RewindexCVEs
CVEs
5,605 vulnerabilities, 1,756 of them in CISA’s Known Exploited Vulnerabilities catalog, newest first.
CVEs mapped to a company Rewindex tracks (by CVE affected-product data, NVD CPE, vendor advisories and package feeds), every entry in CISA’s Known Exploited Vulnerabilities catalog, and CVEs named in a tracked status incident. Other CVEs are not listed.
Dates are the CVE publish date (or the KEV date added). Times are shown in UTC.
Each column is one week (Monday start, UTC), stacked by CVSS severity, by published date or the KEV date added. Dots mark entries added to CISA KEV that week. The last week is still in progress.
CVE-2026-9586 Unauthenticated SQL Injection Leading to Remote Code Execution in Switchvox SMB
CVSS 9.8 criticalKEV added EPSS 19.0%
CVE-2026-83549 SonicWall SMA1000 Appliances OS Command Injection Vulnerability
CVSS 7.8 highKEV added EPSS 9.9%
CVE-2026-83548 SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability
CVSS 10.0 criticalKEV added EPSS 8.0%
CVE-2026-82329 Potential authentication bypass leading to administrative access in Artifactory
CVSS 9.8 criticalKEV added EPSS 14.4%JFrog
CVE-2026-59822 LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback
CVSS 8.2 highKEV added EPSS 0.84%
CVE-2026-49869 Kestra: Unauthenticated Remote Code Execution via Authentication Bypass in `AuthenticationFilter`
CVSS 10.0 criticalKEV added EPSS 2.1%
CVE-2026-48710 Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks
CVSS 6.5 mediumKEV added EPSS 70.3%
CVE-2026-84375 js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources
CVSS 7.5 highEPSS 0.54%Jira
CVE-2026-75604 Next.js: Unauthenticated Remote Code Execution on windows-hosted servers
CVSS 9.0 criticalEPSS 2.1%Vercel
CVE-2026-78607 Missing Authorization in Elasticsearch Leading to Information Disclosure
CVSS 5.4 mediumEPSS 0.33%Elastic Cloud
CVE-2026-78608 Missing Authorization in Kibana Leading to Information Disclosure
CVSS 6.5 mediumEPSS 0.38%Elastic Cloud
CVE-2026-72644 Uncaught Exception in Kibana Leading to Denial of Service
CVSS 6.5 mediumEPSS 0.42%Elastic Cloud
CVE-2026-63137 Incorrect Authorization in Kibana Leading to Privilege Escalation
CVSS 8.3 highEPSS 0.50%Elastic Cloud
CVSS 7.3 highEPSS 0.16%OpenAI
CVSS 9.8 criticalEPSS 0.52%OpenAI
CVSS 8.8 highEPSS 0.56%OpenAI
CVSS 7.3 highEPSS 0.15%OpenAI
CVE-2026-19410 Google Cloud Build Comment Control Bypass via Webhook Suppression
CVSS 9.4 criticalEPSS 0.20%Google Cloud
- CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (opens in new tab)
- This product uses data from the NVD API but is not endorsed or certified by the NVD. (opens in new tab)
- Known Exploited Vulnerabilities catalog from CISA. (opens in new tab)
- EPSS scores from FIRST (Exploit Prediction Scoring System). (opens in new tab)