RewindexCVEs
CVEs
5,606 vulnerabilities, 1,756 of them in CISA’s Known Exploited Vulnerabilities catalog, newest first.
CVEs mapped to a company Rewindex tracks (by CVE affected-product data, NVD CPE, vendor advisories and package feeds), every entry in CISA’s Known Exploited Vulnerabilities catalog, and CVEs named in a tracked status incident. Other CVEs are not listed.
Dates are the CVE publish date (or the KEV date added). Times are shown in UTC.
Each column is one week (Monday start, UTC), stacked by CVSS severity, by published date or the KEV date added. Dots mark entries added to CISA KEV that week. The last week is still in progress.
CVE-2026-42129 Path traversal in the Loki data source plugin
CVSS 7.7 highEPSS 0.44%Grafana Cloud
CVE-2026-12823 Browserbase Skills Autobrowse Trace Artifact default permission
CVSS 3.3 lowEPSS 0.16%Browserbase
CVE-2026-5366 Git Argument Injection in prefecthq/prefect
CVSS 9.9 criticalEPSS 1.0%Prefect
CVE-2026-48584 Microsoft Azure Synapse Elevation of Privilege Vulnerability
CVSS 9.9 criticalEPSS 0.91%Microsoft Azure
CVE-2026-45480 Azure Active Directory Elevation of Privilege Vulnerability
CVSS 10.0 criticalEPSS 0.90%Microsoft Azure
CVE-2026-27878 Tempo TraceQL query with exemplar hint could result in unbounded memory usage
CVSS 6.5 mediumEPSS 0.41%Grafana Cloud
CVE-2026-11941 Use-after-free in connection ID iterator and FFI functions
CVSS 5.6 mediumEPSS 0.25%Cloudflare
CVE-2026-32174 Azure Bot Service Elevation of Privilege Vulnerability
CVSS 7.7 highEPSS 0.77%Microsoft Azure
CVE-2026-12539 Docker Sandboxes ICMP egress restriction bypass after daemon restart
CVSS 5.1 mediumEPSS 0.14%Docker
CVE-2026-12039 Docker Sandboxes network egress allowlist bypass via unfiltered DNS resolution
CVSS 5.7 mediumEPSS 0.10%Docker
CVE-2026-20253 Unauthenticated Arbitrary File Creation and Truncation in a PostgreSQL Sidecar Service Endpoint in Splunk Enterprise
CVSS 9.8 criticalKEV added EPSS 96.9%Splunk
CVE-2026-20266 OS Command Injection in the btool Configuration Helper in Splunk AI Toolkit
CVSS 9.1 criticalEPSS 0.63%Splunk
CVE-2026-20265 Insecure Default Domain Allowlist in Splunk AI Toolkit
CVSS 4.3 mediumEPSS 0.22%Splunk
CVE-2026-48776 LangGraph SDK has unsafe URL path construction
CVSS 4.2 mediumEPSS 0.22%LangChain (LangSmith)
CVE-2026-48907 Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5
CVSS 9.8 criticalKEV added EPSS 85.4%
CVE-2025-68049 WordPress bunny.net plugin <= 2.3.6 - Broken Access Control vulnerability
CVSS 6.3 mediumEPSS 0.24%Bunny.net
CVE-2026-48124 Cursor Desktop sandbox escape via Claude hook configuration
CVSS 8.5 highEPSS 0.14%Cursor
CVE-2026-11931 Insecure Permissions on Authentication Token Cache File in Kiro IDE
CVSS 5.5 mediumEPSS 0.12%Amazon Web Services
CVE-2026-20262 Cisco Catalyst SD-WAN Manager Arbitrary File Write Vulnerability
CVSS 6.5 mediumKEV added EPSS 29.1%
CVE-2026-8683 Overly long URLs crash the Mattermost Desktop App
CVSS 6.5 mediumEPSS 0.20%Mattermost
CVE-2026-54420 LiteSpeed cPanel Plugin UNIX Symbolic Link (Symlink) Following Vulnerability
CVSS 8.5 highKEV added EPSS 1.4%
CVE-2026-11769 Operator - Namespaced User Path Traversal
CVSS 8.8 highEPSS 0.36%Grafana Cloud
CVE-2026-12043 Heap double-free in AWS Common Runtime aws-c-http
CVSS 8.8 highEPSS 0.35%Amazon Web Services
CVE-2026-42306 Moby: Race condition in docker cp allows bind mount redirection to host path
CVSS 7.2 highEPSS 0.10%Docker
CVSS 8.1 highEPSS 0.21%Zoom
CVSS 8.1 highEPSS 0.23%Zoom
CVSS 7.8 highEPSS 0.08%Zoom
CVE-2026-7184 Mattermost Remote Cluster PATCH API Leaks Authentication Tokens
CVSS 6.5 mediumEPSS 0.26%Mattermost
CVE-2026-6739 Mattermost: Delegated admins could patch protected default system roles
CVSS 6.7 mediumEPSS 0.26%Mattermost
CVSS 7.5 highEPSS 0.34%Chroma
CVSS 8.1 highEPSS 0.28%Chroma
CVSS 8.8 highEPSS 0.24%Chroma
CVSS 8.8 highEPSS 0.28%Chroma
CVSS 8.1 highEPSS 0.34%Chroma
CVE-2026-47691 Netty has Insufficient Bailiwick Validation for NS Records
CVSS 8.7 highEPSS 0.37%Confluence
- CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (opens in new tab)
- This product uses data from the NVD API but is not endorsed or certified by the NVD. (opens in new tab)
- Known Exploited Vulnerabilities catalog from CISA. (opens in new tab)
- EPSS scores from FIRST (Exploit Prediction Scoring System). (opens in new tab)