RewindexCVEs
CVEs
5,605 vulnerabilities, 1,756 of them in CISA’s Known Exploited Vulnerabilities catalog, newest first.
CVEs mapped to a company Rewindex tracks (by CVE affected-product data, NVD CPE, vendor advisories and package feeds), every entry in CISA’s Known Exploited Vulnerabilities catalog, and CVEs named in a tracked status incident. Other CVEs are not listed.
Dates are the CVE publish date (or the KEV date added). Times are shown in UTC.
Each column is one week (Monday start, UTC), stacked by CVSS severity, by published date or the KEV date added. Dots mark entries added to CISA KEV that week. The last week is still in progress.
CVE-2026-112368 Unbounded Recursion in phongo_bson_visit_document/visit_array:
CVSS 7.5 highEPSS 0.26%MongoDB Atlas
CVE-2026-18256 Private team metadata disclosure via the team search API
CVSS 4.3 mediumEPSS 0.16%Mattermost
CVE-2026-16453 Mattermost SAML RelayState forgery allows unauthorized team membership
CVSS 7.1 highEPSS 0.19%Mattermost
CVE-2026-19603 Private channel ID disclosure via user status endpoints
CVSS 4.3 mediumEPSS 0.18%Mattermost
CVE-2026-18795 Missing server side validation allowed user to quarantine a DM and GM post
CVSS 6.4 mediumEPSS 0.15%Mattermost
CVE-2026-19601 Disclosure of AD/LDAP bind password via Test Connection
CVSS 4.9 mediumEPSS 0.23%Mattermost
CVE-2026-18551 Mattermost guest account privilege escalation via member roles API
CVSS 6.5 mediumEPSS 0.22%Mattermost
CVE-2026-19541 Outgoing OAuth connection client secret exposure during connection validation
CVSS 6.5 mediumEPSS 0.22%Mattermost
CVE-2026-102764 Improper Origin Validation in Internal Messaging Components of BeyondTrust Remote Support
CVSS 9.8 criticalKEV added EPSS 20.3%
CVE-2025-61624 Fortinet Multiple Products Path Traversal Vulnerability
CVSS 5.4 mediumKEV added EPSS 1.3%
CVE-2026-108126 temporal-proxy payload decryption is not bound to the request namespace
CVSS 6.0 mediumEPSS 0.36%Temporal Cloud
CVE-2026-9703 Viewer role can create, modify and delete Loki alerting rules
CVSS 7.1 highEPSS 0.19%Grafana Cloud
CVE-2026-99999 ipv4: validate checksum_start before completing checksum
CVSS 9.3 criticalEPSS 0.79%Amazon Web Services3 incidents
CVE-2026-21589 Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability
CVSS 7.5 highKEV added EPSS 99.5%BitbucketConfluenceJira
CVE-2026-100406 dbt: Unauthenticated Arbitrary SQL Execution in `dbt docs serve`
CVSS 8.2 highEPSS 0.42%dbt Labs
CVE-2026-0322 PAN-OS: Authenticated Remote Code Execution (RCE) in the Management Interface
CVSS 7.2 highKEV added EPSS 1.7%
CVE-2026-76519 Cisco Secure Email Gateway Arbitrary File Write Vulnerability
CVSS 9.8 criticalKEV added EPSS 2.2%
CVE-2026-97205 NGINX ngx_http_core_module vulnerability
CVSS 8.1 high2 incidents
CVE-2026-93479 NGINX map directive and regex matching vulnerability
CVSS 8.1 high2 incidents
CVE-2026-15176 NGINX ngx_http_core_module vulnerability
CVSS 8.1 high2 incidents
CVE-2026-105134 Ahsay AhsayCBS Replication Receiver UpdateReceivers.do os command injection
CVSS 10.0 criticalKEV added EPSS 86.3%
CVE-2026-105133 Ahsay AhsayCBS API ApiStructsAction.java checkSysPwd improper authentication
CVSS 7.3 highKEV added EPSS 79.2%
CVSS 8.5 highEPSS 0.33%Akamai
CVSS 4.7 mediumEPSS 0.11%Akamai
CVSS 5.3 mediumEPSS 0.33%Akamai
CVSS 4.4 mediumEPSS 0.14%Akamai
CVSS 6.7 mediumEPSS 1.7%Akamai
CVE-2026-78633 Denial of Service in Okta RADIUS Agent Packet Parser
CVSS 6.5 mediumEPSS 0.21%Okta
CVE-2026-78632 Insecure Default File Permissions in Okta RADIUS Agent Windows Installer
CVSS 5.3 mediumEPSS 0.07%Okta
- CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (opens in new tab)
- This product uses data from the NVD API but is not endorsed or certified by the NVD. (opens in new tab)
- Known Exploited Vulnerabilities catalog from CISA. (opens in new tab)
- EPSS scores from FIRST (Exploit Prediction Scoring System). (opens in new tab)