RewindexCVEs
CVEs
5,606 vulnerabilities, 1,756 of them in CISA’s Known Exploited Vulnerabilities catalog, newest first.
CVEs mapped to a company Rewindex tracks (by CVE affected-product data, NVD CPE, vendor advisories and package feeds), every entry in CISA’s Known Exploited Vulnerabilities catalog, and CVEs named in a tracked status incident. Other CVEs are not listed.
Dates are the CVE publish date (or the KEV date added). Times are shown in UTC.
Each column is one week (Monday start, UTC), stacked by CVSS severity, by published date or the KEV date added. Dots mark entries added to CISA KEV that week. The last week is still in progress.
CVE-2026-4055 Insufficient permission validation on cross-team playbook run creation
CVSS 4.3 mediumEPSS 0.15%Mattermost
CVE-2025-34291 Langflow <= 1.6.9 CORS Misconfiguration to Token Hijack & RCE
CVSS 8.8 highKEV added EPSS 92.8%
CVE-2026-9133 Arbitrary file read in rabbitmq-aws plugin
CVSS 7.7 highEPSS 1.1%Amazon Web Services
CVE-2026-20238 Improper Access Control through Role Inheritance in Splunk AI Toolkit app
CVSS 6.5 mediumEPSS 0.32%Splunk
CVE-2026-20239 Sensitive Information Disclosure through Log Files in Splunk Enterprise
CVSS 7.5 highEPSS 0.49%Splunk
CVE-2026-20240 Denial of Service through coldToFrozen.sh Script in Splunk Enterprise
CVSS 7.1 highEPSS 0.40%Splunk
CVE-2026-9101 Prototype pollution in csv parsing
CVSS 4.3 mediumEPSS 0.41%MongoDB Atlas
CVE-2026-9100 Heap memory out of bounds read and crash in C Driver legacy GridFS file reader
CVSS 5.9 mediumEPSS 0.30%MongoDB Atlas
CVE-2026-41091 Microsoft Defender Elevation of Privilege Vulnerability
CVSS 7.8 highKEV added EPSS 8.2%
CVE-2026-45498 Microsoft Defender Denial of Service Vulnerability
CVSS 4.0 mediumKEV added EPSS 63.1%
CVE-2010-0806 Microsoft Internet Explorer Use-After-Free Vulnerability
CVSS 8.8 highKEV added EPSS 82.2%
CVE-2010-0249 Microsoft Internet Explorer Use-After-Free Vulnerability
CVSS 8.8 highKEV added EPSS 91.9%
CVE-2009-3459 Adobe Acrobat and Reader Heap-Based Buffer Overflow Vulnerability
CVSS 8.8 highKEV added EPSS 86.6%
CVE-2009-1537 Microsoft DirectX NULL Byte Overwrite Vulnerability
CVSS 8.8 highKEV added EPSS 51.4%
CVE-2008-4250 Microsoft Windows Buffer Overflow Vulnerability
CVSS 9.8 criticalKEV added EPSS 98.8%
CVE-2026-8838 Remote Code Execution via eval() Injection in amazon-redshift-python-driver
CVSS 9.8 criticalEPSS 0.81%Amazon Web Services
CVE-2026-42822 Azure Local Disconnected Operations (ALDO) Elevation of Privilege Vulnerability
CVSS 10.0 criticalEPSS 0.49%Microsoft Azure
CVSS 10.0 criticalEPSS 15.1%Chroma
CVE-2026-8843 Calling createIndex with certain index types can crash mongod
CVSS 6.5 mediumEPSS 0.24%MongoDB Atlas
CVE-2026-6333 SSRF via Host Header Spoofing in Custom Slash Commands
CVSS 3.5 lowEPSS 0.14%Mattermost
CVE-2026-6345 Prevent password disclosure and force reset during Slack import
CVSS 6.5 mediumEPSS 0.23%Mattermost
CVE-2026-6346 Sensitive credentials exposed in plaintext in Mattermost support packets
CVSS 8.7 highEPSS 0.30%Mattermost
CVE-2026-28732 Slash command trigger-word update allowed command hijacking
CVSS 4.3 mediumEPSS 0.15%Mattermost
CVE-2026-6339 Missing request origin validation on burn-on-read reveal endpoint
CVSS 4.3 mediumEPSS 0.11%Mattermost
CVE-2026-6340 Memory Exhaustion via Malicious 7zip File Upload
CVSS 4.3 mediumEPSS 0.24%Mattermost
CVE-2026-6341 Incomplete group locking implementation
CVSS 4.3 mediumEPSS 0.15%Mattermost
CVE-2026-6342 Group prefix matching bypass for subscriptions
CVSS 4.3 mediumEPSS 0.15%Mattermost
CVE-2026-3495 Unescaped variables during error page composition
CVSS 3.8 lowEPSS 0.14%Mattermost
CVE-2026-3637 Mattermost fails to enforce create_post permission when editing posts
CVSS 4.3 mediumEPSS 0.15%Mattermost
CVE-2026-2325 Improper Input Validation in MS Teams Meetings API Handler
CVSS 4.3 mediumEPSS 0.24%Mattermost
CVE-2026-4053 post edit time limit is not enforced on some post update operations
CVSS 3.1 lowEPSS 0.16%Mattermost
CVE-2026-45773 Turborepo: Login callback CSRF/session fixation
CVSS 6.5 mediumEPSS 0.12%Vercel
CVE-2026-46508 Turborepo: VSCode Extension command injection
CVSS 7.8 highEPSS 0.16%Vercel
CVE-2026-45772 Turborepo: Unexpected local code execution during Yarn Berry detection
CVSS 9.8 criticalEPSS 0.39%Vercel
- CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (opens in new tab)
- This product uses data from the NVD API but is not endorsed or certified by the NVD. (opens in new tab)
- Known Exploited Vulnerabilities catalog from CISA. (opens in new tab)
- EPSS scores from FIRST (Exploit Prediction Scoring System). (opens in new tab)