RewindexCVEs
CVEs
5,657 vulnerabilities, 1,762 of them in CISA’s Known Exploited Vulnerabilities catalog, newest first.
CVEs mapped to a company Rewindex tracks (by CVE affected-product data, NVD CPE, vendor advisories and package feeds), every entry in CISA’s Known Exploited Vulnerabilities catalog, and CVEs named in a tracked status incident. Other CVEs are not listed.
Dates are the CVE publish date (or the KEV date added). Times are shown in UTC.
Each column is one week (Monday start, UTC), stacked by CVSS severity, by published date or the KEV date added. Dots mark entries added to CISA KEV that week. The last week is still in progress.
CVE-2025-30221 Pitchfork HTTP Request/Response Splitting vulnerability
CVSS 4.3 mediumEPSS 0.29%Shopify
CVE-2025-2867 Improper Control of Generation of Code ('Code Injection') in GitLab
CVSS 4.4 mediumEPSS 0.22%GitLab
CVE-2025-2242 Incorrect Authorization in GitLab
CVSS 7.5 highEPSS 0.42%GitLab
CVE-2025-2783 Google Chromium Mojo Sandbox Escape Vulnerability
CVSS 8.3 highKEV added EPSS 9.2%
CVE-2025-20231 Sensitive Information Disclosure in Splunk Secure Gateway App
CVSS 7.1 highEPSS 0.53%Splunk
CVE-2019-9875 Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability
CVSS 8.8 highKEV added EPSS 25.4%
CVE-2019-9874 Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability
CVSS 9.8 criticalKEV added EPSS 83.7%
CVE-2025-1558 Denial of Service Via Malicious GIF
CVSS 6.5 mediumEPSS 0.38%Mattermost
CVE-2025-30154 Multiple Reviewdog actions were compromised during a specific time period
CVSS 8.6 highKEV added EPSS 2.5%
CVE-2025-29927 Authorization Bypass in Next.js Middleware
CVSS 9.1 criticalEPSS 99.2%Vercel
CVE-2025-25068 Bypassing MFA Enforcement on Plugin Endpoints
CVSS 7.5 highEPSS 0.34%Mattermost
CVE-2025-24920 Unauthorized Bookmark Creation and Modification in Archived Channels
CVSS 4.3 mediumEPSS 0.24%Mattermost
CVE-2025-30179 MFA Enforcement Bypass in Search APIs
CVSS 4.3 mediumEPSS 0.32%Mattermost
CVE-2025-25274 Unauthorized Command Execution in Archived Channels
CVSS 4.3 mediumEPSS 0.38%Mattermost
CVE-2025-27933 Unauthorized Private-to-Public Channel Conversion
CVSS 5.4 mediumEPSS 0.21%Mattermost
CVE-2025-0508 MD5 Hash Collision in SageMaker Workflow in aws/sagemaker-python-sdk
CVSS 5.9 mediumEPSS 0.26%Amazon Web Services
CVE-2024-12720 Regular Expression Denial of Service (ReDoS) in huggingface/transformers
CVSS 5.3 mediumEPSS 0.75%Hugging Face
CVE-2025-0192 Stored Cross-site Scripting (XSS) in wandb/openui
CVSS 5.4 mediumEPSS 0.31%Weights & Biases
CVE-2024-8020 Denial of Service in lightning-ai/pytorch-lightning
CVSS 7.5 highEPSS 0.64%Lightning AI
CVE-2024-8019 Arbitrary File Write/Overwrite in lightning-ai/pytorch-lightning
CVSS 9.1 criticalEPSS 1.1%Lightning AI
CVE-2025-1472 Unauthorized View Access to Site Statistics and Team Statistics
CVSS 4.3 mediumEPSS 0.25%Mattermost
CVE-2025-1316 Edimax IC-7100 IP Camera OS Command Injection
CVSS 9.8 criticalKEV added EPSS 74.5%
CVE-2024-48248 NAKIVO Backup and Replication Absolute Path Traversal Vulnerability
CVSS 8.6 highKEV added EPSS 94.4%
CVE-2017-12637 SAP NetWeaver Directory Traversal Vulnerability
CVSS 7.5 highKEV added EPSS 95.1%
CVE-2025-0755 MongoDB C Driver bson library may be susceptible to buffer overflow
CVSS 8.4 highEPSS 0.79%MongoDB Atlas
CVE-2025-30066 tj-actions/changed-files GitHub Action Embedded Malicious Code Vulnerability
CVSS 8.6 highKEV added EPSS 72.1%
CVE-2025-24472 Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability
CVSS 8.1 highKEV added EPSS 7.2%
CVSS 7.5 highEPSS 15.1%Confluence
CVE-2025-0495 Secrets leakage to telemetry endpoint via cache backend configuration via buildx
CVSS 4.1 mediumEPSS 0.20%Docker
CVE-2025-1398 macOS TCC Bypass via Code Injection
CVSS 3.3 lowEPSS 0.17%Mattermost
CVSS 5.4 mediumEPSS 0.24%Akamai
CVSS 7.8 highEPSS 0.36%GitLab
CVSS 7.8 highEPSS 0.36%GitLab
CVE-2025-27496 Snowflake JDBC Driver client-side encryption key in DEBUG logs
CVSS 3.3 lowEPSS 0.12%Snowflake
- CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (opens in new tab)
- This product uses data from the NVD API but is not endorsed or certified by the NVD. (opens in new tab)
- Known Exploited Vulnerabilities catalog from CISA. (opens in new tab)
- EPSS scores from FIRST (Exploit Prediction Scoring System). (opens in new tab)