CVE Tracker
5 recordsEvery published CVE from the last 120 days with CVSS score, vendor and product, cross-referenced against CISA's Known Exploited Vulnerabilities catalog. 6 added to KEV in the last 7 days.
| CVE | CVSS | EPSS | KEV sources | Patch window | Vendor / product | Summary | Published |
|---|
| CVE-2026-28256 | 9.8 | — | — | — | trane / tracer sc\+ firmware | A Use of Hard-coded, Security-relevant Constants vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierg | 224d ago |
| CVE-2026-28255 | 9.8 | — | — | — | trane / tracer sc firmware | A Use of Hard-coded Credentials vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge could allow an | 224d ago |
| CVE-2026-28252 | 9.8 | — | — | — | trane / tracer sc firmware | A Use of a Broken or Risky Cryptographic Algorithm vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concie | 224d ago |
| CVE-2026-28254 | 7.5 | — | — | — | trane / tracer sc firmware | A Missing Authorization vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge could allow an unauthen | 224d ago |
| CVE-2026-28253 | 7.5 | — | — | — | trane / tracer sc firmware | A Memory Allocation with Excessive Size Value vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge c | 224d ago |
Sources: NIST National Vulnerability Database (descriptions, CVSS, CPE); CISA KEV, ENISA EUVD, CIRCL and VulnCheck (exploitation status, three catalogues counted; CIRCL shown as an aggregator); FIRST EPSS (exploitation probability). Patch window is the gap between CVE publication and the earliest KEV listing, so a negative value means a catalogue called it exploited before it was disclosed. Data refreshes every five hours.
