RewindexCVEs
CVEs
5,606 vulnerabilities, 1,756 of them in CISA’s Known Exploited Vulnerabilities catalog, newest first.
CVEs mapped to a company Rewindex tracks (by CVE affected-product data, NVD CPE, vendor advisories and package feeds), every entry in CISA’s Known Exploited Vulnerabilities catalog, and CVEs named in a tracked status incident. Other CVEs are not listed.
Dates are the CVE publish date (or the KEV date added). Times are shown in UTC.
Each column is one week (Monday start, UTC), stacked by CVSS severity, by published date or the KEV date added. Dots mark entries added to CISA KEV that week. The last week is still in progress.
CVE-2026-26004 Sentry allows unauthorized access to event data across organizational boundaries
CVSS 6.5 mediumEPSS 0.25%Sentry
CVE-2026-4295 Arbitrary code execution via crafted project files in Kiro IDE
CVSS 7.8 highEPSS 0.22%Amazon Web Services
CVE-2026-4358 Memory safety issues in slot-based execution hash table spill
CVSS 6.4 mediumEPSS 0.36%MongoDB Atlas
CVSS 7.8 highEPSS 0.28%Canva
CVSS 6.1 mediumEPSS 0.28%Canva
CVSS 6.1 mediumEPSS 0.28%Canva
CVSS 6.1 mediumEPSS 0.28%Canva
CVSS 6.1 mediumEPSS 0.28%Canva
CVSS 7.8 highEPSS 0.27%Canva
CVSS 6.1 mediumEPSS 0.29%Canva
CVSS 6.1 mediumEPSS 0.28%Canva
CVSS 6.1 mediumEPSS 0.28%Canva
CVSS 6.1 mediumEPSS 0.28%Canva
CVSS 6.1 mediumEPSS 0.28%Canva
CVSS 6.1 mediumEPSS 0.28%Canva
CVSS 6.1 mediumEPSS 0.28%Canva
CVSS 6.1 mediumEPSS 0.28%Canva
CVSS 6.1 mediumEPSS 0.28%Canva
CVSS 6.1 mediumEPSS 0.28%Canva
CVSS 6.1 mediumEPSS 0.28%Canva
CVSS 6.1 mediumEPSS 0.28%Canva
CVSS 6.1 mediumEPSS 0.28%Canva
CVE-2026-4147 Stack memory disclosure in filemd5 command
CVSS 6.5 mediumEPSS 0.22%MongoDB Atlas
CVE-2026-1629 Permalink Preview Information Disclosure After Permission Revocation
CVSS 4.3 mediumEPSS 0.23%Mattermost
CVE-2026-26230 Team Admin Privilege Escalation to Demote Members to Guest
CVSS 3.8 lowEPSS 0.16%Mattermost
CVE-2026-2454 DoS in Calls plugin via malformed msgpack in websocket request.
CVSS 5.8 mediumEPSS 0.29%Mattermost
CVE-2026-26304 Permission Bypass in Playbook Run Creation
CVSS 4.3 mediumEPSS 0.16%Mattermost
CVE-2026-4270 AWS API MCP File Access Restriction Bypass
CVSS 5.5 mediumEPSS 0.13%Amazon Web Services
CVE-2026-24692 Guest users can bypass read permissions via search API
CVSS 4.3 mediumEPSS 0.17%Mattermost
CVE-2026-22545 Password Change Bypass via Auth Switch Endpoint
CVSS 3.1 lowEPSS 0.15%Mattermost
CVE-2026-2455 SSRF bypass via IPv4-mapped IPv6 literals
CVSS 4.3 mediumEPSS 0.17%Mattermost
CVE-2026-21386 Private channel enumeration via /mute slash command
CVSS 4.3 mediumEPSS 0.19%Mattermost
CVE-2026-25780 Memory Exhaustion via Malformed DOC File Upload
CVSS 4.3 mediumEPSS 0.28%Mattermost
CVE-2026-4265 Guest user can upload files without permission across teams
CVSS 4.3 mediumEPSS 0.23%Mattermost
CVE-2026-25783 Denial of service via malformed User-Agent header in getBrowserVersion
CVSS 4.3 mediumEPSS 0.30%Mattermost
CVE-2026-24458 DoS attack via login attempts with multi-megabyte passwords
CVSS 7.5 highEPSS 0.28%Mattermost
CVE-2026-2462 Admin RCE via Malicious Plugin Upload on CI Test Instances
CVSS 6.6 mediumEPSS 0.34%Mattermost
CVE-2026-26246 Memory Exhaustion via Malformed PSD File Upload
CVSS 4.3 mediumEPSS 0.22%Mattermost
CVE-2026-2458 Unauthorized channel enumeration in private teams after member removal
CVSS 4.3 mediumEPSS 0.17%Mattermost
CVE-2026-2457 WebSocket Message Spoofing via Permalink Embed Manipulation
CVSS 4.3 mediumEPSS 0.11%Mattermost
CVE-2026-2463 Unauthorized access to invite ID during team creation
CVSS 4.3 mediumEPSS 0.17%Mattermost
CVE-2026-2456 Denial of Service via Unbounded Memory Allocation in Integration Actions
CVSS 5.3 mediumEPSS 0.17%Mattermost
CVE-2025-47813 Wing FTP Server Information Disclosure Vulnerability
CVSS 4.3 mediumKEV added EPSS 62.5%
CVE-2026-26133 M365 Copilot Information Disclosure Vulnerability
CVSS 7.1 highEPSS 0.44%Microsoft TeamsPower BI
- CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (opens in new tab)
- This product uses data from the NVD API but is not endorsed or certified by the NVD. (opens in new tab)
- Known Exploited Vulnerabilities catalog from CISA. (opens in new tab)
- EPSS scores from FIRST (Exploit Prediction Scoring System). (opens in new tab)