RewindexCVEs
CVEs
5,606 vulnerabilities, 1,756 of them in CISA’s Known Exploited Vulnerabilities catalog, newest first.
CVEs mapped to a company Rewindex tracks (by CVE affected-product data, NVD CPE, vendor advisories and package feeds), every entry in CISA’s Known Exploited Vulnerabilities catalog, and CVEs named in a tracked status incident. Other CVEs are not listed.
Dates are the CVE publish date (or the KEV date added). Times are shown in UTC.
Each column is one week (Monday start, UTC), stacked by CVSS severity, by published date or the KEV date added. Dots mark entries added to CISA KEV that week. The last week is still in progress.
CVE-2026-3109 Missing timestamp validation in Zoom webhook handler
CVSS 2.2 lowEPSS 0.30%Mattermost
CVE-2026-3115 Guest users can view group member IDs without respecting view restrictions
CVSS 4.3 mediumEPSS 0.24%Mattermost
CVE-2026-3114 Zip Bomb Denial of Service via Unrestricted Archive Decompression
CVSS 6.5 mediumEPSS 0.36%Mattermost
CVE-2026-3116 Improper Input Validation in Zoom Plugin Webhook Handler
CVSS 4.9 mediumEPSS 0.36%Mattermost
CVE-2026-3108 Terminal Escape Injection in mmctl Report Posts Command
CVSS 8.0 highEPSS 0.28%Mattermost
CVE-2026-33634 Trivy ecosystem supply chain briefly compromised
CVSS 8.8 highKEV added EPSS 59.7%
CVE-2025-13078 Improper Validation of Specified Quantity in Input in GitLab
CVSS 6.5 mediumEPSS 0.42%GitLab
CVE-2025-13436 Allocation of Resources Without Limits or Throttling in GitLab
CVSS 6.5 mediumEPSS 0.42%GitLab
CVE-2025-14595 Missing Authorization in GitLab
CVSS 4.3 mediumEPSS 0.26%GitLab
CVE-2026-1724 Missing Authentication for Critical Function in GitLab
CVSS 6.8 mediumEPSS 0.47%GitLab
CVE-2026-2745 Authentication Bypass Using an Alternate Path or Channel in GitLab
CVSS 6.8 mediumEPSS 0.35%GitLab
CVE-2026-2726 Incorrect Authorization in GitLab
CVSS 4.3 mediumEPSS 0.20%GitLab
CVE-2026-3857 Cross-Site Request Forgery (CSRF) in GitLab
CVSS 8.1 highEPSS 0.22%GitLab
CVE-2026-3988 Inefficient Algorithmic Complexity in GitLab
CVSS 7.5 highEPSS 0.49%GitLab
CVE-2026-27659 CSRF vulnerability in UpdateAccessControlPolicyActiveStatus endpoint
CVSS 4.6 mediumEPSS 0.12%Mattermost
CVE-2026-20719 DoS via URL Previews Rendering Malicious SVGs
CVSS 4.3 mediumEPSS 0.36%Mattermost
CVE-2026-27656 Account Takeover via Substring Matching in OpenID Connect Authentication
CVSS 5.7 mediumEPSS 0.18%Mattermost
CVE-2026-26233 Denial of Service via HTTP/2 single packet attack on login endpoint
CVSS 4.3 mediumEPSS 0.31%Mattermost
CVE-2026-4363 Incorrect Authorization in GitLab
CVSS 3.7 lowEPSS 0.12%GitLab
CVE-2026-33017 Langflow has Unauthenticated Remote Code Execution via Public Flow Build Endpoint
CVSS 9.8 criticalKEV added EPSS 96.2%
CVSS 9.4 criticalEPSS 0.43%Salesforce
CVE-2026-28809 XXE in esaml SAML library allows local file read and potential SSRF
CVSS 5.3 mediumEPSS 0.29%Dropbox
CVE-2025-54068 Livewire vulnerable to remote command execution during property update hydration
CVSS 9.8 criticalKEV added EPSS 96.3%
CVE-2025-43520 Apple Multiple Products Classic Buffer Overflow Vulnerability
CVSS 5.5 mediumKEV added EPSS 0.43%
CVE-2025-43510 Apple Multiple Products Improper Locking Vulnerability
CVSS 7.8 highKEV added EPSS 0.36%
CVE-2025-32432 Craft CMS Allows Remote Code Execution
CVSS 10.0 criticalKEV added EPSS 99.8%
CVE-2025-31277 Apple Multiple Products Buffer Overflow Vulnerability
CVSS 8.8 highKEV added EPSS 1.7%
CVE-2026-22732 Under Some Conditions Spring Security HTTP Headers Are not Written
CVSS 9.1 criticalEPSS 0.49%Jira
CVE-2026-22731 Authentication Bypass under Actuator Health groups paths
CVSS 8.2 highEPSS 0.34%Bitbucket
CVE-2026-23659 Azure Data Factory Information Disclosure Vulnerability
CVSS 8.6 highEPSS 0.82%Microsoft Azure
CVE-2026-23658 Azure DevOps: msazure Elevation of Privilege Vulnerability
CVSS 8.6 highEPSS 0.81%Microsoft Azure
CVE-2026-32169 Azure Cloud Shell Elevation of Privilege Vulnerability
CVSS 10.0 criticalEPSS 0.57%Microsoft Azure
CVE-2026-4428 CRL Distribution Point Scope Check Logic Error in AWS-LC
CVSS 7.4 highEPSS 0.26%Amazon Web Services
CVE-2026-26933 Improper Validation of Array Index in Packetbeat Leading to Denial of Service
CVSS 5.7 mediumEPSS 0.25%Elastic Cloud
CVE-2026-20131 Cisco Secure Firewall Management Center Software Remote Code Execution Vulnerability
CVSS 10.0 criticalKEV added EPSS 43.2%
CVE-2026-20963 Microsoft SharePoint Remote Code Execution Vulnerability
CVSS 9.8 criticalKEV added EPSS 29.2%
CVE-2025-66376 Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting Vulnerability
CVSS 7.2 highKEV added EPSS 20.2%
CVE-2026-29057 Next.js: HTTP request smuggling in rewrites
CVSS 6.5 mediumEPSS 0.45%Vercel
CVE-2026-27980 Next.js: Unbounded next/image disk cache growth can exhaust storage
CVSS 7.5 highEPSS 0.71%Vercel
CVE-2026-27979 Next.js: Unbounded postponed resume buffering can lead to DoS
CVSS 7.5 highEPSS 0.69%Vercel
CVE-2026-27978 Next.js: null origin can bypass Server Actions CSRF checks
CVSS 4.3 mediumEPSS 0.21%Vercel
CVE-2026-27977 Next.js: null origin can bypass dev HMR websocket CSRF checks
CVSS 5.4 mediumEPSS 0.18%Vercel
- CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (opens in new tab)
- This product uses data from the NVD API but is not endorsed or certified by the NVD. (opens in new tab)
- Known Exploited Vulnerabilities catalog from CISA. (opens in new tab)
- EPSS scores from FIRST (Exploit Prediction Scoring System). (opens in new tab)