RewindexCVEs
CVEs
5,605 vulnerabilities, 1,756 of them in CISA’s Known Exploited Vulnerabilities catalog, newest first.
CVEs mapped to a company Rewindex tracks (by CVE affected-product data, NVD CPE, vendor advisories and package feeds), every entry in CISA’s Known Exploited Vulnerabilities catalog, and CVEs named in a tracked status incident. Other CVEs are not listed.
Dates are the CVE publish date (or the KEV date added). Times are shown in UTC.
Each column is one week (Monday start, UTC), stacked by CVSS severity, by published date or the KEV date added. Dots mark entries added to CISA KEV that week. The last week is still in progress.
CVE-2026-93321 Malformed LLB file operation can crash buildkitd
CVSS 6.9 mediumEPSS 0.16%Docker
CVE-2026-93315 BuildKit proxy CA cleanup can be disrupted by build steps
CVSS 5.8 mediumEPSS 0.10%Docker
CVE-2026-93326 Crafted Git build source can bypass certain policy validation
CVSS 6.0 mediumEPSS 0.25%Docker
CVE-2026-93323 Oversized Dockerfile or .dockerignore can exhaust buildkitd memory
CVSS 6.8 mediumEPSS 0.11%Docker
CVE-2026-93322 Malformed MergeOp can crash the BuildKit daemon
CVSS 6.9 mediumEPSS 0.12%Docker
CVE-2026-93320 BuildKit improperly handles special files in build snapshots
CVSS 6.0 mediumEPSS 0.11%Docker
CVE-2026-93319 A malicious frontend can cause a daemon panic
CVSS 5.7 mediumEPSS 0.09%Docker
CVE-2026-93318 Cache poisoning via unvalidated image layer DiffIDs
CVSS 7.5 highEPSS 0.17%Docker
CVE-2026-93317 Container blob cache can accept unverified content
CVSS 5.9 mediumEPSS 0.16%Docker
CVE-2026-89039 Arbitrary file read via the convert_playwright_script prompt in mcp-k6
CVSS 6.5 mediumEPSS 0.38%Grafana Cloud
CVE-2026-88779 Memory overflow vulnerability leading to Denial of Service
CVSS 7.5 highKEV added EPSS 11.4%
CVSS 5.8 mediumEPSS 0.22%Zilliz
CVSS 4.0 mediumEPSS 0.23%Zilliz
CVE-2026-103956 Missing authentication for critical function in Loom for AWS
CVSS 10.0 criticalEPSS 2.5%Amazon Web Services
CVE-2026-94483 Next.js: Server-Side Request Forgery in Image Optimization
CVSS 6.5 mediumEPSS 0.33%Vercel
CVE-2026-94543 Next.js: Cache poisoning of SSG and ISR pages in self-hosted Next.js applications
CVSS 5.3 mediumEPSS 0.51%Vercel
CVE-2026-90970 Improper Neutralization of Special Elements Used in a Template Engine in GitLab AI Gateway
CVSS 9.9 criticalEPSS 17.5%GitLab
CVE-2026-102490 Local privilege escalation in Zammad v1.5.0 to v7.2.2 installed via DEB or RPM package
CVSS 7.8 highKEV added EPSS 0.86%
CVE-2026-102489 Undisclosed RCE in Zammad v6.3 and higher
CVSS 9.8 criticalKEV added EPSS 2.0%
CVE-2026-104020 Uncontrolled recursion in the Ion reader in Amazon Ion Python
CVSS 7.5 highEPSS 0.44%Amazon Web Services
CVE-2026-104286 Fortinet FortiMail Path Traversal Vulnerability
CVSS 9.8 criticalKEV added EPSS 4.6%
CVE-2026-15911 Confluent Kafka Python Improper TLS Certificate Validation
CVSS 7.4 highEPSS 0.30%Confluent
CVE-2026-103505 AWS EFS CSI Driver Mount Option Injection via mounttargetipmap
CVSS 6.5 mediumEPSS 0.43%Amazon Web Services
CVE-2026-103004 next.js cache leak on warm `use cache` handlers accessing root param
CVSS 5.3 mediumEPSS 0.25%Vercel
CVE-2026-94545 Satori-generated SVG has improper escaping
CVSS 5.3 mediumEPSS 1.1%Vercel
CVE-2026-76504 Cisco Catalyst SD-WAN Manager System Account Authorization Bypass Vulnerability
CVSS 9.8 criticalKEV added EPSS 38.9%
CVSS 2.0 lowEPSS 0.10%Anthropic
- CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (opens in new tab)
- This product uses data from the NVD API but is not endorsed or certified by the NVD. (opens in new tab)
- Known Exploited Vulnerabilities catalog from CISA. (opens in new tab)
- EPSS scores from FIRST (Exploit Prediction Scoring System). (opens in new tab)