RewindexCVEs
CVEs
5,606 vulnerabilities, 1,756 of them in CISA’s Known Exploited Vulnerabilities catalog, newest first.
CVEs mapped to a company Rewindex tracks (by CVE affected-product data, NVD CPE, vendor advisories and package feeds), every entry in CISA’s Known Exploited Vulnerabilities catalog, and CVEs named in a tracked status incident. Other CVEs are not listed.
Dates are the CVE publish date (or the KEV date added). Times are shown in UTC.
Each column is one week (Monday start, UTC), stacked by CVSS severity, by published date or the KEV date added. Dots mark entries added to CISA KEV that week. The last week is still in progress.
CVE-2026-48939 Joomla Extension - icagenda.com - Remote Code Execution in iCaganda extension for Joomla < 4.0.8/3.9.15
CVSS 9.8 criticalKEV added EPSS 20.1%
CVE-2026-59826 Metabase: Arbitrary Code Execution via Database Connection Detail Bypass
CVSS 9.1 criticalEPSS 1.0%MetabaseMetabase Cloud
CVE-2026-59827 Metabase: Unsafe Deserialization of H2 Query Results
CVSS 9.9 criticalEPSS 3.8%MetabaseMetabase Cloud
CVE-2026-12879 Cross-Tenant Data Exfiltration in Apigee via BigQuery Confused Deputy
CVSS 5.9 mediumEPSS 0.30%Google Cloud
CVE-2025-12506 Use of Incorrectly-Resolved Name or Reference in GitLab
CVSS 3.5 lowEPSS 0.33%GitLab
CVE-2026-6352 Incorrect Authorization in GitLab
CVSS 2.7 lowEPSS 0.44%GitLab
CVE-2026-7492 Missing Authorization in GitLab
CVSS 4.3 mediumEPSS 0.35%GitLab
CVE-2026-8472 Missing Authorization in GitLab
CVSS 4.3 mediumEPSS 0.39%GitLab
CVE-2026-11827 Insufficiently Protected Credentials in GitLab
CVSS 4.9 mediumEPSS 0.44%GitLab
CVE-2026-14896 Nomad vulnerable to cross-namespace host volume claim deletion
CVSS 4.2 mediumEPSS 0.25%HashiCorp
CVE-2026-14891 Nomad vulnerable to sandbox escape in Docker task driver
CVSS 8.7 highEPSS 0.49%HashiCorp
CVE-2026-60104 Bitwarden Server < 2026.6.0 Authorization Bypass via Admin Auth Request
CVSS 8.7 highEPSS 0.37%Bitwarden
CVE-2026-14373 Nomad Docker driver Linux host namespace bypass
CVSS 7.7 highEPSS 0.34%HashiCorp
CVE-2026-14362 Denial of service via crafted push/pull gossip message in memberlist
CVSS 4.9 mediumEPSS 0.25%HashiCorp
CVE-2026-59879 Immutable.js `List` 32-bit trie overflow → unrecoverable DoS
CVSS 7.5 highEPSS 0.58%ConfluenceJira
CVE-2026-59871 node-tar: Process crash via PAX numeric path type confusion
CVSS 5.3 mediumEPSS 0.64%ConfluenceJira
CVE-2026-59873 node-tar: Decompression/parse DoS via unlimited input
CVSS 7.5 highEPSS 0.58%ConfluenceJira
CVE-2026-15062 SQL Injection in Snowflake Snowpark Python SDK
CVSS 9.6 criticalEPSS 0.39%Snowflake
CVE-2026-15036 Harness gitspaces Endpoint list_all.go getAuthorizedSpaces authorization
CVSS 4.3 mediumEPSS 0.41%Harness
CVE-2026-59253 n8n - Improper Authorization in Workflow Assignment to Folders
CVSS 5.0 mediumEPSS 0.28%n8n
CVE-2026-56778 n8n - Authorization Bypass in Public API Execution Retry Endpoint
CVSS 6.4 mediumEPSS 0.30%n8n
CVE-2026-56776 n8n - Incorrect OAuth Scope Validation in Workflow Test Run Endpoint
CVSS 7.4 highEPSS 0.28%n8n
CVE-2026-56775 n8n - Incorrect OAuth Scope Validation in Evaluation Test Runs Endpoints
CVSS 5.4 mediumEPSS 0.30%n8n
CVE-2026-56360 n8n - Webhook Forgery via Unsigned POST Requests in ZendeskTrigger
CVSS 4.0 mediumEPSS 0.31%n8n
CVE-2026-56359 n8n - Cross-Site Scripting in Credential Management OAuth2 Authorization URL
CVSS 5.4 mediumEPSS 0.24%n8n
CVE-2026-54698 Hasura: Row-level authorization bypass on table computed fields
CVSS 5.9 mediumEPSS 0.27%Hasura
CVE-2026-14904 RES Auth.GetUserPrivateKey Arbitrary File Read
CVSS 6.5 mediumEPSS 0.57%Amazon Web Services
CVE-2026-56290 Joomla Extension - joomlack.fr - Unauthenticated file upload in Page Builder CK extension < 3.6.0
CVSS 9.8 criticalKEV added EPSS 30.9%
CVE-2026-55255 Langflow: IDOR Vulnerability in `/api/v1/responses` Endpoint Allows Authenticated Attackers to Access Another User's Flow
CVSS 8.4 highKEV added EPSS 0.89%
CVE-2026-48908 Joomla Extension - joomshaper.com - Remote Code Execution in SP Pagebuilder extension for Joomla < 6.6.2
CVSS 9.8 criticalKEV added EPSS 88.5%
CVE-2026-48282 ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
CVSS 10.0 criticalKEV added EPSS 42.4%
CVSS 6.5 mediumEPSS 0.37%OpenAI
CVE-2026-53359 KVM: x86: Fix shadow paging use-after-free due to unexpected role
CVSS 8.8 highEPSS 1.4%Google Cloud
CVE-2025-71380 n8n - Arbitrary Command Execution via Execute Command Node
CVSS 8.8 highEPSS 0.57%n8n
CVE-2026-26145 Microsoft Azure Synapse Elevation of Privilege Vulnerability
CVSS 4.8 mediumEPSS 0.70%Microsoft Azure
CVE-2026-45499 Azure OpenAI Elevation of Privilege Vulnerability
CVSS 9.9 criticalEPSS 0.78%Microsoft Azure
- CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (opens in new tab)
- This product uses data from the NVD API but is not endorsed or certified by the NVD. (opens in new tab)
- Known Exploited Vulnerabilities catalog from CISA. (opens in new tab)
- EPSS scores from FIRST (Exploit Prediction Scoring System). (opens in new tab)