilege escalation attack due to a	93d ago
CVE-2026-64536	8.1	—	—	—	—	In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB reads in is_ap_in_	93d ago
CVE-2026-13152	8.1	—	—	—	—	The Custom Fields Account Registration For Woocommerce WordPress plugin before 1.4 does not prevent its custom reg	93d ago
CVE-2026-12255	8.1	—	—	—	—	The MainWP Child WordPress plugin before 6.1.2 does not verify the requester's identity in its site-registration r	93d ago
CVE-2026-17496	8.1	—	—	—	notegen / notegen	NoteGen before 0.32.0 renders AI chat responses with markdown-it configured with html:true and injects the result	94d ago
CVE-2026-64444	8.1	—	—	—	linux / linux kernel	In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in OnAssocRsp	95d ago
CVE-2026-64443	8.1	—	—	—	linux / linux kernel	In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in update_bea	95d ago
CVE-2026-64442	8.1	—	—	—	linux / linux kernel	In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB reads in IE loops	95d ago
CVE-2026-64440	8.1	—	—	—	linux / linux kernel	In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB write in HT_caps_h	95d ago
CVE-2026-64398	8.1	—	—	—	linux / linux kernel	In the Linux kernel, the following vulnerability has been resolved: ksmbd: add a permission check for FSCTL_SET_ZE	95d ago
CVE-2026-64368	8.1	—	—	—	linux / linux kernel	In the Linux kernel, the following vulnerability has been resolved: mm/slab: do not limit zeroing to orig_size whe	95d ago
CVE-2026-10818exploited	8.1	2.5%	1/3	+80d	—	The WPForms Pro plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including,	95d ago
CVE-2026-66374	8.1	—	—	—	—	Knot Resolver before 6.4.1 allows remote code execution via a heap-based buffer overflow in the DoQ (DNS-over-QUIC	96d ago
CVE-2026-54342	8.1	—	—	—	—	In epa4all, prior to version 2026-05-20, an attacker on the network path between epa4all and any backend (ePA Akte	96d ago
CVE-2026-65708	8.1	—	—	—	—	sysPass through version 3.2.11 contains an insecure direct object reference vulnerability that allows any authenti	96d ago
CVE-2026-64235	8.1	—	—	—	linux / linux kernel	In the Linux kernel, the following vulnerability has been resolved: x86/ftrace: Relocate %rip-relative percpu refs	96d ago
CVE-2026-64223	8.1	—	—	—	linux / linux kernel	In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: consume only present negotiate	96d ago
CVE-2026-8789	8.1	—	—	—	—	The Easy Appointments plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capa	96d ago
CVE-2026-49035	8.1	—	—	—	—	The affected product is vulnerable to a heap-based buffer overflow via a crafted MMS Initiate request.	97d ago
CVE-2026-65916	8.1	—	—	—	—	CyberPanel through 1.9.1, fixed in commit b198460, contains a missing authorization vulnerability in the cancelBac	97d ago
CVE-2026-64815	8.1	—	—	—	jetbrains / intellij idea	In JetBrains IntelliJ IDEA before 2026.2 arbitrary code injection was possible via UI Designer form files	97d ago
CVE-2026-59545	8.1	—	—	—	—	Unauthenticated Broken Authentication in miniOrange Discord Integration <= 2.2.4 versions.	97d ago
CVE-2026-65757	8.1	—	—	—	—	Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Modules Anywhere extensi	97d ago
CVE-2026-13072	8.1	—	—	—	mongodb / mongodb	When compute mode is enabled on a standalone mongod instance, insufficient validation of externally sourced BSON d	98d ago
CVE-2026-13059	8.1	—	—	—	mongodb / mongodb	An authenticated user with low privileges may be able to perform unauthorized reads and writes on data protected b	98d ago
CVE-2026-13190	8.1	—	—	—	progress / telerik ui for asp.net ajax	In Progress® Telerik® UI for AJAX prior to v2026.2.708, a deserialization vulnerability in the persistence utiliti	98d ago
CVE-2026-13187	8.1	—	—	—	progress / telerik ui for asp.net ajax	In Progress® Telerik® UI for AJAX prior to v2026.2.708, DialogHandler provider type input may be tampered with, po	98d ago
CVE-2026-13186	8.1	—	—	—	progress / telerik ui for asp.net ajax	In Progress® Telerik® UI for AJAX prior to v2026.2.708, a path traversal vulnerability in the file-based persisten	98d ago
CVE-2026-13185	8.1	—	—	—	progress / telerik ui for asp.net ajax	In Progress® Telerik® UI for AJAX prior to v2026.2.708, applications using cookie-based storage in RadPersistenceM	98d ago
CVE-2026-13181	8.1	—	—	—	progress / telerik ui for asp.net ajax	In Progress® Telerik® UI for AJAX prior to v2026.2.708, forged upload metadata can influence AsyncUploadTypeName p	98d ago
CVE-2026-65596	8.1	—	—	—	n8n / n8n	n8n before 1.123.64, 2.29.8, and 2.30.1 fails to enforce the "Allowed HTTP Request Domains" restriction on HTTP-ba	98d ago
CVE-2026-4773	8.1	—	—	—	—	Improper validation of specified type of input vulnerability in Magarsus Consulting Ltd.	98d ago
CVE-2026-15802	8.1	—	—	—	—	The WP Foodbakery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path vali	98d ago
CVE-2026-62547	8.1	—	—	—	oracle / workflow	Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer).	99d ago
CVE-2026-62530	8.1	—	—	—	oracle / human resources management system	Vulnerability in the Oracle HRMS (France) product of Oracle E-Business Suite (component: French HR).	99d ago
CVE-2026-62514	8.1	—	—	—	oracle / e-business suite	Vulnerability in the Oracle Process Manufacturing Regulatory Management product of Oracle E-Business Suite (compon	99d ago
CVE-2026-62504	8.1	—	—	—	oracle / time and labor	Vulnerability in the Oracle Time and Labor product of Oracle E-Business Suite (component: Internal Operations).	99d ago
CVE-2026-62497	8.1	—	—	—	oracle / flow manufacturing	Vulnerability in the Oracle Flow Manufacturing product of Oracle E-Business Suite (component: Internal Operations)	99d ago
CVE-2026-62494	8.1	—	—	—	oracle / time and labor	Vulnerability in the Oracle Time and Labor product of Oracle E-Business Suite (component: Internal Operations).	99d ago
CVE-2026-62472	8.1	—	—	—	oracle / installed base	Vulnerability in the Oracle Installed Base product of Oracle E-Business Suite (component: Create Item Instance).	99d ago
CVE-2026-62468	8.1	—	—	—	oracle / human resources	Vulnerability in the Oracle Human Resources product of Oracle E-Business Suite (component: Enterprise Command Cent	99d ago
CVE-2026-62451	8.1	—	—	—	oracle / work in process	Vulnerability in the Oracle Work in Process product of Oracle E-Business Suite (component: Internal Operations).	99d ago
CVE-2026-62445	8.1	—	—	—	oracle / order management	Vulnerability in the Oracle Order Management product of Oracle E-Business Suite (component: Product Diagnostic Too	99d ago
CVE-2026-61338	8.1	—	—	—	oracle / e-business suite	Vulnerability in the Oracle Contracts Integration product of Oracle E-Business Suite (component: Internal Operatio	99d ago

Sources: NIST National Vulnerability Database (descriptions, CVSS, CPE); CISA KEV, ENISA EUVD, CIRCL and VulnCheck (exploitation status, three catalogues counted; CIRCL shown as an aggregator); FIRST EPSS (exploitation probability). Patch window is the gap between CVE publication and the earliest KEV listing, so a negative value means a catalogue called it exploited before it was disclosed. Data refreshes every five hours.

Loading

CVE Tracker