RewindexCVEs
CVEs
5,606 vulnerabilities, 1,756 of them in CISA’s Known Exploited Vulnerabilities catalog, newest first.
CVEs mapped to a company Rewindex tracks (by CVE affected-product data, NVD CPE, vendor advisories and package feeds), every entry in CISA’s Known Exploited Vulnerabilities catalog, and CVEs named in a tracked status incident. Other CVEs are not listed.
Dates are the CVE publish date (or the KEV date added). Times are shown in UTC.
Each column is one week (Monday start, UTC), stacked by CVSS severity, by published date or the KEV date added. Dots mark entries added to CISA KEV that week. The last week is still in progress.
CVE-2026-33105 Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability
CVSS 10.0 criticalEPSS 0.72%Microsoft Azure
CVE-2026-26135 Azure Custom Locations Resource Provider (RP) Elevation of Privilege Vulnerability
CVSS 9.6 criticalEPSS 0.60%Microsoft Azure
CVE-2026-33107 Azure Databricks Elevation of Privilege Vulnerability
CVSS 10.0 criticalEPSS 0.71%Microsoft Azure
CVE-2026-32213 Azure AI Foundry Elevation of Privilege Vulnerability
CVSS 10.0 criticalEPSS 0.91%Microsoft Azure
CVE-2026-5429 Kiro IDE Webview Cross-Site Scripting via Workspace Color Theme
CVSS 7.8 highEPSS 0.16%Amazon Web Services
CVE-2026-3502 TrueConf Client Update Integrity Verification Bypass
CVSS 7.8 highKEV added EPSS 5.6%
CVE-2026-5199 Cross Namespace Access via Batch Operation
CVSS 2.3 lowEPSS 0.32%Temporal Cloud
CVE-2026-34236 Auth0 PHP SDK Insufficient Entropy in Cookie Encryption
CVSS 8.2 highEPSS 0.22%Auth0
CVE-2026-33990 Docker Model Runner OCI Registry Client Vulnerable to Server-Side Request Forgery (SSRF)
CVSS 9.1 criticalEPSS 0.25%Docker
CVE-2026-5281 Google Dawn Use-After-Free Vulnerability
CVSS 8.8 highKEV added EPSS 13.5%
CVE-2026-4800 lodash vulnerable to Code Injection via `_.template` imports key names
CVSS 8.1 highEPSS 2.8%BitbucketConfluenceJira1 incident
CVE-2026-5190 AWS C Event Stream Streaming Decoder Stack Buffer Overflow
CVSS 7.5 highEPSS 0.41%Amazon Web Services
CVSS 7.8 highEPSS 0.18%Anthropic
CVE-2026-22569 Incorrect startup configuration in ZCC
CVSS 5.4 mediumEPSS 0.18%Zscaler
CVE-2026-34060 Ruby LSP has arbitrary code execution through branch setting
CVSS 9.8 criticalEPSS 0.48%Shopify
CVE-2026-33997 Moby: Off-by-one error in plugin privilege validation
CVSS 6.8 mediumEPSS 0.39%Docker
CVE-2026-34040 Moby: AuthZ plugin bypass with oversized request body
CVSS 8.8 highEPSS 9.1%Docker
CVE-2026-5170 Users could trigger a crash of mongod primaries during promotion to sharded
CVSS 5.3 mediumEPSS 0.20%MongoDB Atlas
CVE-2026-3055 Insufficient input validation leading to memory overread
CVSS 9.8 criticalKEV added EPSS 91.5%
CVE-2026-2370 Improper Handling of Parameters in GitLab
CVSS 8.1 highEPSS 0.45%GitLab
CVE-2026-4993 wandb OpenUI config.py hard-coded credentials
CVSS 3.3 lowEPSS 0.15%Weights & Biases
CVE-2026-4992 wandb OpenUI HTMLAnnotator server.py get_share HTML injection
CVSS 4.3 mediumEPSS 0.34%Weights & Biases
CVE-2026-33937 Handlebars.js has JavaScript Injection via AST Type Confusion
CVSS 9.8 critical1 incident
CVE-2026-27879 Query resampling can cause unbounded memory allocations
CVSS 6.5 mediumEPSS 0.39%Grafana Cloud
CVE-2026-28375 Grafana Testdata datasource can issue unbounded memory allocations
CVSS 6.5 mediumEPSS 0.39%Grafana Cloud
CVE-2026-27876 RCE on Grafana via sqlExpressions
CVSS 9.1 criticalEPSS 2.0%Grafana Cloud
CVE-2026-27880 OpenFeature evaluation API reads input data with no bounds
CVSS 7.5 highEPSS 0.79%Grafana Cloud
CVE-2026-27877 Public dashboards discloses all direct mode datasources
CVSS 6.5 mediumEPSS 0.31%Grafana Cloud
CVE-2025-53521 BigIP APM Vulnerability
CVSS 9.8 criticalKEV added EPSS 2.3%
CVE-2026-33671 Picomatch has a ReDoS vulnerability via extglob quantifiers
CVSS 7.5 highEPSS 0.42%Confluence
CVE-2026-21724 Missing Protected-field Authorization in Provisioning Contact Points API
CVSS 5.4 mediumEPSS 0.27%Grafana Cloud
CVE-2026-33375 Grafana MSSQL Data Source Plugin: Restriction Bypass Leading to OOM DoS
CVSS 6.5 mediumEPSS 0.45%Grafana Cloud
CVE-2026-3112 Arbitrary File Read via Advanced Logging Support Packet
CVSS 6.8 mediumEPSS 0.44%Mattermost
- CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (opens in new tab)
- This product uses data from the NVD API but is not endorsed or certified by the NVD. (opens in new tab)
- Known Exploited Vulnerabilities catalog from CISA. (opens in new tab)
- EPSS scores from FIRST (Exploit Prediction Scoring System). (opens in new tab)