RewindexCVEs
CVEs
5,605 vulnerabilities, 1,756 of them in CISA’s Known Exploited Vulnerabilities catalog, newest first.
CVEs mapped to a company Rewindex tracks (by CVE affected-product data, NVD CPE, vendor advisories and package feeds), every entry in CISA’s Known Exploited Vulnerabilities catalog, and CVEs named in a tracked status incident. Other CVEs are not listed.
Dates are the CVE publish date (or the KEV date added). Times are shown in UTC.
Each column is one week (Monday start, UTC), stacked by CVSS severity, by published date or the KEV date added. Dots mark entries added to CISA KEV that week. The last week is still in progress.
CVE-2026-76531 Files or Directories Accessible to External Parties in Splunk SOAR
CVSS 9.9 criticalEPSS 0.41%Splunk
CVE-2026-76530 Use of Non-Canonical URL Paths for Authorization Decisions in Splunk SOAR
CVSS 8.8 highEPSS 0.29%Splunk
CVE-2026-76529 Improper Protection of Alternate Path in Splunk SOAR
Not scoredEPSS 0.17%Splunk
CVE-2026-76528 Protection Mechanism Failure in Splunk SOAR
Not scoredEPSS 0.13%Splunk
CVE-2026-76526 Improper Neutralization in Splunk SOAR
Not scoredEPSS 0.17%Splunk
CVE-2026-76407 Improper Access Control in Splunk SOAR
Not scoredEPSS 0.13%Splunk
CVE-2026-76406 Information Disclosure through REST API Authentication in Splunk SOAR
CVSS 5.9 mediumEPSS 0.32%Splunk
CVE-2026-76308 Missing Authorization through the REST API in Splunk SOAR
CVSS 6.5 mediumEPSS 0.17%Splunk
CVE-2026-76306 Information Disclosure through REST API Query Filters in Splunk SOAR
CVSS 7.5 highEPSS 0.22%Splunk
CVE-2026-76305 Improper Access Control during App Downloads in Splunk SOAR
CVSS 6.5 mediumEPSS 0.27%Splunk
CVE-2026-76303 Stored Cross-Site Scripting (XSS) through App Documentation in Splunk SOAR
CVSS 5.7 mediumEPSS 0.23%Splunk
CVE-2026-76302 Security Hardening in Splunk Enterprise - October 2026
CVSS 9.9 criticalEPSS 0.40%Splunk
CVE-2026-76301 Security Hardening in Splunk Enterprise - October 2026
Not scoredEPSS 0.17%Splunk
CVE-2026-76300 Security Hardening in Splunk Enterprise - October 2026
Not scoredEPSS 0.17%Splunk
CVE-2026-76299 Security Hardening in Splunk Enterprise - October 2026
CVSS 9.9 criticalEPSS 0.33%Splunk
CVE-2026-76295 SPL Injection through the REST API in Splunk Secure Gateway
CVSS 4.3 mediumEPSS 0.27%Splunk
CVE-2026-76294 Improper Access Control in Field Extraction Management in Splunk Enterprise
CVSS 4.3 mediumEPSS 0.27%Splunk
CVE-2026-76292 Missing Authorization through REST API Endpoints in Splunk Secure Gateway
CVSS 6.5 mediumEPSS 0.34%Splunk
CVE-2026-76289 Denial of Service (DoS) through the REST API in Splunk Enterprise
CVSS 6.5 mediumEPSS 0.37%Splunk
CVE-2026-76287 Authorization Bypass in the Data Management REST API in Splunk Enterprise
CVSS 5.4 mediumEPSS 0.21%Splunk
CVE-2026-114139 Sentry-Javascript: Middleware Bypass when using Tunnel route
CVSS 9.1 criticalEPSS 0.51%Sentry
CVE-2026-109619 RCE via stale global state
CVSS 8.1 highEPSS 100.0%Amazon Web ServicesGoogle Cloud14 incidents
CVE-2026-109618 RCE via OOM corruption
CVSS 9.8 criticalEPSS 100.0%Amazon Web ServicesGoogle Cloud15 incidents
CVE-2026-111943 Distrust compromised intermediate certificates in crypto/x509
Not scoredEPSS 0.30%Amazon Web ServicesGoogle Cloud2 incidents
CVE-2026-112380 Missing authorization in the WhatsApp channel in Kiro Crew
CVSS 9.9 criticalEPSS 0.41%Amazon Web Services
CVE-2026-85267 Cross-Site WebSocket Hijacking in Google Cloud Shell
CVSS 8.7 highEPSS 0.21%Google Cloud
CVE-2026-96656 Plex Media Server arbitrary file write
CVSS 7.2 highKEV added EPSS 1.8%
CVE-2026-96655 Plex Media Server arbitrary-host SSRF
CVSS 4.3 mediumKEV added EPSS 1.6%
CVE-2026-96654 Plex Media Server URL injection
CVSS 6.5 mediumKEV added EPSS 1.9%
CVE-2026-96652 Plex Media Server SSRF
CVSS 4.3 mediumKEV added EPSS 1.8%
CVE-2026-110936 Siemens Software Center Uncontrolled Search Path Element Vulnerability
CVSS 6.7 mediumKEV added EPSS 0.97%
CVE-2026-106931 EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability
CVSS 7.8 highKEV added EPSS 2.5%
- CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (opens in new tab)
- This product uses data from the NVD API but is not endorsed or certified by the NVD. (opens in new tab)
- Known Exploited Vulnerabilities catalog from CISA. (opens in new tab)
- EPSS scores from FIRST (Exploit Prediction Scoring System). (opens in new tab)