CVE Tracker: vulnerabilities by vendor, severity and exploitation status

CVE Tracker

21,446 records

Every published CVE from the last 120 days with CVSS score, vendor and product, cross-referenced against CISA's Known Exploited Vulnerabilities catalog. 6 added to KEV in the last 7 days.

SeverityAll critical high medium lowExploitedIn CISA KEV

CVE	CVSS	EPSS	KEV sources	Patch window	Vendor / product	Summary	Published
CVE-2026-60368	8.8	—	—	—	oracle / platform security for java	Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized	79d ago
CVE-2026-64791	8.8	—	—	—	—	Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Regular Labs Extension M	79d ago
CVE-2026-63685	8.8	—	—	—	—	Joomla Extension - regularlabs.com - Authorization bypass in DB Replacer extension - Administrator routes and repl	79d ago
CVE-2026-63684	8.8	—	—	—	—	Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in various admin/import/exp	79d ago
CVE-2026-63280	8.8	—	—	—	—	Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Regular Labs conditions	79d ago
CVE-2025-50330	8.8	—	—	—	—	An issue in ZipGenius Team ZipGenius v.6.3.2.3116 and before allows a remote attacker to escalate privileges and e	79d ago
CVE-2025-50327	8.8	—	—	—	—	An issue in Franco Corbelli ZPAQFRANZ v.61.3 and before allows a remote attacker to escalate privileges and execut	79d ago
CVE-2025-50324	8.8	—	—	—	—	An issue in Milos Paripovic OneCommander v.3.96.0.0 allows a remote attacker to execute arbitrary code via the One	79d ago
CVE-2025-44090	8.8	—	—	—	—	An issue in OhSoft CoffeeZip v4.8.0.0 allows attackers to execute arbitrary code via downloading and executing a c	79d ago
CVE-2025-44089	8.8	—	—	—	—	An issue in NCH Software ExpressZip v11.29 allows attackers to execute arbitrary code via downloading and executin	79d ago
CVE-2026-22049	8.8	—	—	—	netapp / ontap	ONTAP versions 9.16.1 and higher with WebAuthn multi-factor authentication (MFA) configured are susceptible to a v	80d ago
CVE-2026-64835	8.8	—	—	—	ffmpeg / ffmpeg	FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the ADX audio decoder wi	80d ago
CVE-2026-64832	8.8	—	—	—	ffmpeg / ffmpeg	FFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability in the NVIDIA NVDEC hardware decoder within	80d ago
CVE-2026-65013	8.8	—	—	—	—	Onlook through 0.2.32, fixed in commit 423e2e9, contains a broken object level authorization vulnerability that al	80d ago
CVE-2026-64831	8.8	—	—	—	ffmpeg / ffmpeg	FFmpeg versions 8.0 through 8.1.2 contains a stack buffer overflow vulnerability in the Vulkan HEVC hardware decod	80d ago
CVE-2026-64830	8.8	—	—	—	ffmpeg / ffmpeg	FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub subtitle demuxer tha	80d ago
CVE-2026-49499	8.8	—	—	—	dell / powerprotect data manager	Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contain(s) a Generation of Incorrect Security Tokens v	80d ago
CVE-2026-65603	8.8	—	—	—	—	The Grav Login plugin (grav-plugin-login) versions <= 3.8.11 contain a privilege escalation flaw in the authentica	80d ago
CVE-2026-65602	8.8	—	—	—	traefik / traefik	Traefik 3.6.0 through 3.6.22 and 3.7.0 through 3.7.6 fail to enforce the crossProviderNamespaces allowlist for Ing	80d ago
CVE-2026-65601	8.8	—	—	—	traefik / traefik	Traefik versions 3.7.0 through 3.7.6 contain a namespace confusion vulnerability in the Kubernetes Gateway API pro	80d ago
CVE-2026-65595	8.8	—	—	—	n8n / n8n	n8n before 2.30.1 and 2.29.8 assigns all Public API key scopes to JWTs issued through the Token Exchange module re	80d ago
CVE-2026-65591	8.8	—	—	—	n8n / n8n	n8n contains a sanitizer bypass vulnerability in the legacy expression evaluator's computed-member handler.	80d ago
CVE-2026-65016	8.8	—	—	—	n8n / n8n	n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a privilege escalation vulnerability in Enterprise SSO in	80d ago
CVE-2026-65015	8.8	—	—	—	n8n / n8n	n8n versions before 2.30.1 contain a privilege escalation vulnerability in the AI Agents feature where the node-ex	80d ago
CVE-2026-14551	8.8	—	—	—	—	The servereye client (also known as sensorhub, technically ClientAgentContainerService) versions 20.15 and earlier	80d ago
CVE-2026-3821	8.8	—	—	—	—	Supermicro (SMC) SMASH services contain an Arbitrary code execution issue in X14DBG-DAP and X14DBI.	80d ago
CVE-2026-12968	8.8	—	—	—	—	The Product Addons and Product Options With Custom Fields WordPress plugin before 1.6.15 does not restrict an unau	80d ago
CVE-2026-16423	8.8	—	—	—	google / chrome	Use after free in UI in Google Chrome prior to 150.0.7871.182 allowed a remote attacker who convinced a user to en	80d ago
CVE-2026-16421	8.8	—	—	—	google / chrome	Inappropriate implementation in WebAudio in Google Chrome prior to 150.0.7871.182 allowed a remote attacker to exe	80d ago
CVE-2026-16420	8.8	—	—	—	google / chrome	Type Confusion in WebAudio in Google Chrome prior to 150.0.7871.182 allowed a remote attacker to execute arbitrary	80d ago
CVE-2026-16418	8.8	—	—	—	google / chrome	Stack buffer overflow in V8 in Google Chrome prior to 150.0.7871.182 allowed a remote attacker to execute arbitrar	80d ago
CVE-2026-8987	8.8	—	—	—	autel / maxicharger single charger firmware	Autel Maxi Charger Single firmware through V1.03.51 contains a heap-based buffer overflow in the set_ap_param comma	80d ago
CVE-2026-62534	8.8	—	—	—	oracle / applications framework	Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Web Utilities).	80d ago
CVE-2026-62516	8.8	—	—	—	oracle / demantra demand management	Vulnerability in the Oracle Demantra Demand Management product of Oracle Supply Chain (component: Product Security	80d ago
CVE-2026-62498	8.8	—	—	—	oracle / flow manufacturing	Vulnerability in the Oracle Flow Manufacturing product of Oracle E-Business Suite (component: Internal Operations)	80d ago
CVE-2026-62496	8.8	—	—	—	oracle / yard management	Vulnerability in the Oracle Yard Management product of Oracle E-Business Suite (component: Internal Operations).	80d ago
CVE-2026-62478	8.8	—	—	—	oracle / public sector financials	Vulnerability in the Oracle Public Sector Financials product of Oracle E-Business Suite (component: Internal Opera	80d ago
CVE-2026-62476	8.8	—	—	—	oracle / public sector payroll	Vulnerability in the Oracle Public Sector Payroll product of Oracle E-Business Suite (component: Internal Operatio	80d ago
CVE-2026-62464	8.8	—	—	—	oracle / payroll	Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations).	80d ago
CVE-2026-62447	8.8	—	—	—	oracle / trade management	Vulnerability in the Oracle Trade Management product of Oracle E-Business Suite (component: Claim LOV).	80d ago
CVE-2026-61322	8.8	—	—	—	oracle / telesales	Vulnerability in the TeleSales product of Oracle E-Business Suite (component: Internal Operations).	80d ago
CVE-2026-61320	8.8	—	—	—	oracle / e-business suite	Vulnerability in the Oracle Payables product of Oracle E-Business Suite (component: Internal Operations).	80d ago
CVE-2026-61311	8.8	—	—	—	oracle / product hub	Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations).	80d ago
CVE-2026-61289	8.8	—	—	—	oracle / process manufacturing product development	Vulnerability in the Oracle Process Manufacturing Product Development product of Oracle E-Business Suite (componen	80d ago
CVE-2026-61243	8.8	—	—	—	oracle / peoplesoft enterprise fin common objects	Vulnerability in the PeopleSoft Enterprise FIN Common Objects Argentina product of Oracle PeopleSoft (component: S	80d ago
CVE-2026-61180	8.8	—	—	—	oracle / agile product lifecycle management for process	Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (compone	80d ago
CVE-2026-61179	8.8	—	—	—	oracle / agile product lifecycle management for process	Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (compone	80d ago
CVE-2026-61168	8.8	—	—	—	oracle / agile product lifecycle management	Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Security).	80d ago
CVE-2026-61166	8.8	—	—	—	oracle / agile product lifecycle management	Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: User and User Group).	80d ago
CVE-2026-61149	8.8	—	—	—	oracle / commerce experience manager	Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce	80d ago
CVE-2026-61148	8.8	—	—	—	oracle / commerce experience manager	Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce	80d ago
CVE-2026-61127	8.8	—	—	—	oracle / communications service catalog and design	Vulnerability in the Oracle Communications Service Catalog and Design product of Oracle Communications (component:	80d ago
CVE-2026-61121	8.8	—	—	—	oracle / human resources management system	Vulnerability in the Oracle HRMS (UK) product of Oracle E-Business Suite (component: UK Payroll).	80d ago
CVE-2026-61110	8.8	—	—	—	oracle / applications dba	Vulnerability in the Oracle Applications DBA product of Oracle E-Business Suite (component: ADPatch).	80d ago
CVE-2026-61099	8.8	—	—	—	oracle / webcenter enterprise capture	Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bu	80d ago
CVE-2026-61098	8.8	—	—	—	oracle / webcenter enterprise capture	Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bu	80d ago
CVE-2026-61063	8.8	—	—	—	oracle / peoplesoft enterprise scm supplier contract management	Vulnerability in the PeopleSoft Enterprise SCM Supplier Contract Management product of Oracle PeopleSoft (componen	80d ago
CVE-2026-61062	8.8	—	—	—	oracle / peoplesoft enterprise fin cash management	Vulnerability in the PeopleSoft Enterprise FIN Cash Management product of Oracle PeopleSoft (component: Cash Manag	80d ago
CVE-2026-61010	8.8	—	—	—	oracle / process manufacturing systems	Vulnerability in the Oracle Process Manufacturing Systems product of Oracle E-Business Suite (component: Internal	80d ago
CVE-2026-60989	8.8	—	—	—	oracle / advanced collections	Vulnerability in the Oracle Advanced Collections product of Oracle E-Business Suite (component: Internal Operation	80d ago

Sources: NIST National Vulnerability Database (descriptions, CVSS, CPE); CISA KEV, ENISA EUVD, CIRCL and VulnCheck (exploitation status, three catalogues counted; CIRCL shown as an aggregator); FIRST EPSS (exploitation probability). Patch window is the gap between CVE publication and the earliest KEV listing, so a negative value means a catalogue called it exploited before it was disclosed. Data refreshes every five hours.

Loading

CVE Tracker