RewindexCVEs
CVEs
923 matching vulnerabilities, 615 of them in CISA’s Known Exploited Vulnerabilities catalog, newest first.
CVEs mapped to a company Rewindex tracks (by CVE affected-product data, NVD CPE, vendor advisories and package feeds), every entry in CISA’s Known Exploited Vulnerabilities catalog, and CVEs named in a tracked status incident. Other CVEs are not listed.
Dates are the CVE publish date (or the KEV date added). Times are shown in UTC.
Each column is one week (Monday start, UTC), stacked by CVSS severity, by published date or the KEV date added. Dots mark entries added to CISA KEV that week. The last week is still in progress.
CVE-2026-50481 Azure Active Directory Elevation of Privilege Vulnerability
CVSS 9.9 criticalEPSS 0.82%Microsoft Azure
CVE-2026-62896 Microsoft Teams Elevation of Privilege Vulnerability
CVSS 9.6 criticalEPSS 0.69%Microsoft Teams
CVE-2026-63077 JetBrains TeamCity Deserialization of Untrusted Data Vulnerability
CVSS 9.8 criticalKEV added EPSS 93.6%
CVE-2026-9198 Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation
CVSS 9.8 criticalKEV added EPSS 28.7%
CVE-2026-58062 Stapled OCSP response accepted without binding to the checked certificate
CVSS 9.1 criticalEPSS 0.36%ConfluenceJira
CVE-2026-59650 MTI/A0 DH agreement exponentiates unvalidated peer value
CVSS 9.1 criticalEPSS 0.34%ConfluenceJira
CVE-2026-8763 Name Constraints bypass via trailing dot in rfc822Name and URI
CVSS 9.1 criticalEPSS 0.43%ConfluenceJira
CVE-2026-66803 Azure Cosmos DB Remote Code Execution Vulnerability
CVSS 10.0 criticalEPSS 0.90%Microsoft Azure
CVE-2026-47876 VMXNET3 out-of-bounds write vulnerability
CVSS 9.3 criticalEPSS 0.19%Google Cloud
CVE-2026-59309 vCenter authentication-bypass vulnerability
CVSS 9.8 criticalEPSS 0.61%Google Cloud
CVE-2026-16812 VeloCloud Orchestrator OS Command Injection
CVSS 10.0 criticalKEV added EPSS 1.0%
CVE-2026-62835 Azure Portal Information Disclosure Vulnerability
CVSS 9.3 criticalEPSS 0.97%Microsoft Azure
CVE-2026-56163 Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability
CVSS 10.0 criticalEPSS 0.90%Microsoft Azure
CVE-2026-58630 Azure App Service on Azure Stack Hub Elevation of Privilege Vulnerability
CVSS 10.0 criticalEPSS 0.87%Microsoft Azure
CVE-2026-58275 Azure DNS Elevation of Privilege Vulnerability
CVSS 10.0 criticalEPSS 0.92%Microsoft Azure
CVE-2026-62825 Azure Key Vault Elevation of Privilege Vulnerability
CVSS 10.0 criticalEPSS 0.92%Microsoft Azure
CVE-2026-56160 Azure Red Hat OpenShift (ARO) Elevation of Privilege Vulnerability
CVSS 9.1 criticalEPSS 0.79%Microsoft Azure
CVE-2026-16232 Authentication Bypass in the SmartConsole Login Process Using an Application Token
CVSS 9.8 criticalKEV added EPSS 3.5%
CVE-2026-50522 Microsoft SharePoint Remote Code Execution Vulnerability
CVSS 9.8 criticalKEV added EPSS 3.0%
CVE-2026-63030 WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution
CVSS 9.8 criticalKEV added EPSS 10.6%WordPress.com
CVE-2026-0770 Langflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution Vulnerability
CVSS 9.8 criticalKEV added EPSS 62.6%
CVE-2026-53412 Zoom Workplace VDI Plugin for Windows - Improper Input Validation
CVSS 9.8 criticalEPSS 0.53%Zoom
CVE-2026-15925 Improper TLS Hostname Verification in Snowflake Connector for Python
CVSS 9.2 criticalEPSS 0.18%Snowflake
CVE-2026-58644 Microsoft SharePoint Remote Code Execution Vulnerability
CVSS 9.8 criticalKEV added EPSS 15.9%
CVE-2026-39808 Fortinet FortiSandbox OS Command Injection Vulnerability
CVSS 9.1 criticalKEV added EPSS 93.2%
CVE-2026-25089 Fortinet FortiSandbox OS Command Injection Vulnerability
CVSS 9.1 criticalKEV added EPSS 76.1%
CVE-2026-50148 Metabase: Remote Code Execution via Snowflake JDBC Driver Arbitrary File Write
CVSS 10.0 criticalEPSS 0.77%MetabaseMetabase Cloud
CVE-2026-46817 Oracle E-Business Suite Improper Privilege Management Vulnerability
CVSS 9.8 criticalKEV added EPSS 12.3%
CVE-2026-15409 SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability
CVSS 10.0 criticalKEV added EPSS 6.8%
CVE-2026-15183 Input Validation Vulnerabilities in Snowflake Spark Connector
CVSS 9.2 criticalEPSS 0.31%Snowflake
CVE-2026-56291 Joomla Extension - balbooa.com - Unauthenticated file upload in Balbooa Forms extension < 2.4.1
CVSS 9.8 criticalKEV added EPSS 14.9%
CVE-2026-48939 Joomla Extension - icagenda.com - Remote Code Execution in iCaganda extension for Joomla < 4.0.8/3.9.15
CVSS 9.8 criticalKEV added EPSS 20.1%
CVE-2026-59826 Metabase: Arbitrary Code Execution via Database Connection Detail Bypass
CVSS 9.1 criticalEPSS 1.0%MetabaseMetabase Cloud
CVE-2026-59827 Metabase: Unsafe Deserialization of H2 Query Results
CVSS 9.9 criticalEPSS 3.8%MetabaseMetabase Cloud
CVE-2026-15062 SQL Injection in Snowflake Snowpark Python SDK
CVSS 9.6 criticalEPSS 0.39%Snowflake
CVE-2026-56290 Joomla Extension - joomlack.fr - Unauthenticated file upload in Page Builder CK extension < 3.6.0
CVSS 9.8 criticalKEV added EPSS 30.9%
CVE-2026-48908 Joomla Extension - joomshaper.com - Remote Code Execution in SP Pagebuilder extension for Joomla < 6.6.2
CVSS 9.8 criticalKEV added EPSS 88.5%
CVE-2026-48282 ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
CVSS 10.0 criticalKEV added EPSS 42.4%
CVE-2026-45499 Azure OpenAI Elevation of Privilege Vulnerability
CVSS 9.9 criticalEPSS 0.78%Microsoft Azure
CVE-2026-53492 containerd CRI checkpoint restore CDI annotation smuggling
CVSS 9.6 criticalEPSS 0.35%Google Cloud
CVE-2026-50195 containerd: CRI checkpoint import allows local image tag poisoning
CVSS 9.9 criticalEPSS 0.30%Google Cloud
CVE-2026-55276 Apache Tomcat: Logged effective web.xml is incomplete
CVSS 9.1 criticalEPSS 0.61%ConfluenceJira
CVE-2026-53434 Apache Tomcat: Invalid CRL configuration doesn't trigger failure for FFM Connector
CVSS 9.1 criticalEPSS 0.59%ConfluenceJira
- CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (opens in new tab)
- This product uses data from the NVD API but is not endorsed or certified by the NVD. (opens in new tab)
- Known Exploited Vulnerabilities catalog from CISA. (opens in new tab)
- EPSS scores from FIRST (Exploit Prediction Scoring System). (opens in new tab)