CVE Tracker: vulnerabilities by vendor, severity and exploitation status

CVE Tracker

6 records

Every published CVE from the last 120 days with CVSS score, vendor and product, cross-referenced against CISA's Known Exploited Vulnerabilities catalog. 10 added to KEV in the last 7 days.

SeverityAll critical high medium lowExploitedIn CISA KEV

CVE	CVSS	EPSS	KEV sources	Patch window	Vendor / product	Summary	Published
CVE-2026-39822	7.8	—	—	—	golang / go	On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when th	59d ago
CVE-2026-78662	7.5	—	—	—	golang / crypto	Previously, a channel registered in the mux's chanList is not usable until it is established.	3d ago
CVE-2026-56855	7.5	—	—	—	golang / crypto	Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock	3d ago
CVE-2026-46604	7.5	—	—	—	golang / tiff	The TIFF decoder can panic when decoding an invalid image with an out-of-bounds strip offset.	71d ago
CVE-2026-46597	7.5	—	—	—	golang / crypto	An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-	107d ago
CVE-2026-39829	7.5	—	—	—	golang / crypto	The RSA and DSA public key parsers did not enforce size limits on key parameters.	107d ago

Sources: NIST National Vulnerability Database (descriptions, CVSS, CPE); CISA KEV, ENISA EUVD, CIRCL and VulnCheck (exploitation status, four independent catalogues); FIRST EPSS (exploitation probability). Patch window is the gap between CVE publication and the earliest KEV listing, so a negative value means a catalogue called it exploited before it was disclosed. Data refreshes every five hours.

Loading

CVE Tracker