RewindexCVEs
CVEs
615 matching vulnerabilities, 615 of them in CISA’s Known Exploited Vulnerabilities catalog, newest first.
CVEs mapped to a company Rewindex tracks (by CVE affected-product data, NVD CPE, vendor advisories and package feeds), every entry in CISA’s Known Exploited Vulnerabilities catalog, and CVEs named in a tracked status incident. Other CVEs are not listed.
Dates are the CVE publish date (or the KEV date added). Times are shown in UTC.
Each column is one week (Monday start, UTC), stacked by CVSS severity, by published date or the KEV date added. Dots mark entries added to CISA KEV that week. The last week is still in progress.
CVE-2026-50522 Microsoft SharePoint Remote Code Execution Vulnerability
CVSS 9.8 criticalKEV added EPSS 3.0%
CVE-2026-63030 WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution
CVSS 9.8 criticalKEV added EPSS 10.6%WordPress.com
CVE-2026-0770 Langflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution Vulnerability
CVSS 9.8 criticalKEV added EPSS 62.6%
CVE-2026-58644 Microsoft SharePoint Remote Code Execution Vulnerability
CVSS 9.8 criticalKEV added EPSS 15.9%
CVE-2026-39808 Fortinet FortiSandbox OS Command Injection Vulnerability
CVSS 9.1 criticalKEV added EPSS 93.2%
CVE-2026-25089 Fortinet FortiSandbox OS Command Injection Vulnerability
CVSS 9.1 criticalKEV added EPSS 76.1%
CVE-2026-46817 Oracle E-Business Suite Improper Privilege Management Vulnerability
CVSS 9.8 criticalKEV added EPSS 12.3%
CVE-2026-15409 SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability
CVSS 10.0 criticalKEV added EPSS 6.8%
CVE-2026-56291 Joomla Extension - balbooa.com - Unauthenticated file upload in Balbooa Forms extension < 2.4.1
CVSS 9.8 criticalKEV added EPSS 14.9%
CVE-2026-48939 Joomla Extension - icagenda.com - Remote Code Execution in iCaganda extension for Joomla < 4.0.8/3.9.15
CVSS 9.8 criticalKEV added EPSS 20.1%
CVE-2026-56290 Joomla Extension - joomlack.fr - Unauthenticated file upload in Page Builder CK extension < 3.6.0
CVSS 9.8 criticalKEV added EPSS 30.9%
CVE-2026-48908 Joomla Extension - joomshaper.com - Remote Code Execution in SP Pagebuilder extension for Joomla < 6.6.2
CVSS 9.8 criticalKEV added EPSS 88.5%
CVE-2026-48282 ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
CVSS 10.0 criticalKEV added EPSS 42.4%
CVE-2026-48558 SimpleHelp Authentication Bypass via Missing OIDC JWT Signature Verification
CVSS 10.0 criticalKEV added EPSS 77.7%
CVE-2026-12569 Remote Code Execution (RCE) vulnerability in Windchill PDMlink
CVSS 9.8 criticalKEV added EPSS 46.0%
CVE-2026-34910 Ubiquiti UniFi OS Improper Input Validation Vulnerability
CVSS 10.0 criticalKEV added EPSS 90.0%
CVE-2026-34909 Ubiquiti UniFi OS Path Traversal Vulnerability
CVSS 10.0 criticalKEV added EPSS 68.0%
CVE-2026-34908 Ubiquiti UniFi OS Improper Access Control Vulnerability
CVSS 10.0 criticalKEV added EPSS 88.3%
CVE-2025-67038 Lantronix EDS5000, G520, and X300 OS Command Injection
CVSS 9.8 criticalKEV added EPSS 20.3%
CVE-2026-20253 Unauthenticated Arbitrary File Creation and Truncation in a PostgreSQL Sidecar Service Endpoint in Splunk Enterprise
CVSS 9.8 criticalKEV added EPSS 96.9%Splunk
CVE-2026-48907 Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5
CVSS 9.8 criticalKEV added EPSS 85.4%
CVE-2026-35273 Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability
CVSS 9.8 criticalKEV added EPSS 96.7%
CVE-2026-10520 Ivanti Sentry OS Command Injection Vulnerability
CVSS 10.0 criticalKEV added EPSS 99.9%
CVE-2026-50751 User Authentication Bypass in VPN Remote Access and Mobile Access
CVSS 9.3 criticalKEV added EPSS 85.3%
CVE-2026-45247 Mirasvit Cache Warmer for Magento < 1.11.12 PHP Object Injection
CVSS 9.8 criticalKEV added EPSS 26.2%
CVE-2026-0257 PAN-OS: GlobalProtect Authentication Bypass Vulnerabilities
CVSS 9.1 criticalKEV added EPSS 95.0%
CVE-2026-48027 Compromised Nx Console version 18.95.0
CVSS 9.8 criticalKEV added EPSS 1.9%
CVE-2026-8398 Daemon Tools Lite Embedded Malicious Code Vulnerability
CVSS 9.8 criticalKEV added EPSS 1.5%
CVE-2026-45321 Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys
CVSS 9.6 criticalKEV added EPSS 3.3%
CVE-2026-48172 LiteSpeed cPanel Plugin Privilege Escalation Vulnerability
CVSS 9.8 criticalKEV added EPSS 17.9%
CVE-2026-9082 Drupal core - Highly critical - SQL injection - SA-CORE-2026-004
CVSS 9.8 criticalKEV added EPSS 89.4%
CVE-2008-4250 Microsoft Windows Buffer Overflow Vulnerability
CVSS 9.8 criticalKEV added EPSS 98.8%
CVE-2026-20182 Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability
CVSS 10.0 criticalKEV added EPSS 91.8%
CVE-2026-42208 LiteLLM: SQL injection in Proxy API key verification
CVSS 9.8 criticalKEV added EPSS 89.4%
CVE-2026-0300 PAN-OS: Unauthenticated user initiated Buffer Overflow Vulnerability in User-ID™ Authentication Portal
CVSS 9.8 criticalKEV added EPSS 41.7%
CVE-2026-41940 WebPros cPanel and WHM Authentication Bypass via Login Flow
CVSS 9.8 criticalKEV added EPSS 98.5%
CVE-2024-57726 SimpleHelp Missing Authorization Vulnerability
CVSS 9.9 criticalKEV added EPSS 66.4%
CVE-2026-39987 marimo Affected by Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass
CVSS 9.8 criticalKEV added EPSS 99.6%
CVE-2025-32975 Quest KACE Systems Management Appliance (SMA) Improper Authentication Vulnerability
CVSS 10.0 criticalKEV added EPSS 2.5%
CVE-2026-21643 Fortinet FortiClient EMS SQL Injection Vulnerability
CVSS 9.1 criticalKEV added EPSS 97.7%
CVE-2026-1340 Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability
CVSS 9.8 criticalKEV added EPSS 98.6%
CVE-2026-35616 Fortinet FortiClient EMS Improper Access Control Vulnerability
CVSS 9.1 criticalKEV added EPSS 94.0%
CVE-2026-3055 Insufficient input validation leading to memory overread
CVSS 9.8 criticalKEV added EPSS 91.5%
CVE-2025-53521 BigIP APM Vulnerability
CVSS 9.8 criticalKEV added EPSS 2.3%
CVE-2026-33017 Langflow has Unauthenticated Remote Code Execution via Public Flow Build Endpoint
CVSS 9.8 criticalKEV added EPSS 96.2%
CVE-2025-54068 Livewire vulnerable to remote command execution during property update hydration
CVSS 9.8 criticalKEV added EPSS 96.3%
CVE-2025-32432 Craft CMS Allows Remote Code Execution
CVSS 10.0 criticalKEV added EPSS 99.8%
CVE-2026-20131 Cisco Secure Firewall Management Center Software Remote Code Execution Vulnerability
CVSS 10.0 criticalKEV added EPSS 43.2%
CVE-2026-20963 Microsoft SharePoint Remote Code Execution Vulnerability
CVSS 9.8 criticalKEV added EPSS 29.2%
CVE-2025-68613 n8n Vulnerable to Remote Code Execution via Expression Injection
CVSS 10.0 criticalKEV added EPSS 99.0%n8n
- CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (opens in new tab)
- This product uses data from the NVD API but is not endorsed or certified by the NVD. (opens in new tab)
- Known Exploited Vulnerabilities catalog from CISA. (opens in new tab)
- EPSS scores from FIRST (Exploit Prediction Scoring System). (opens in new tab)