RewindexCVEs
CVEs
923 matching vulnerabilities, 615 of them in CISA’s Known Exploited Vulnerabilities catalog, newest first.
CVEs mapped to a company Rewindex tracks (by CVE affected-product data, NVD CPE, vendor advisories and package feeds), every entry in CISA’s Known Exploited Vulnerabilities catalog, and CVEs named in a tracked status incident. Other CVEs are not listed.
Dates are the CVE publish date (or the KEV date added). Times are shown in UTC.
Each column is one week (Monday start, UTC), stacked by CVSS severity, by published date or the KEV date added. Dots mark entries added to CISA KEV that week. The last week is still in progress.
CVSS 9.6 criticalEPSS 0.33%Zoom
CVE-2025-68613 n8n Vulnerable to Remote Code Execution via Expression Injection
CVSS 10.0 criticalKEV added EPSS 99.0%n8n
CVE-2025-26399 SolarWinds Web Help Desk Deserialization of Untrusted Data Privilege Escalation Vulnerability
CVSS 9.8 criticalKEV added EPSS 90.1%
CVE-2021-22681 Rockwell Multiple Products Insufficient Protected Credentials Vulnerability
CVSS 9.8 criticalKEV added EPSS 63.6%
CVE-2017-7921 Hikvision Multiple Products Improper Authentication Vulnerability
CVSS 9.8 criticalKEV added EPSS 100.0%
CVE-2026-2835 HTTP Request Smuggling via HTTP/1.0 and Transfer-Encoding Misparsing
CVSS 9.1 criticalEPSS 0.82%Cloudflare
CVE-2026-2833 HTTP Request Smuggling via Premature Upgrade
CVSS 9.1 criticalEPSS 0.69%Cloudflare
CVE-2026-3136 Google Cloud Build Comment Control Bypass
CVSS 9.8 criticalEPSS 0.37%Google Cloud
CVE-2026-20127 Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability
CVSS 10.0 criticalKEV added EPSS 89.3%
CVE-2026-27606 Rollup 4 has Arbitrary File Write via Path Traversal
CVSS 9.1 criticalEPSS 1.7%Jira
CVE-2026-1229 Incorrect calculation in CIRCL secp384r1 CombinedMult
CVSS 9.8 criticalEPSS 0.43%Cloudflare
CVE-2026-27197 Sentry: Improper Authentication on SAML SSO process allows user identity linking
CVSS 9.1 criticalEPSS 0.49%Sentry
CVE-2025-49113 RoundCube Webmail Deserialization of Untrusted Data Vulnerability
CVSS 9.9 criticalKEV added EPSS 99.7%
CVE-2026-22769 Dell RecoverPoint for Virtual Machines (RP4VMs) Use of Hard-coded Credentials Vulnerability
CVSS 10.0 criticalKEV added EPSS 13.5%
CVE-2020-7796 Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery Vulnerability
CVSS 9.8 criticalKEV added EPSS 93.6%
CVE-2026-1731 Remote code execution vulnerability in BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA)
CVSS 9.8 criticalKEV added EPSS 93.1%
CVE-2024-43468 Microsoft Configuration Manager Remote Code Execution Vulnerability
CVSS 9.8 criticalKEV added EPSS 81.0%
CVE-2026-21531 Azure SDK for Python Remote Code Execution Vulnerability
CVSS 9.8 criticalEPSS 2.6%Microsoft Azure
CVE-2026-1868 Improper Neutralization of Special Elements Used in a Template Engine in GitLab AI Gateway
CVSS 9.9 criticalEPSS 0.71%GitLab
CVE-2026-1727 Information Disclosure via Bucket Squatting in Google Cloud Agentspace.
CVSS 9.1 criticalEPSS 0.29%Google Cloud
CVE-2026-24300 Azure Front Door Elevation of Privilege Vulnerability
CVSS 9.8 criticalEPSS 1.2%Microsoft Azure
CVE-2026-24423 SmarterTools SmarterMail < Build 9511 Unauthenticated RCE via ConnectToHub API
CVSS 9.8 criticalKEV added EPSS 88.2%
CVE-2025-11953 Command injection in React Native Community CLI allows remote attackers to perform remote code execution by sending HTTP requests
CVSS 9.8 criticalKEV added EPSS 94.0%
CVE-2026-25547 Uncontrolled Resource Consumption in @isaacs/brace-expansion
CVSS 9.2 criticalEPSS 0.55%Jira
CVE-2026-25526 JinJava Bypass through ForTag leads to Arbitrary Java Execution
CVSS 9.8 criticalEPSS 0.98%HubSpot
CVE-2025-40551 SolarWinds Web Help Desk Deserialization of Untrusted Data Remote Code Execution Vulnerability
CVSS 9.8 criticalKEV added EPSS 84.2%
CVE-2019-19006 Sangoma FreePBX Improper Authentication Vulnerability
CVSS 9.8 criticalKEV added EPSS 55.9%
CVE-2026-1281 Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability
CVSS 9.8 criticalKEV added EPSS 98.7%
CVE-2026-24858 Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability
CVSS 9.4 criticalKEV added EPSS 86.6%
CVE-2026-24061 GNU InetUtils Argument Injection Vulnerability
CVSS 9.8 criticalKEV added EPSS 99.0%
CVE-2026-23760 SmarterTools SmarterMail < Build 9511 Authentication Bypass via Password Reset API
CVSS 9.8 criticalKEV added EPSS 96.4%
CVE-2025-52691 Upload Arbitrary Files
CVSS 10.0 criticalKEV added EPSS 85.7%
CVSS 9.8 criticalEPSS 0.65%Salesforce
CVSS 9.8 criticalEPSS 0.65%Salesforce
CVSS 9.8 criticalEPSS 0.60%Salesforce
CVSS 9.8 criticalEPSS 0.43%Salesforce
CVE-2024-37079 Broadcom VMware vCenter Server Out-of-bounds Write Vulnerability
CVSS 9.8 criticalKEV added EPSS 22.4%
CVE-2026-24304 Azure Resource Manager Elevation of Privilege Vulnerability
CVSS 9.9 criticalEPSS 0.67%Microsoft Azure
CVE-2026-24306 Azure Front Door Elevation of Privilege Vulnerability
CVSS 9.8 criticalEPSS 0.85%Microsoft Azure
CVE-2021-47748 Hasura GraphQL 1.3.3 - Remote Code Execution
CVSS 9.8 criticalEPSS 1.1%Hasura
CVE-2026-0933 OS Command Injection in `wrangler pages deploy`
CVSS 9.9 criticalEPSS 1.5%Cloudflare
CVE-2026-22844 Zoom Node Deployments - Command Injection
CVSS 9.9 criticalEPSS 13.5%Zoom
CVE-2026-22708 Cursor has a Terminal Tool Allowlist Bypass via Environment Variables
CVSS 9.8 criticalEPSS 0.82%Cursor
CVE-2026-22871 GuardDog Path Traversal Vulnerability Leads to Arbitrary File Overwrite and RCE
CVSS 9.8 criticalEPSS 1.1%Datadog
CVSS 9.8 criticalEPSS 0.44%Salesforce
CVE-2025-37164 Hewlett Packard Enterprise (HPE) OneView Code Injection Vulnerability
CVSS 10.0 criticalKEV added EPSS 90.2%
CVE-2025-14733 WatchGuard Firebox iked Out of Bounds Write Vulnerability
CVSS 9.8 criticalKEV added EPSS 29.4%
- CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (opens in new tab)
- This product uses data from the NVD API but is not endorsed or certified by the NVD. (opens in new tab)
- Known Exploited Vulnerabilities catalog from CISA. (opens in new tab)
- EPSS scores from FIRST (Exploit Prediction Scoring System). (opens in new tab)