57.924 CVE tracked
784 Exploited now
188 Used by ransomware
Last sync
CVE Tracker
57.924 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sorted descending | Product and flaw | EPSS, sort descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2026-22828 | HIGH 8.1 | fortinet fortianalyzer_cloud A heap-based buffer overflow vulnerability in Fortinet FortiAnalyzer Cloud 7.6.2 through 7.6.4, FortiManager Cloud 7.6.2 through 7.6.4 may allow a remote unauthenticated attacker to execute arbitrary code or commands via specifically crafted requests. Successf | 0.9% | — |
| CVE-2026-22719 | HIGH 8.1 | vmware aria_operations VMware Aria Operations contains a command injection vulnerability. A malicious unauthenticated actor may exploit this issue to execute arbitrary commands which may lead to remote code execution in VMware Aria Operations while support-assisted product migration | 17.4% | |
| CVE-2026-22153 | HIGH 8.1 | fortinet fortios An Authentication Bypass by Primary Weakness vulnerability [CWE-305] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4 may allow an unauthenticated attacker to bypass LDAP authentication of Agentless VPN or FSSO policy, when the remote LDAP server is confi | 0.7% | — |
| CVE-2026-21228 | HIGH 8.1 | microsoft azure_local Improper certificate validation in Azure Local allows an unauthorized attacker to execute code over a network. | 0.8% | — |
| CVE-2026-20916 | HIGH 8.1 | f5 big-iq_centralized_management An authenticated iControl REST user with low privileges can create or modify arbitrary files through an undisclosed iControl REST endpoint on the BIG-IQ system. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. | 0.4% | — |
| CVE-2026-20856 | HIGH 8.1 | microsoft windows_10_1607 Improper input validation in Windows Server Update Service allows an unauthorized attacker to execute code over a network. | 1.1% | — |
| CVE-2026-20335 | HIGH 8.1 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Adaptive Security Appliance Software, Cisco Secure Firewall Threat Defense Software and Cisco Secure Firewall Management Center Software engineering team has cond | — | — |
| CVE-2026-20156 | HIGH 8.1 | cisco roomos As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco RoomOS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally d | 0.3% | — |
| CVE-2026-20002 | HIGH 8.1 | cisco secure_firewall_management_center A vulnerability in the web-based management interface of Cisco Secure FMC Software could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. This vulnerability is due to inadequate validation of user-supplied inpu | 0.3% | — |
| CVE-2026-19303 | HIGH 8.1 | langflow langflow IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to delete arbitrary local files or directories due to improper limitation of a pathname to a restricted directory. | 0.4% | — |
| CVE-2026-15371 | HIGH 8.1 | Velociraptor's web GUI allows specifying a custom type for columns in tables. The URL type takes the cell value and forms a URL which can be clicked in the GUI.The code does not limit the schemes allowed in this URL , allowing an attacker to specify a JavaScri | 0.2% | — |
| CVE-2026-14122 | HIGH 8.1 | google chrome Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: Low) | 0.3% | — |
| CVE-2026-14111 | HIGH 8.1 | google chrome Use after free in WebProtect in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code via a crafted Chrome Extension. (Chromium security severity: Low) | 0.4% | — |
| CVE-2026-13799 | HIGH 8.1 | google chrome Use after free in QUIC in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to potentially exploit heap corruption via malicious network traffic. (Chromium security severity: High) | 0.3% | — |
| CVE-2026-13791 | HIGH 8.1 | google chrome Insufficient validation of untrusted input in Downloads in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code via a crafted Chrome Extension. (Chromium security severity: Hig | 0.3% | — |
| CVE-2026-13787 | HIGH 8.1 | google chrome Use after free in Chromoting in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code via malicious network traffic. (Chromium security severity: Critical) | 0.4% | — |
| CVE-2026-13774 | HIGH 8.1 | google chrome Use after free in Extensions in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code via a crafted Chrome Extension. (Chromium security severity: Critical) | 0.3% | — |
| CVE-2026-13473 | HIGH 8.1 | ibm storage_protect IBM Storage Protect Client 8.1.0.0 through 8.1.27.0, 8.1.27.1, and 8.2.0.0 through 8.2.1.0 IBM Storage Protect is vulnerable to a heap-based buffer overflow, caused by improper bounds checking. A remote attacker could overflow a buffer and execute arbitrary co | 0.5% | — |
| CVE-2026-13448 | HIGH 8.1 | langflow langflow IBM Langflow OSS 1.0.0 through 1.10.1 Lanflow OSS contains an unauthenticated remote code execution vulnerability in the public flow build endpoint ( /api/v1/build_public_tmp/{flow_id}/flow ). The vulnerability stems from an incomplete denylist in the validate | 0.7% | — |
| CVE-2026-13445 | HIGH 8.1 | langflow langflow IBM Langflow OSS 1.0.0 through 1.10.1 can allow an authenticated attacker to exploit the SaveToFile component to read and modify another user's uploaded files by specifying absolute paths pointing to victim storage locations. In append mode, the attacker's wor | 0.4% | — |
| CVE-2026-13020 | HIGH 8.1 | esri portal_for_arcgis A Weak Password Recovery Mechanism for Forgotten Password exists in Esri Portal for ArcGIS versions 12.1 and earlier on Windows, Linux and Kubernetes. A remote, unauthorized attacker may assume ownership of a user’s account by manipulating this mechanism. ArcG | 0.3% | — |
| CVE-2026-12012 | HIGH 8.1 | google chrome Use after free in Network in Google Chrome prior to 149.0.7827.115 allowed an attacker in a privileged network position to potentially exploit heap corruption via malicious network traffic. (Chromium security severity: High) | 0.2% | — |
| CVE-2026-11693 | HIGH 8.1 | google chrome Inappropriate implementation in Plugins in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: High) | 0.2% | — |
| CVE-2026-11689 | HIGH 8.1 | google chrome Insufficient policy enforcement in Passwords in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: High) | 0.2% | — |
| CVE-2026-11643 | HIGH 8.1 | google chrome Use after free in Proxy in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code via malicious network traffic. (Chromium security severity: Critical) | 0.3% | — |