RewindexCVEs
CVEs
5,606 vulnerabilities, 1,756 of them in CISA’s Known Exploited Vulnerabilities catalog, newest first.
CVEs mapped to a company Rewindex tracks (by CVE affected-product data, NVD CPE, vendor advisories and package feeds), every entry in CISA’s Known Exploited Vulnerabilities catalog, and CVEs named in a tracked status incident. Other CVEs are not listed.
Dates are the CVE publish date (or the KEV date added). Times are shown in UTC.
Each column is one week (Monday start, UTC), stacked by CVSS severity, by published date or the KEV date added. Dots mark entries added to CISA KEV that week. The last week is still in progress.
CVE-2026-42585 Netty: HTTP Request Smuggling due to malformed Transfer-Encoding
CVSS 6.5 mediumEPSS 0.27%BitbucketConfluenceJira
CVE-2026-42584 Netty: HttpClientCodec response desynchronization
CVSS 7.3 highEPSS 0.84%ConfluenceJira
CVE-2026-42583 Netty: Lz4FrameDecoder resource exhaustion
CVSS 7.5 highEPSS 0.46%BitbucketConfluenceJira
CVSS 7.8 highEPSS 0.12%Zoom
CVSS 7.8 highEPSS 0.12%Zoom
CVE-2026-42581 Netty: HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization
CVSS 5.8 mediumEPSS 0.63%Jira
CVSS 1.8 lowEPSS 0.14%Zoom
CVE-2026-44581 Next.js: Cross-site scripting in App Router applications using CSP nonces
CVSS 4.7 mediumEPSS 0.22%Vercel
CVE-2026-44580 Next.js: Cross-site scripting in beforeInteractive scripts with untrusted input
CVSS 6.1 mediumEPSS 0.21%Vercel
CVE-2026-44577 Next.js: Denial of Service in the Image Optimization API
CVSS 5.9 mediumEPSS 0.74%Vercel
CVE-2026-44576 Next.js: Cache poisoning in React Server Component responses
CVSS 5.4 mediumEPSS 0.30%Vercel
CVE-2026-44574 Next.js: Middleware / Proxy bypass through dynamic route parameter injection
CVSS 8.1 highEPSS 0.64%Vercel
CVE-2026-44573 Next.js: Middleware / Proxy bypass in Pages Router applications using i18n
CVSS 7.5 highEPSS 0.80%Vercel
CVE-2026-44572 Next.js: Middleware / Proxy redirects can be cache-poisoned
CVSS 3.7 lowEPSS 0.28%Vercel
CVE-2026-44479 Vercel: Non-interactive mode includes CLI arguments in suggested command output
CVSS 5.5 mediumEPSS 0.16%Vercel
CVE-2026-8202 Post-authentication CPU utilization DoS via $trim/$ltrim/$rtrim operators
CVSS 4.3 mediumEPSS 0.26%MongoDB Atlas
CVE-2026-8200 Schema validation log messages may not redact user data
CVSS 2.7 lowEPSS 0.20%MongoDB Atlas
CVE-2026-8199 Post-auth memory exhaustion via bitwise match expressions
CVSS 6.5 mediumEPSS 0.26%MongoDB Atlas
CVE-2026-8053 FlatBSON Duplicate Field Index Drift
CVSS 8.8 highEPSS 0.66%MongoDB Atlas
CVE-2026-8431 Ops Manager RCE via webhook body
CVSS 7.2 highEPSS 0.37%MongoDB Atlas
CVE-2026-42830 Azure Monitor Agent Metrics Extension Elevation of Privilege Vulnerability
CVSS 6.5 mediumEPSS 0.47%Microsoft Azure
CVE-2026-42823 Azure Logic Apps Elevation of Privilege Vulnerability
CVSS 9.9 criticalEPSS 0.60%Microsoft Azure
CVE-2026-40381 Azure Connected Machine Agent Elevation of Privilege Vulnerability
CVSS 7.8 highEPSS 0.22%Microsoft Azure
CVE-2026-33833 Azure Machine Learning Notebook Spoofing Vulnerability
CVSS 8.2 highEPSS 0.50%Microsoft Azure
CVE-2026-32185 Microsoft Teams Spoofing Vulnerability
CVSS 5.5 mediumEPSS 0.47%Microsoft Teams
CVE-2026-33117 Azure SDK for Java Security Feature Bypass Vulnerability
CVSS 9.1 criticalEPSS 0.48%Microsoft Azure
CVE-2026-32204 Azure Monitor Agent Elevation of Privilege Vulnerability
CVSS 7.8 highEPSS 0.29%Microsoft Azure
CVE-2026-43515 Apache Tomcat: Security constraints not correctly applied
CVSS 9.1 criticalEPSS 1.2%ConfluenceJira
CVE-2026-43513 Apache Tomcat: LockOutRealm treats user names as case-sensitive
CVSS 7.5 highEPSS 0.50%ConfluenceJira
CVE-2026-43512 Apache Tomcat: Digest authenticator will authenticate any unknown user
CVSS 9.8 criticalEPSS 1.3%ConfluenceJira
CVE-2026-41293 Apache Tomcat: HTTP/2 request headers not validated
CVSS 9.8 criticalEPSS 1.7%ConfluenceJira
CVE-2026-42498 Apache Tomcat: WebSocket authentication header exposure
CVSS 7.3 highEPSS 0.65%ConfluenceJira
CVE-2026-7428 Insecure default administrative credentials in AlloyDB for PostgreSQL
CVSS 9.2 criticalEPSS 0.24%Google Cloud
CVE-2026-45393 Local privilege escalation to SYSTEM in Cribl Edge for Windows
CVSS 7.8 highEPSS 0.22%Cribl
CVE-2026-45392 DOM-based XSS in Cribl Stream
CVSS 8.7 highEPSS 0.28%Cribl
CVE-2026-45391 Local privilege escalation in Cribl Edge for Linux
CVSS 7.8 highEPSS 0.89%Cribl
- CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (opens in new tab)
- This product uses data from the NVD API but is not endorsed or certified by the NVD. (opens in new tab)
- Known Exploited Vulnerabilities catalog from CISA. (opens in new tab)
- EPSS scores from FIRST (Exploit Prediction Scoring System). (opens in new tab)