RewindexCVEs
CVEs
923 matching vulnerabilities, 615 of them in CISA’s Known Exploited Vulnerabilities catalog, newest first.
CVEs mapped to a company Rewindex tracks (by CVE affected-product data, NVD CPE, vendor advisories and package feeds), every entry in CISA’s Known Exploited Vulnerabilities catalog, and CVEs named in a tracked status incident. Other CVEs are not listed.
Dates are the CVE publish date (or the KEV date added). Times are shown in UTC.
Each column is one week (Monday start, UTC), stacked by CVSS severity, by published date or the KEV date added. Dots mark entries added to CISA KEV that week. The last week is still in progress.
CVE-2026-42354 Sentry: Improper authentication on SAML SSO process allows user identity linking
CVSS 9.1 criticalEPSS 0.62%Sentry
CVE-2026-41574 Nhost Vulnerable to Account Takeover via OAuth Email Verification Bypass
CVSS 9.8 criticalEPSS 0.80%Nhost
CVE-2026-42208 LiteLLM: SQL injection in Proxy API key verification
CVSS 9.8 criticalKEV added EPSS 89.4%
CVE-2026-42826 Azure DevOps Information Disclosure Vulnerability
CVSS 10.0 criticalEPSS 0.84%Microsoft Azure
CVE-2026-35428 Azure Cloud Shell Spoofing Vulnerability
CVSS 9.6 criticalEPSS 0.93%Microsoft Azure
CVE-2026-33844 Azure Managed Instance for Apache Cassandra Remote Code Execution Vulnerability
CVSS 9.0 criticalEPSS 0.99%Microsoft Azure
CVE-2026-33823 Microsoft Team Events Portal Information Disclosure Vulnerability
CVSS 9.6 criticalEPSS 0.72%Microsoft Teams
CVE-2026-33109 Azure Managed Instance for Apache Cassandra Remote Code Execution Vulnerability
CVSS 9.9 criticalEPSS 0.71%Microsoft Azure
CVE-2026-0300 PAN-OS: Unauthenticated user initiated Buffer Overflow Vulnerability in User-ID™ Authentication Portal
CVSS 9.8 criticalKEV added EPSS 41.7%
CVSS 9.8 criticalEPSS 0.31%Bitwarden
CVE-2026-41940 WebPros cPanel and WHM Authentication Bypass via Login Flow
CVSS 9.8 criticalKEV added EPSS 98.5%
CVE-2026-41248 Official Clerk JavaScript SDKs: Middleware-based route protection bypass
CVSS 9.1 criticalEPSS 0.32%Clerk
CVE-2026-6911 Authentication Bypass via Missing JWT Signature Verification in AWS Ops Wheel
CVSS 9.8 criticalEPSS 0.25%Amazon Web Services
CVE-2026-21515 Azure IoT Central Elevation of Privilege Vulnerability
CVSS 9.9 criticalEPSS 0.70%Microsoft Azure
CVE-2024-57726 SimpleHelp Missing Authorization Vulnerability
CVSS 9.9 criticalKEV added EPSS 66.4%
CVE-2026-25874 LeRobot Unsafe Deserialization Remote Code Execution via gRPC
CVSS 9.8 criticalEPSS 15.5%Hugging Face
CVE-2026-39987 marimo Affected by Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass
CVSS 9.8 criticalKEV added EPSS 99.6%
CVE-2026-40050 CrowdStrike LogScale Unauthenticated Path Traversal
CVSS 9.8 criticalEPSS 0.60%CrowdStrike
CVE-2025-32975 Quest KACE Systems Management Appliance (SMA) Improper Authentication Vulnerability
CVSS 10.0 criticalKEV added EPSS 2.5%
CVSS 9.3 criticalEPSS 0.21%Cohere
CVE-2026-4810 Remote Code Execution in Google Agent Development Kit (ADK)
CVSS 9.3 criticalEPSS 1.8%Google Cloud
CVE-2026-21643 Fortinet FortiClient EMS SQL Injection Vulnerability
CVSS 9.1 criticalKEV added EPSS 97.7%
CVE-2026-1340 Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability
CVSS 9.8 criticalKEV added EPSS 98.6%
CVE-2026-39382 dbt has a Command Injection in Reusable Workflow via Unsanitized comment-body Output
CVSS 9.3 criticalEPSS 0.42%dbt Labs
CVE-2026-35616 Fortinet FortiClient EMS Improper Access Control Vulnerability
CVSS 9.1 criticalKEV added EPSS 94.0%
CVE-2026-32211 Azure MCP Server Information Disclosure Vulnerability
CVSS 9.1 criticalEPSS 0.83%Microsoft Azure
CVE-2026-33105 Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability
CVSS 10.0 criticalEPSS 0.72%Microsoft Azure
CVE-2026-26135 Azure Custom Locations Resource Provider (RP) Elevation of Privilege Vulnerability
CVSS 9.6 criticalEPSS 0.60%Microsoft Azure
CVE-2026-33107 Azure Databricks Elevation of Privilege Vulnerability
CVSS 10.0 criticalEPSS 0.71%Microsoft Azure
CVE-2026-32213 Azure AI Foundry Elevation of Privilege Vulnerability
CVSS 10.0 criticalEPSS 0.91%Microsoft Azure
CVE-2026-33990 Docker Model Runner OCI Registry Client Vulnerable to Server-Side Request Forgery (SSRF)
CVSS 9.1 criticalEPSS 0.25%Docker
CVE-2026-34060 Ruby LSP has arbitrary code execution through branch setting
CVSS 9.8 criticalEPSS 0.48%Shopify
CVE-2026-3055 Insufficient input validation leading to memory overread
CVSS 9.8 criticalKEV added EPSS 91.5%
CVE-2026-33937 Handlebars.js has JavaScript Injection via AST Type Confusion
CVSS 9.8 critical1 incident
CVE-2026-27876 RCE on Grafana via sqlExpressions
CVSS 9.1 criticalEPSS 2.0%Grafana Cloud
CVE-2025-53521 BigIP APM Vulnerability
CVSS 9.8 criticalKEV added EPSS 2.3%
CVE-2026-33017 Langflow has Unauthenticated Remote Code Execution via Public Flow Build Endpoint
CVSS 9.8 criticalKEV added EPSS 96.2%
CVSS 9.4 criticalEPSS 0.43%Salesforce
CVE-2025-54068 Livewire vulnerable to remote command execution during property update hydration
CVSS 9.8 criticalKEV added EPSS 96.3%
CVE-2025-32432 Craft CMS Allows Remote Code Execution
CVSS 10.0 criticalKEV added EPSS 99.8%
CVE-2026-22732 Under Some Conditions Spring Security HTTP Headers Are not Written
CVSS 9.1 criticalEPSS 0.49%Jira
CVE-2026-32169 Azure Cloud Shell Elevation of Privilege Vulnerability
CVSS 10.0 criticalEPSS 0.57%Microsoft Azure
CVE-2026-20131 Cisco Secure Firewall Management Center Software Remote Code Execution Vulnerability
CVSS 10.0 criticalKEV added EPSS 43.2%
CVE-2026-20963 Microsoft SharePoint Remote Code Execution Vulnerability
CVSS 9.8 criticalKEV added EPSS 29.2%
CVE-2026-32621 Apollo Federation has prototype pollution via incomplete key sanitization
CVSS 9.9 criticalEPSS 0.53%Apollo GraphQL
- CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (opens in new tab)
- This product uses data from the NVD API but is not endorsed or certified by the NVD. (opens in new tab)
- Known Exploited Vulnerabilities catalog from CISA. (opens in new tab)
- EPSS scores from FIRST (Exploit Prediction Scoring System). (opens in new tab)