RewindexCVEs
CVEs
5,606 vulnerabilities, 1,756 of them in CISA’s Known Exploited Vulnerabilities catalog, newest first.
CVEs mapped to a company Rewindex tracks (by CVE affected-product data, NVD CPE, vendor advisories and package feeds), every entry in CISA’s Known Exploited Vulnerabilities catalog, and CVEs named in a tracked status incident. Other CVEs are not listed.
Dates are the CVE publish date (or the KEV date added). Times are shown in UTC.
Each column is one week (Monday start, UTC), stacked by CVSS severity, by published date or the KEV date added. Dots mark entries added to CISA KEV that week. The last week is still in progress.
CVE-2026-33464 Uncontrolled Resource Consumption in Kibana Leading to Denial of Service
CVSS 6.5 mediumEPSS 0.27%Elastic Cloud
CVE-2026-33462 Path Traversal in Kibana Leading to Unauthorized Deletion of User Accounts
CVSS 4.6 mediumEPSS 0.24%Elastic Cloud
CVE-2026-9807 Incorrect Authorization in GitLab
CVSS 4.3 mediumEPSS 0.19%GitLab
CVE-2026-1402 Allocation of Resources Without Limits or Throttling in GitLab
CVSS 6.5 mediumEPSS 0.47%GitLab
CVE-2026-2601 Missing Authorization in GitLab
CVSS 4.3 mediumEPSS 0.24%GitLab
CVE-2026-4868 Authorization Bypass Through User-Controlled Key in GitLab
CVSS 8.2 highEPSS 0.43%GitLab
CVE-2026-5296 Missing Authorization in GitLab
CVSS 4.3 mediumEPSS 0.20%GitLab
CVE-2026-6713 Incorrect Authorization in GitLab
CVSS 5.3 mediumEPSS 0.36%GitLab
CVE-2026-8716 Use of Incorrectly-Resolved Name or Reference in GitLab
CVSS 4.3 mediumEPSS 0.19%GitLab
CVE-2026-48027 Compromised Nx Console version 18.95.0
CVSS 9.8 criticalKEV added EPSS 1.9%
CVE-2026-42280 Improper Permission Checking in Auth.js SDK
CVSS 7.1 highEPSS 0.21%Auth0
CVE-2026-8398 Daemon Tools Lite Embedded Malicious Code Vulnerability
CVSS 9.8 criticalKEV added EPSS 1.5%
CVE-2026-45321 Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys
CVSS 9.6 criticalKEV added EPSS 3.3%
CVE-2026-48172 LiteSpeed cPanel Plugin Privilege Escalation Vulnerability
CVSS 9.8 criticalKEV added EPSS 17.9%
CVE-2026-4915 Server panic via outgoing webhook responses
CVSS 6.5 mediumEPSS 0.28%Mattermost
CVE-2026-46300 net: skbuff: preserve shared-frag marker during coalescing
CVSS 7.8 high2 incidents
CVE-2026-26147 Azure Stack HCI Information Disclosure Vulnerability
CVSS 7.7 highEPSS 0.58%Microsoft Azure
CVE-2026-47280 Azure Resource Manager Elevation of Privilege Vulnerability
CVSS 10.0 criticalEPSS 0.49%Microsoft Azure
CVE-2026-40411 Azure Virtual Network Gateway Remote Code Execution Vulnerability
CVSS 9.9 criticalEPSS 0.52%Microsoft Azure
CVE-2026-40412 Azure Orbital Spatio Remote Code Execution Vulnerability
CVSS 10.0 criticalEPSS 0.53%Microsoft Azure
CVE-2026-9255 Tool Execution Without Authorization via Piped Stdin in Kiro CLI
CVSS 7.8 highEPSS 0.12%Amazon Web Services
CVE-2026-28735 GitHub OAuth Scope Validation
CVSS 5.4 mediumEPSS 0.14%Mattermost
CVE-2026-4635 Persistent notification timing attack causing server denial of service
CVSS 6.5 mediumEPSS 0.17%Mattermost
CVE-2026-4646 Insufficient input validation in GitHub plugin API causes denial of service
CVSS 4.3 mediumEPSS 0.25%Mattermost
CVE-2026-3636 Sanitize team member data returned by API
CVSS 4.3 mediumEPSS 0.18%Mattermost
CVE-2026-5308 Missing request body size limits on Zoom plugin HTTP endpoints
CVSS 4.9 mediumEPSS 0.25%Mattermost
CVE-2026-5755 Denial of service via crafted TIFF file upload
CVSS 6.5 mediumEPSS 0.25%Mattermost
CVE-2026-9082 Drupal core - Highly critical - SQL injection - SA-CORE-2026-004
CVSS 9.8 criticalKEV added EPSS 89.4%
Not scoredGitLab
CVE-2026-34926 Trend Micro Apex One (On-Premise) Directory Traversal Vulnerability
CVSS 6.7 mediumKEV added EPSS 13.4%
CVE-2026-22880 Mobile SSO authentication flow allows credential theft via malicious server
CVSS 6.1 mediumEPSS 0.12%Mattermost
- CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (opens in new tab)
- This product uses data from the NVD API but is not endorsed or certified by the NVD. (opens in new tab)
- Known Exploited Vulnerabilities catalog from CISA. (opens in new tab)
- EPSS scores from FIRST (Exploit Prediction Scoring System). (opens in new tab)