RewindexCVEs
CVEs
923 matching vulnerabilities, 615 of them in CISA’s Known Exploited Vulnerabilities catalog, newest first.
CVEs mapped to a company Rewindex tracks (by CVE affected-product data, NVD CPE, vendor advisories and package feeds), every entry in CISA’s Known Exploited Vulnerabilities catalog, and CVEs named in a tracked status incident. Other CVEs are not listed.
Dates are the CVE publish date (or the KEV date added). Times are shown in UTC.
Each column is one week (Monday start, UTC), stacked by CVSS severity, by published date or the KEV date added. Dots mark entries added to CISA KEV that week. The last week is still in progress.
CVE-2026-48558 SimpleHelp Authentication Bypass via Missing OIDC JWT Signature Verification
CVSS 10.0 criticalKEV added EPSS 77.7%
CVE-2026-50548 Cursor Desktop sandbox escape via agent-controlled working directory
CVSS 9.8 criticalEPSS 1.0%Cursor
CVE-2026-50549 Cursor Desktop sandbox escape via symlink and failed path canonicalization
CVSS 9.8 criticalEPSS 1.0%Cursor
CVE-2026-12569 Remote Code Execution (RCE) vulnerability in Windchill PDMlink
CVSS 9.8 criticalKEV added EPSS 46.0%
CVE-2026-34910 Ubiquiti UniFi OS Improper Input Validation Vulnerability
CVSS 10.0 criticalKEV added EPSS 90.0%
CVE-2026-34909 Ubiquiti UniFi OS Path Traversal Vulnerability
CVSS 10.0 criticalKEV added EPSS 68.0%
CVE-2026-34908 Ubiquiti UniFi OS Improper Access Control Vulnerability
CVSS 10.0 criticalKEV added EPSS 88.3%
CVE-2025-67038 Lantronix EDS5000, G520, and X300 OS Command Injection
CVSS 9.8 criticalKEV added EPSS 20.3%
CVE-2026-28381 Local File Read/Write to Potential Privilege Escalation via Snowflake GET/PUT
CVSS 9.6 criticalEPSS 0.35%Grafana Cloud
CVE-2026-5366 Git Argument Injection in prefecthq/prefect
CVSS 9.9 criticalEPSS 1.0%Prefect
CVE-2026-48584 Microsoft Azure Synapse Elevation of Privilege Vulnerability
CVSS 9.9 criticalEPSS 0.91%Microsoft Azure
CVE-2026-45480 Azure Active Directory Elevation of Privilege Vulnerability
CVSS 10.0 criticalEPSS 0.90%Microsoft Azure
CVE-2026-20253 Unauthenticated Arbitrary File Creation and Truncation in a PostgreSQL Sidecar Service Endpoint in Splunk Enterprise
CVSS 9.8 criticalKEV added EPSS 96.9%Splunk
CVE-2026-20266 OS Command Injection in the btool Configuration Helper in Splunk AI Toolkit
CVSS 9.1 criticalEPSS 0.63%Splunk
CVE-2026-48907 Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5
CVSS 9.8 criticalKEV added EPSS 85.4%
CVE-2026-35273 Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability
CVSS 9.8 criticalKEV added EPSS 96.7%
CVE-2026-4764 Privilege Escalation in Dialogflow CX via Playbook Import
CVSS 9.4 criticalEPSS 0.21%Google Cloud
CVE-2026-10520 Ivanti Sentry OS Command Injection Vulnerability
CVSS 10.0 criticalKEV added EPSS 99.9%
CVE-2026-47643 Azure Stack Edge Remote Code Execution Vulnerability
CVSS 9.8 criticalEPSS 0.75%Microsoft Azure
CVE-2026-50751 User Authentication Bypass in VPN Remote Access and Mobile Access
CVSS 9.3 criticalKEV added EPSS 85.3%
CVE-2026-48567 Azure HorizonDB Elevation of Privilege Vulnerability
CVSS 10.0 criticalEPSS 1.0%Microsoft Azure
CVE-2026-45247 Mirasvit Cache Warmer for Magento < 1.11.12 PHP Object Injection
CVSS 9.8 criticalKEV added EPSS 26.2%
CVE-2026-0257 PAN-OS: GlobalProtect Authentication Bypass Vulnerabilities
CVSS 9.1 criticalKEV added EPSS 95.0%
CVE-2026-48027 Compromised Nx Console version 18.95.0
CVSS 9.8 criticalKEV added EPSS 1.9%
CVE-2026-8398 Daemon Tools Lite Embedded Malicious Code Vulnerability
CVSS 9.8 criticalKEV added EPSS 1.5%
CVE-2026-45321 Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys
CVSS 9.6 criticalKEV added EPSS 3.3%
CVE-2026-48172 LiteSpeed cPanel Plugin Privilege Escalation Vulnerability
CVSS 9.8 criticalKEV added EPSS 17.9%
CVE-2026-47280 Azure Resource Manager Elevation of Privilege Vulnerability
CVSS 10.0 criticalEPSS 0.49%Microsoft Azure
CVE-2026-40411 Azure Virtual Network Gateway Remote Code Execution Vulnerability
CVSS 9.9 criticalEPSS 0.52%Microsoft Azure
CVE-2026-40412 Azure Orbital Spatio Remote Code Execution Vulnerability
CVSS 10.0 criticalEPSS 0.53%Microsoft Azure
CVE-2026-9082 Drupal core - Highly critical - SQL injection - SA-CORE-2026-004
CVSS 9.8 criticalKEV added EPSS 89.4%
CVE-2008-4250 Microsoft Windows Buffer Overflow Vulnerability
CVSS 9.8 criticalKEV added EPSS 98.8%
CVE-2026-8838 Remote Code Execution via eval() Injection in amazon-redshift-python-driver
CVSS 9.8 criticalEPSS 0.81%Amazon Web Services
CVE-2026-42822 Azure Local Disconnected Operations (ALDO) Elevation of Privilege Vulnerability
CVSS 10.0 criticalEPSS 0.49%Microsoft Azure
CVSS 10.0 criticalEPSS 15.1%Chroma
CVE-2026-45772 Turborepo: Unexpected local code execution during Yarn Berry detection
CVSS 9.8 criticalEPSS 0.39%Vercel
CVE-2026-20182 Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability
CVSS 10.0 criticalKEV added EPSS 91.8%
CVE-2026-44484 Compromise of PyTorch Lightning PyPi Package Versions
CVSS 9.8 criticalEPSS 0.39%Lightning AI
CVE-2026-42823 Azure Logic Apps Elevation of Privilege Vulnerability
CVSS 9.9 criticalEPSS 0.60%Microsoft Azure
CVE-2026-33117 Azure SDK for Java Security Feature Bypass Vulnerability
CVSS 9.1 criticalEPSS 0.48%Microsoft Azure
CVE-2026-43515 Apache Tomcat: Security constraints not correctly applied
CVSS 9.1 criticalEPSS 1.2%ConfluenceJira
CVE-2026-43512 Apache Tomcat: Digest authenticator will authenticate any unknown user
CVSS 9.8 criticalEPSS 1.3%ConfluenceJira
CVE-2026-41293 Apache Tomcat: HTTP/2 request headers not validated
CVSS 9.8 criticalEPSS 1.7%ConfluenceJira
CVE-2026-7428 Insecure default administrative credentials in AlloyDB for PostgreSQL
CVSS 9.2 criticalEPSS 0.24%Google Cloud
- CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (opens in new tab)
- This product uses data from the NVD API but is not endorsed or certified by the NVD. (opens in new tab)
- Known Exploited Vulnerabilities catalog from CISA. (opens in new tab)
- EPSS scores from FIRST (Exploit Prediction Scoring System). (opens in new tab)