CVE Tracker: vulnerabilities by vendor, severity and exploitation status

CVE Tracker

15,513 records

Every published CVE from the last 120 days with CVSS score, vendor and product, cross-referenced against CISA's Known Exploited Vulnerabilities catalog. 8 added to KEV in the last 7 days.

SeverityAll critical high medium lowExploitedIn CISA KEV

CVE	CVSS	EPSS	KEV sources	Patch window	Vendor / product	Summary	Published
CVE-2025-69113	8.1	—	—	—	—	Unauthenticated Local File Inclusion in Nexio <= 1.10.0 versions.	133d ago
CVE-2025-69112	8.1	—	—	—	—	Unauthenticated Local File Inclusion in Planty <= 1.14.0 versions.	133d ago
CVE-2025-69110	8.1	—	—	—	—	Unauthenticated Local File Inclusion in AirSupply <= 2.0.0 versions.	133d ago
CVE-2025-69109	8.1	—	—	—	—	Unauthenticated Local File Inclusion in Raider Spirit <= 1.1.2 versions.	133d ago
CVE-2025-69107	8.1	—	—	—	—	Unauthenticated Local File Inclusion in Rosaleen <= 2.8 versions.	133d ago
CVE-2025-69105	8.1	—	—	—	—	Unauthenticated Local File Inclusion in Modernee <= 1.6.0 versions.	133d ago
CVE-2025-60085	8.1	—	—	—	—	Unauthenticated Local File Inclusion in Learnify <= 1.15.0 versions.	133d ago
CVE-2025-58954	8.1	—	—	—	—	Unauthenticated Local File Inclusion in HomeRoofer <= 2.11.0 versions.	133d ago
CVE-2025-58953	8.1	—	—	—	—	Unauthenticated Local File Inclusion in Joly <= 1.22.0 versions.	133d ago
CVE-2025-58952	8.1	—	—	—	—	Unauthenticated Local File Inclusion in Neuronet < 1.14.0 versions.	133d ago
CVE-2025-58924	8.1	—	—	—	—	Unauthenticated Local File Inclusion in Geya <= 1.15 versions.	133d ago
CVE-2026-46939	8.1	—	—	—	oracle / e-business suite	Vulnerability in the Oracle Configure to Order product of Oracle E-Business Suite (component: Supply to Order Work	133d ago
CVE-2026-46927	8.1	—	—	—	oracle / receivables	Vulnerability in the Oracle Receivables product of Oracle E-Business Suite (component: Internal Operations).	133d ago
CVE-2026-46920	8.1	—	—	—	oracle / siebel crm	Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager).	133d ago
CVE-2026-46898	8.1	—	—	—	oracle / enterprise command center framework	Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite (component: Cor	133d ago
CVE-2026-46891	8.1	—	—	—	oracle / jd edwards enterpriseone accounts payable	Vulnerability in the JD Edwards EnterpriseOne Accounts Payable product of Oracle JD Edwards (component: Accounts P	133d ago
CVE-2026-46851	8.1	—	—	—	oracle / peoplesoft enterprise campus software campus community	Vulnerability in the PeopleSoft Enterprise CS Campus Community product of Oracle PeopleSoft (component: Security).	133d ago
CVE-2026-46849	8.1	—	—	—	oracle / peoplesoft enterprise cs student financials	Vulnerability in the PeopleSoft Enterprise CS Student Financials product of Oracle PeopleSoft (component: Other).	133d ago
CVE-2026-35289	8.1	—	—	—	oracle / peoplesoft enterprise pt peopletools	Vulnerability in the PeopleSoft Enterprise PT PeopleTools product of Oracle PeopleSoft (component: Deployment Pack	133d ago
CVE-2026-35279	8.1	—	—	—	oracle / peoplesoft enterprise pt peopletools	Vulnerability in the PeopleSoft Enterprise PT PeopleTools product of Oracle PeopleSoft (component: Performance Mon	133d ago
CVE-2026-35276	8.1	—	—	—	oracle / peoplesoft enterprise pt peopletools	Vulnerability in the PeopleSoft Enterprise PT PeopleTools product of Oracle PeopleSoft (component: Application Ser	133d ago
CVE-2026-53866	8.1	—	—	—	openclaw / openclaw	OpenClaw before 2026.5.12 contains an allowlist bypass vulnerability in shell inline-command parsing that allows a	134d ago
CVE-2026-53864	8.1	—	—	—	openclaw / openclaw	OpenClaw before 2026.5.26 contains an insufficient sanitization vulnerability in the host environment sanitizer th	134d ago
CVE-2026-53857	8.1	—	—	—	openclaw / openclaw	OpenClaw before 2026.5.3 contains a policy enforcement vulnerability where Zalo contacts with mutable display meta	134d ago
CVE-2026-53855	8.1	—	—	—	openclaw / openclaw	OpenClaw before 2026.4.2 contains an inline-eval bypass vulnerability allowing authenticated operators to weaken s	134d ago
CVE-2026-53849	8.1	—	—	—	openclaw / openclaw	OpenClaw before 2026.5.7 contains a privilege escalation vulnerability where the allowFrom feature improperly vali	134d ago
CVE-2026-12328	8.1	—	—	—	mozilla / firefox	Memory safety bugs present in Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird ESR 140.11, Firefox 151 and Thun	134d ago
CVE-2026-12327	8.1	—	—	—	mozilla / firefox	Memory safety bugs present in Firefox ESR 140.11, Thunderbird ESR 140.11, Firefox 151 and Thunderbird 151.	134d ago
CVE-2026-12326	8.1	—	—	—	mozilla / firefox	Memory safety bugs present in Firefox 151 and Thunderbird 151.	134d ago
CVE-2026-12292	8.1	—	—	—	mozilla / firefox	Incorrect boundary conditions in the Web Audio component.	134d ago
CVE-2026-12290	8.1	—	—	—	mozilla / firefox	Memory safety bug fixed in Firefox 152.	134d ago
CVE-2026-8442	8.1	—	—	—	—	The WP Review Slider Pro plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to and includ	134d ago
CVE-2026-48970	8.1	—	—	—	—	Unauthenticated Broken Authentication in Really Simple SSL <= 9.5.10 versions.	135d ago
CVE-2026-42687	8.1	—	—	—	—	Unauthenticated PHP Object Injection in EventPrime <= 4.3.2.1 versions.	135d ago
CVE-2026-42411	8.1	—	—	—	—	Unauthenticated Broken Authentication in CloudSecure WP Security <= 1.4.7 versions.	135d ago
CVE-2026-39587	8.1	—	—	—	—	Unauthenticated Privilege Escalation in WP BASE Booking <= 5.9.0 versions.	135d ago
CVE-2026-27333	8.1	—	—	—	—	Unauthenticated Deserialization of untrusted data in Paid Videochat Turnkey Site <= 7.3.23 versions.	135d ago
CVE-2026-50891	8.1	—	—	—	—	Incorrect access control in the /admin/api/config component of Filestash v0.4.0 allows attackers to escalate privi	135d ago
CVE-2026-50888	8.1	—	—	—	—	An authenticated Server-Side Request Forgery (SSRF) in the custom scraper subsystem component of Benjamin Jonard K	135d ago
CVE-2026-50881	8.1	—	—	—	—	Incorrect access control in the impworks Bonsai v6.0 allows authenticated attackers with Editor privileges to esca	135d ago
CVE-2026-50875	8.1	—	—	—	—	Incorrect access control in the /{form}/webhooks/{webhook} endpoint of Deck9 Input v2.0.1 allows authenticated att	135d ago
CVE-2026-50874	8.1	—	—	—	—	An OS command injection vulnerability in the /manage/features/media component of kanishka-linux Reminiscence v0.3.	135d ago
CVE-2026-53823	8.1	—	—	—	openclaw / openclaw	OpenClaw before 2026.5.3 contains a privilege escalation vulnerability in the allowFrom feature that binds to muta	138d ago
CVE-2026-45013	8.1	—	—	—	—	ApostropheCMS is an open-source Node.js content management system.	138d ago
CVE-2026-53408	8.1	—	—	—	zoom / meeting software development kit	Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace before version 7.0.4 for Android and bef	138d ago
CVE-2026-53407	8.1	—	—	—	zoom / workplace	Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace before version 7.0.4 for Android and bef	138d ago
CVE-2026-50101	8.1	—	—	—	—	Naxclow devices use a server-side, per-device relay credential that never rotates and is re-issued to the device o	138d ago
CVE-2026-7368	8.1	—	—	—	—	The Yarbo cloud does not enforce per-device or per-user authorization.	138d ago
CVE-2026-50633	8.1	—	—	—	apache / cxf	A JNDI Injection vulnerability has been discovered in Apache CXF's JCA integration module, which can allow for cod	138d ago
CVE-2026-50632	8.1	—	—	—	apache / cxf	A further incomplete fix for a previous advisory CVE-2026-44417 (Untrusted JMS configuration can lead to RCE) for	138d ago
CVE-2026-11846	8.1	—	—	—	—	The iVEC-IEI Virtualization Edge Computer developed by IEI Integration Corp has an Arbitrary File Deletion vulnera	138d ago
CVE-2026-48610	8.1	—	—	—	—	Under certain network configurations, a malicious actor with access to network could exploit an Improper Access Co	139d ago
CVE-2026-6250	8.1	—	—	—	tp-link / tapo c110 firmware	An authenticated format string vulnerability exists in the ONVIF service of Tapo C110 v2 due to improper handling o	139d ago
CVE-2026-44249	8.1	—	—	—	netty / netty	Netty is a network application framework for development of protocol servers and clients.	139d ago
CVE-2026-12012	8.1	—	—	—	google / chrome	Use after free in Network in Google Chrome prior to 149.0.7827.115 allowed an attacker in a privileged network pos	139d ago
CVE-2026-46622	8.1	—	—	—	—	SolidInvoice is an open-source invoicing platform.	139d ago
CVE-2026-46489	8.1	—	—	—	—	SolidInvoice is an open-source invoicing platform.	139d ago
CVE-2026-45178	8.1	—	—	—	paloaltonetworks / idira secrets manager	Idira Secrets Manager Self-Hosted versions 13.8.0 and lower exhibit improper access control within internal cluste	139d ago
CVE-2026-53777	8.1	—	—	—	—	Perry before 0.5.1159 contains a path traversal vulnerability that allows a malicious build server to write arbitr	139d ago
CVE-2026-11816	8.1	—	—	—	keras / keras	Keras versions prior to 3.14.0 are vulnerable to a path traversal issue in the archive extraction utilities locate	139d ago

Sources: NIST National Vulnerability Database (descriptions, CVSS, CPE); CISA KEV, ENISA EUVD, CIRCL and VulnCheck (exploitation status, three catalogues counted; CIRCL shown as an aggregator); FIRST EPSS (exploitation probability). Patch window is the gap between CVE publication and the earliest KEV listing, so a negative value means a catalogue called it exploited before it was disclosed. Data refreshes every five hours.

Loading

CVE Tracker