CVE Tracker: vulnerabilities by vendor, severity and exploitation status

CVE Tracker

6 records

Every published CVE from the last 120 days with CVSS score, vendor and product, cross-referenced against CISA's Known Exploited Vulnerabilities catalog. 7 added to KEV in the last 7 days.

SeverityAll critical high medium lowExploitedIn CISA KEV

CVE	CVSS	EPSS	KEV sources	Patch window	Vendor / product	Summary	Published
CVE-2026-43622	7.8	—	—	—	ggml / llama.cpp	llama.cpp builds b1886 through b7445 contain a double free vulnerability in the LLaMA-Android JNI wrapper where ne	68d ago
CVE-2026-33298	7.8	—	—	—	ggml / llama.cpp	llama.cpp is an inference of several LLM models in C/C++.	203d ago
CVE-2026-27940	7.8	—	—	—	ggml / llama.cpp	llama.cpp is an inference of several LLM models in C/C++.	215d ago
CVE-2026-52132	7.5	—	—	—	ggml / llama.cpp	llama.cpp through commit 97f06e9, when started with the --reranking flag, allows remote attackers to cause a denia	42d ago
CVE-2026-52131	7.5	—	—	—	ggml / llama.cpp	llama.cpp b5693 and before has a Reachable Assertion via the gguf_reader::read function.	42d ago
CVE-2026-52130	7.5	—	—	—	ggml / llama.cpp	llama.cpp b5693 and before is vulnerable to Uncontrolled Recursion in common/json-schema-to-grammar.cpp, resulting	42d ago

Sources: NIST National Vulnerability Database (descriptions, CVSS, CPE); CISA KEV, ENISA EUVD, CIRCL and VulnCheck (exploitation status, three catalogues counted; CIRCL shown as an aggregator); FIRST EPSS (exploitation probability). Patch window is the gap between CVE publication and the earliest KEV listing, so a negative value means a catalogue called it exploited before it was disclosed. Data refreshes every five hours.

Loading

CVE Tracker