RewindexCVEs
CVEs
5,606 vulnerabilities, 1,756 of them in CISA’s Known Exploited Vulnerabilities catalog, newest first.
CVEs mapped to a company Rewindex tracks (by CVE affected-product data, NVD CPE, vendor advisories and package feeds), every entry in CISA’s Known Exploited Vulnerabilities catalog, and CVEs named in a tracked status incident. Other CVEs are not listed.
Dates are the CVE publish date (or the KEV date added). Times are shown in UTC.
Each column is one week (Monday start, UTC), stacked by CVSS severity, by published date or the KEV date added. Dots mark entries added to CISA KEV that week. The last week is still in progress.
CVE-2026-57522 Bitwarden Server < 2026.5.0 JSON Injection via Webhook Templates
CVSS 3.5 lowEPSS 0.46%Bitwarden
CVE-2026-57521 Bitwarden Server < 2026.5.0 Broken Access Control via PreviewInvoiceController
CVSS 4.3 mediumEPSS 0.43%Bitwarden
CVE-2026-2299 Improper Access Control in Mattermost Google Drive Plugin File Creation Endpoint
CVSS 4.2 mediumEPSS 0.20%Mattermost
CVE-2026-50548 Cursor Desktop sandbox escape via agent-controlled working directory
CVSS 9.8 criticalEPSS 1.0%Cursor
CVE-2026-50549 Cursor Desktop sandbox escape via symlink and failed path canonicalization
CVSS 9.8 criticalEPSS 1.0%Cursor
CVE-2026-0934 Incorrect Authorization in GitLab
CVSS 3.8 lowEPSS 0.33%GitLab
CVE-2026-1606 Improper Control of Generation of Code ('Code Injection') in GitLab
CVSS 4.3 mediumEPSS 0.36%GitLab
CVE-2026-2238 Missing Authorization in GitLab
CVSS 5.3 mediumEPSS 0.47%GitLab
CVE-2026-3176 Missing Authorization in GitLab
CVSS 3.1 lowEPSS 0.34%GitLab
CVE-2026-5309 Authorization Bypass Through User-Controlled Key in GitLab
CVSS 5.4 mediumEPSS 0.29%GitLab
CVE-2026-5796 Incorrect Authorization in GitLab
CVSS 4.3 mediumEPSS 0.39%GitLab
CVE-2026-5952 Incorrect Authorization in GitLab
CVSS 4.3 mediumEPSS 0.41%GitLab
CVE-2026-8330 Insertion of Sensitive Information into Log File in GitLab
CVSS 4.4 mediumEPSS 0.20%GitLab
CVE-2026-11379 Incorrect Authorization in GitLab
CVSS 5.3 mediumEPSS 0.30%GitLab
CVE-2026-12053 Insertion of Sensitive Information into Log File in GitLab
CVSS 8.6 highEPSS 0.63%GitLab
CVE-2026-12635 Reliance on Reverse DNS Resolution for a Security-Critical Action in GitLab
CVSS 0.0 noneEPSS 0.25%GitLab
CVE-2026-20230 Cisco Unified Communications Manager Server-Side Request Forgery Vulnerability
CVSS 8.6 highKEV added EPSS 88.2%
CVE-2026-12569 Remote Code Execution (RCE) vulnerability in Windchill PDMlink
CVSS 9.8 criticalKEV added EPSS 46.0%
CVE-2026-52794 Sentry: Inefficient Regular Expression Complexity in sentry
CVSS 7.5 highEPSS 0.55%Sentry
CVE-2026-56358 n8n - Stored Cross-Site Scripting in Form Trigger Node
CVSS 5.4 mediumEPSS 0.24%n8n
CVE-2026-56351 n8n - SQL Injection in MySQL, PostgreSQL, and Microsoft SQL Nodes
CVSS 8.2 highEPSS 0.37%n8n
CVE-2026-13006 Incomplete protection against CVE-2025-11226
CVSS 7.0 highEPSS 0.18%Confluence
CVE-2026-7574 Anthropic Claude Desktop Cowork VM Image Contents Not Validated Before Use
CVSS 8.7 highEPSS 0.12%Anthropic
CVE-2026-12958 Arbitrary file write in Language Servers for AWS
CVSS 7.8 highEPSS 0.19%Amazon Web Services
CVE-2026-12957 Arbitrary Code Execution in Language Servers for AWS
CVSS 7.8 highEPSS 0.23%Amazon Web Services
CVE-2026-34910 Ubiquiti UniFi OS Improper Input Validation Vulnerability
CVSS 10.0 criticalKEV added EPSS 90.0%
CVE-2026-34909 Ubiquiti UniFi OS Path Traversal Vulnerability
CVSS 10.0 criticalKEV added EPSS 68.0%
CVE-2026-34908 Ubiquiti UniFi OS Improper Access Control Vulnerability
CVSS 10.0 criticalKEV added EPSS 88.3%
CVE-2025-67038 Lantronix EDS5000, G520, and X300 OS Command Injection
CVSS 9.8 criticalKEV added EPSS 20.3%
CVSS 3.7 low1 incident
CVE-2026-8934 Cross-Project Information Leakage in Google App Engine UI
CVSS 6.9 mediumEPSS 0.51%Google Cloud
CVE-2026-6062 IDOR in Jira plugin subscription edit endpoint
CVSS 6.4 mediumEPSS 0.24%Mattermost
CVE-2026-9162 Global session revocation does not invalidate active WebSocket connections
CVSS 4.3 mediumEPSS 0.33%Mattermost
CVE-2026-5139 GitLab Plugin Allows Non-Admin Users to Modify Default Instance Configuration
CVSS 5.4 mediumEPSS 0.29%Mattermost
CVE-2026-28381 Local File Read/Write to Potential Privilege Escalation via Snowflake GET/PUT
CVSS 9.6 criticalEPSS 0.35%Grafana Cloud
CVE-2026-9029 Stored XSS in the Geomap panel tile-layer attribution
CVSS 7.3 highEPSS 0.25%Grafana Cloud
CVE-2026-10601 Path traversal in the Tempo and Loki data source plugins
CVSS 5.4 mediumEPSS 0.29%Grafana Cloud
- CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (opens in new tab)
- This product uses data from the NVD API but is not endorsed or certified by the NVD. (opens in new tab)
- Known Exploited Vulnerabilities catalog from CISA. (opens in new tab)
- EPSS scores from FIRST (Exploit Prediction Scoring System). (opens in new tab)