CVE Tracker: vulnerabilities by vendor, severity and exploitation status

CVE Tracker

15,513 records

Every published CVE from the last 120 days with CVSS score, vendor and product, cross-referenced against CISA's Known Exploited Vulnerabilities catalog. 8 added to KEV in the last 7 days.

SeverityAll critical high medium lowExploitedIn CISA KEV

CVE	CVSS	EPSS	KEV sources	Patch window	Vendor / product	Summary	Published
CVE-2026-9843	8.1	—	—	—	—	The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to arbitrary file dele	131d ago
CVE-2026-49340	8.1	—	—	—	—	gonic is a music streaming server / free-software subsonic server API implementation.	131d ago
CVE-2026-49291	8.1	—	—	—	—	mcp-memory-service is a semantic memory layer for AI applications.	131d ago
CVE-2026-49286	8.1	—	—	—	—	PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page.	131d ago
CVE-2026-49872	8.1	—	—	—	apache / apisix	Improper Authentication vulnerability in Apache APISIX.	131d ago
CVE-2026-47339	8.1	—	—	—	apache / apisix	Incorrect Authorization vulnerability in Apache APISIX.	131d ago
CVE-2026-56076	8.1	—	—	—	—	PraisonAI before 1.5.128 contains a cross-origin agent execution vulnerability in the AGUI endpoint that allows re	132d ago
CVE-2026-43994	8.1	—	—	—	coturn project / coturn	Coturn is a free open source implementation of TURN and STUN Server.	132d ago
CVE-2026-56020	8.1	—	—	—	—	The Webmin HTTP server (miniserv.pl) allows unauthenticated attackers to impersonate any user with a configured SS	132d ago
CVE-2026-42488	8.1	—	—	—	—	Some shadow paging errors paths will switch the page-tables without updating the currently running vCPU reference.	132d ago
CVE-2026-11719	8.1	—	—	—	google / mcp toolbox for databases	An authenticated authorization bypass vulnerability exists in MCP Toolbox for Databases due to missing scope enfor	132d ago
CVE-2026-55744	8.1	—	—	—	—	Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the Personal File St	132d ago
CVE-2026-55200	8.1	—	—	—	libssh2 / libssh2	libssh2 through 1.11.1, fixed in commit 7acf3df contains an out-of-bounds write vulnerability in ssh2_transport_re	133d ago
CVE-2026-50107	8.1	—	—	—	f5 / nginx gateway fabric	When NGINX Plus or NGINX Open Source is configured as the data plane for NGINX Gateway Fabric, an injection vulner	133d ago
CVE-2026-53871	8.1	—	—	—	—	Hermes WebUI before 0.51.368 contains an authorization bypass vulnerability in the get_profile_cookie() function t	133d ago
CVE-2026-30799	8.1	—	—	—	rti / connext professional	Missing Authentication for Critical Function vulnerability in RTI Connext Professional (Security Plugins) allows I	133d ago
CVE-2026-2674	8.1	—	—	—	rti / connext professional	Out-of-bounds Write, Out-of-bounds Write, Out-of-bounds Write vulnerability in RTI Connext Professional (Queueing S	133d ago
CVE-2026-2467	8.1	—	—	—	rti / connext professional	Heap-based Buffer Overflow vulnerability in RTI Connext Professional (Core Libraries) allows Overflow Variables and	133d ago
CVE-2026-54415	8.1	—	—	—	—	Missing Authorization in the server management routes (routes/admin.php) in Azuriom Azuriom CMS before 1.2.11 on a	133d ago
CVE-2026-42530	8.1	—	—	—	f5 / nginx gateway fabric	NGINX Open Source has a vulnerability in the ngx_http_v3_module module.	133d ago
CVE-2026-42055	8.1	—	—	—	f5 / dos	NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_proxy_v2_module and ngx_http_grpc_module mod	133d ago
CVE-2026-32804	8.1	—	—	—	dell / powerflex manager	Dell PowerFlex Manager, version(s) prior to 5.1.0.1, contain(s) an Improper Authentication vulnerability.	133d ago
CVE-2026-11311	8.1	—	—	—	f5 / nginx gateway fabric	When NGINX Plus is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists in the	133d ago
CVE-2026-54814	8.1	—	—	—	—	Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerabil	133d ago
CVE-2026-52707	8.1	—	—	—	—	Unauthenticated Local File Inclusion in Kastell <= 2.0 versions.	133d ago
CVE-2026-40757	8.1	—	—	—	—	Unauthenticated PHP Object Injection in Château <= 1.2.1 versions.	133d ago
CVE-2026-40756	8.1	—	—	—	—	Unauthenticated PHP Object Injection in Zoya <= 1.4 versions.	133d ago
CVE-2026-40752	8.1	—	—	—	—	Unauthenticated PHP Object Injection in Manufaktur Solutions <= 1.1.1 versions.	133d ago
CVE-2026-40738	8.1	—	—	—	—	Unauthenticated PHP Object Injection in Eldon <= 1.4.1 versions.	133d ago
CVE-2026-40733	8.1	—	—	—	—	Unauthenticated PHP Object Injection in ShiftUp <= 1.3 versions.	133d ago
CVE-2026-39590	8.1	—	—	—	—	Unauthenticated Local File Inclusion in Atomlab <= 2.4.5 versions.	133d ago
CVE-2026-39576	8.1	—	—	—	—	Unauthenticated PHP Object Injection in SingleMalt <= 1.5 versions.	133d ago
CVE-2026-39560	8.1	—	—	—	—	Unauthenticated PHP Object Injection in Hiroshi <= 1.5.1 versions.	133d ago
CVE-2026-39559	8.1	—	—	—	—	Unauthenticated Local File Inclusion in Uppercase < 1.2.2 versions.	133d ago
CVE-2026-39556	8.1	—	—	—	—	Unauthenticated PHP Object Injection in Konsept <= 1.9 versions.	133d ago
CVE-2026-39523	8.1	—	—	—	—	Unauthenticated Local File Inclusion in Solene Core <= 2.3.2 versions.	133d ago
CVE-2026-39445	8.1	—	—	—	—	Unauthenticated PHP Object Injection in Alukas < 3.0.0 versions.	133d ago
CVE-2026-39442	8.1	—	—	—	—	Unauthenticated PHP Object Injection in PressMart <= 1.2.26 versions.	133d ago
CVE-2025-69175	8.1	—	—	—	—	Unauthenticated Local File Inclusion in Line Agency <= 1.3.1 versions.	133d ago
CVE-2025-69174	8.1	—	—	—	—	Unauthenticated Local File Inclusion in Etude <= 1.6 versions.	133d ago
CVE-2025-69170	8.1	—	—	—	—	Unauthenticated Local File Inclusion in Eventicity <= 1.5 versions.	133d ago
CVE-2025-69166	8.1	—	—	—	—	Unauthenticated Local File Inclusion in Gunslinger <= 1.7 versions.	133d ago
CVE-2025-69164	8.1	—	—	—	—	Unauthenticated Local File Inclusion in Skyward <= 1.10 versions.	133d ago
CVE-2025-69158	8.1	—	—	—	—	Unauthenticated Local File Inclusion in Granola <= 1.13 versions.	133d ago
CVE-2025-69157	8.1	—	—	—	—	Unauthenticated Local File Inclusion in Gamic <= 1.15 versions.	133d ago
CVE-2025-69144	8.1	—	—	—	—	Unauthenticated Local File Inclusion in Preservation <= 1.10 versions.	133d ago
CVE-2025-69126	8.1	—	—	—	—	Unauthenticated Local File Inclusion in Fortius <= 2.3.0 versions.	133d ago
CVE-2025-69123	8.1	—	—	—	—	Unauthenticated Local File Inclusion in Snow Club <= 1.1 versions.	133d ago
CVE-2025-69120	8.1	—	—	—	—	Unauthenticated Local File Inclusion in Dazzle <= 1.0.0 versions.	133d ago
CVE-2025-69115	8.1	—	—	—	—	Unauthenticated Local File Inclusion in LuxMed \| Medicine & Healthcare Doctor WordPress Theme <= 1.2.2 versions.	133d ago
CVE-2025-69106	8.1	—	—	—	—	Unauthenticated Local File Inclusion in Imba <= 1.5.0 versions.	133d ago
CVE-2026-40761	8.1	—	—	—	—	Unauthenticated PHP Object Injection in Valeska <= 1.2.2 versions.	133d ago
CVE-2026-40760	8.1	—	—	—	—	Unauthenticated PHP Object Injection in Behold <= 1.5 versions.	133d ago
CVE-2026-40759	8.1	—	—	—	—	Unauthenticated PHP Object Injection in Esmée <= 1.4 versions.	133d ago
CVE-2026-40758	8.1	—	—	—	—	Unauthenticated PHP Object Injection in Léonie <= 1.2.1 versions.	133d ago
CVE-2026-40755	8.1	—	—	—	—	Unauthenticated PHP Object Injection in TechLink <= 1.3 versions.	133d ago
CVE-2026-40754	8.1	—	—	—	—	Unauthenticated PHP Object Injection in Roisin <= 1.4 versions.	133d ago
CVE-2026-40753	8.1	—	—	—	—	Unauthenticated PHP Object Injection in EasyMeals <= 1.5.1 versions.	133d ago
CVE-2026-40751	8.1	—	—	—	—	Unauthenticated PHP Object Injection in Ashtanga <= 1.2 versions.	133d ago
CVE-2026-40739	8.1	—	—	—	—	Unauthenticated PHP Object Injection in LuxeDrive <= 1.4 versions.	133d ago

Sources: NIST National Vulnerability Database (descriptions, CVSS, CPE); CISA KEV, ENISA EUVD, CIRCL and VulnCheck (exploitation status, three catalogues counted; CIRCL shown as an aggregator); FIRST EPSS (exploitation probability). Patch window is the gap between CVE publication and the earliest KEV listing, so a negative value means a catalogue called it exploited before it was disclosed. Data refreshes every five hours.

Loading

CVE Tracker