RewindexCVEs
CVEs
5,606 vulnerabilities, 1,756 of them in CISA’s Known Exploited Vulnerabilities catalog, newest first.
CVEs mapped to a company Rewindex tracks (by CVE affected-product data, NVD CPE, vendor advisories and package feeds), every entry in CISA’s Known Exploited Vulnerabilities catalog, and CVEs named in a tracked status incident. Other CVEs are not listed.
Dates are the CVE publish date (or the KEV date added). Times are shown in UTC.
Each column is one week (Monday start, UTC), stacked by CVSS severity, by published date or the KEV date added. Dots mark entries added to CISA KEV that week. The last week is still in progress.
CVE-2026-45736 ws: Uninitialized memory disclosure
CVSS 4.4 mediumEPSS 0.74%BitbucketConfluence
CVE-2026-42897 Microsoft Exchange Server Spoofing Vulnerability
CVSS 8.1 highKEV added EPSS 70.7%
CVE-2026-6811 PHP Stack Exhaustion
CVSS 5.9 mediumEPSS 0.37%MongoDB Atlas
CVE-2026-22707 Strapi Upload Plugin MIME Validation Bypass via Content API
CVSS 5.4 mediumEPSS 0.19%Strapi Cloud
CVE-2026-22706 Strapi: Password Reset Does Not Revoke Existing Refresh Sessions
CVSS 6.5 mediumEPSS 0.34%Strapi Cloud
CVE-2026-22599 Strapi Vulnerable to SQL Injection in Content Type Builder
CVSS 7.2 highEPSS 1.2%Strapi Cloud
CVE-2026-44827 Diffusers: None.py Trust Remote Code Bypass
CVSS 8.8 highEPSS 0.72%Hugging Face
CVE-2026-20182 Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability
CVSS 10.0 criticalKEV added EPSS 91.8%
CVE-2026-44484 Compromise of PyTorch Lightning PyPi Package Versions
CVSS 9.8 criticalEPSS 0.39%Lightning AI
CVE-2025-12669 Improper Control of Generation of Code ('Code Injection') in GitLab
CVSS 5.4 mediumEPSS 0.18%GitLab
CVE-2025-13874 Authorization Bypass Through User-Controlled Key in GitLab
CVSS 4.3 mediumEPSS 0.23%GitLab
CVE-2025-14869 Improper Validation of Specified Quantity in Input in GitLab
CVSS 7.5 highEPSS 0.35%GitLab
CVE-2025-14870 Allocation of Resources Without Limits or Throttling in GitLab
CVSS 7.5 highEPSS 0.34%GitLab
CVE-2026-1184 Deserialization of Untrusted Data in GitLab
CVSS 6.5 mediumEPSS 0.33%GitLab
CVE-2026-1322 Business Logic Errors in GitLab
CVSS 6.8 mediumEPSS 0.31%GitLab
CVE-2026-1338 Authorization Bypass Through User-Controlled Key in GitLab
CVSS 4.3 mediumEPSS 0.23%GitLab
CVE-2026-1659 Allocation of Resources Without Limits or Throttling in GitLab
CVSS 7.5 highEPSS 0.36%GitLab
CVE-2026-2900 Missing Authorization in GitLab
CVSS 2.7 lowEPSS 0.27%GitLab
CVE-2026-3073 Authorization Bypass Through User-Controlled Key in GitLab
CVSS 4.3 mediumEPSS 0.26%GitLab
CVE-2026-3074 Authorization Bypass Through User-Controlled Key in GitLab
CVSS 4.3 mediumEPSS 0.20%GitLab
CVE-2026-3160 Unintended Proxy or Intermediary ('Confused Deputy') in GitLab
CVSS 5.8 mediumEPSS 0.22%GitLab
CVE-2026-3607 Access Control Check Implemented After Asset is Accessed in GitLab
CVSS 4.3 mediumEPSS 0.27%GitLab
CVE-2026-4524 Authentication Bypass Using an Alternate Path or Channel in GitLab
CVSS 6.5 mediumEPSS 0.29%GitLab
CVE-2026-4527 Cross-Site Request Forgery (CSRF) in GitLab
CVSS 6.5 mediumEPSS 0.19%GitLab
CVE-2026-6063 Authorization Bypass Through User-Controlled Key in GitLab
CVSS 4.3 mediumEPSS 0.23%GitLab
CVE-2026-6883 Missing Authorization in GitLab
CVSS 2.6 lowEPSS 0.16%GitLab
CVE-2026-7471 Server-Side Request Forgery (SSRF) in GitLab
CVSS 3.5 lowEPSS 0.17%GitLab
CVE-2026-8280 Allocation of Resources Without Limits or Throttling in GitLab
CVSS 6.5 mediumEPSS 0.30%GitLab
CVE-2026-8144 Missing Authorization in GitLab
CVSS 4.3 mediumEPSS 0.18%GitLab
CVE-2026-28374 IDOR in Annotations API allows unprivileged users to DELETE annotation
CVSS 4.3 mediumEPSS 0.20%Grafana Cloud
CVE-2026-28383 Grafana plugin resources can lead to unbounded memory allocation
CVSS 6.5 mediumEPSS 0.33%Grafana Cloud
CVE-2026-33376 Auth Proxy IPv6 whitelist bypass
CVSS 7.4 highEPSS 0.28%Grafana Cloud
CVE-2026-33380 SQL Expressions Read File From Disk
CVSS 6.3 mediumEPSS 0.35%Grafana Cloud
CVE-2026-28380 BAC in Snapshot API allows deletion of unauthorized dashboard snapshots
CVSS 6.5 mediumEPSS 0.23%Grafana Cloud
CVE-2026-33381 Users can generate Service Account tokens after permissions removal
CVSS 5.9 mediumEPSS 0.33%Grafana Cloud
CVE-2026-28376 Grafana Live push endpoint allows unbounded memory allocation leading to OOM
CVSS 6.5 mediumEPSS 0.33%Grafana Cloud
- CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (opens in new tab)
- This product uses data from the NVD API but is not endorsed or certified by the NVD. (opens in new tab)
- Known Exploited Vulnerabilities catalog from CISA. (opens in new tab)
- EPSS scores from FIRST (Exploit Prediction Scoring System). (opens in new tab)