CVE Tracker
Every vulnerability our newsroom covers, scored with CVSS, checked against CISA's Known Exploited Vulnerabilities list and ranked by EPSS exploit odds. Free to use, refreshed every few minutes.
Vendors
Microsoft33Cisco27Adobe15Linux13Check Point10JFrog10SonicWall8BeyondTrust7Google7SAP6Schneider Electric6Oracle5Apple4Barracuda Networks4
337 CVEs
EPSSCoverage
9.9CVSS 3.1
CVE-2026-57092
Microsoft Windows VMSwitch Elevation of Privilege Vulnerability
Microsoft · Windows 10 Version 1607
EPSS
0.91%
1 story
4 months ago
9.8CVSS 3.1
CVE-2026-55010
Minecraft Bedrock Dedicated Server Remote Code Execution Vulnerability
Microsoft · Minecraft Bedrock Dedicated Server
EPSS
0.97%
1 story
4 months ago
9.8CVSS 3.1
CVE-2026-50518
Windows DHCP Server Remote Code Execution Vulnerability
Microsoft · Windows 10 Version 1607
EPSS
0.97%
1 story
4 months ago
9.8CVSS 3.1
CVE-2026-56188
Windows Server Network driver Remote Code Execution Vulnerability
Microsoft · Windows 10 Version 1607
EPSS
0.61%
1 story
4 months ago
9.8CVSS 3.1
CVE-2026-56190
Remote Desktop Protocol Remote Code Execution Vulnerability
Microsoft · Windows 10 Version 1607
EPSS
0.97%
1 story
4 months ago
9.6CVSS 3.1
CVE-2026-55008
Microsoft Exchange Server Spoofing Vulnerability
Microsoft · Exchange Server 2016 Cumulative Update 23
EPSS
0.86%
1 story
4 months ago
6.1CVSS 3.1
CVE-2026-50661
Windows BitLocker Security Feature Bypass Vulnerability
Microsoft · Windows 10 Version 1607
EPSS
0.48%
1 story
4 months ago
10.0CVSS 4.0
CVE-2026-48939
Exploited
Joomla Extension - icagenda.com - Remote Code Execution in iCaganda extension for Joomla < 4.0.8/3.9.15
iCagenda
EPSS
20%
1 story
4 months ago
10.0CVSS 4.0
CVE-2026-56291
Exploited
Joomla Extension - balbooa.com - Unauthenticated file upload in Balbooa Forms extension < 2.4.1
Balbooa · Forms
EPSS
15%
1 story
4 months ago
7.5CVSS 3.1
CVE-2018-0171
Exploited
Cisco IOS and IOS XE Software Smart Install Remote Code Execution Vulnerability
Cisco · IOS and IOS XE
EPSS
99%
1 story
4 months ago
9.8CVSS 3.1
CVE-2026-20896
Gitea Docker image trusts spoofable reverse-proxy headers by default
Gitea · Open Source Git Server
EPSS
2.8%
3 stories
4 months ago
10.0CVSS 3.1
CVE-2025-32432
Exploited
Craft CMS Allows Remote Code Execution
Craft CMS
EPSS
100%
1 story
4 months ago
10.0CVSS 4.0
CVE-2026-48907
Exploited
Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5
Widget Factory · Joomla Content Editor
EPSS
85%
1 story
4 months ago
9.8CVSS 3.1
CVE-2025-12057
WavePlayer < 3.8.0 - Unauthenticated Arbitrary File Upload
EPSS
0.61%
1 story
4 months ago
9.8CVSS 3.1
CVE-2020-36847
Simple File List < 4.2.3 - Remote Code Execution
Eemitch · Simple File List
EPSS
59%
1 story
4 months ago
9.8CVSS 3.1
CVE-2024-9234
GutenKit <= 2.1.0 - Unauthenticated Arbitrary File Upload
Ataurr · GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor
EPSS
10%
1 story
4 months ago
9.8CVSS 3.1
CVE-2025-12352
Gravity Forms <= 2.9.20 - Unauthenticated Arbitrary File Upload via 'copy_post_image'
Gravity Forms
EPSS
1.1%
1 story
4 months ago
9.8CVSS 3.1
CVE-2025-13486
Advanced Custom Fields: Extended 0.9.0.5 - 0.9.1.1 - Unauthenticated Remote Code Execution in prepare_form
Hwk-fr · Advanced Custom Fields: Extended
EPSS
69%
1 story
4 months ago
9.8CVSS 3.1
CVE-2025-6389
Sneeit Framework <= 8.3 - Unauthenticated Remote Code Execution in sneeit_articles_pagination_callback
Sneeit · Framework
EPSS
76%
1 story
4 months ago
9.8CVSS 3.1
CVE-2025-7852
WPBookit <= 1.0.6 - Unauthenticated Arbitrary File Upload via image_upload_handle Function
Iqonicdesign · WPBookit
EPSS
1.6%
1 story
4 months ago
9.8CVSS 3.1
CVE-2026-0740
Ninja Forms - File Upload <= 3.3.26 - Unauthenticated Arbitrary File Upload
SaturdayDrive · Ninja Forms - File Uploads
EPSS
63%
1 story
4 months ago
9.8CVSS 3.1
CVE-2026-1357
Migration, Backup, Staging <= 0.9.123 - Unauthenticated Arbitrary File Upload
Wpvividplugins · WPvivid — Backup, Migration & Staging
EPSS
39%
1 story
4 months ago
9.8CVSS 3.1
CVE-2026-29014
MetInfo CMS Unauthenticated PHP Code Injection RCE
MetInfo CMS
EPSS
39%
1 story
4 months ago
9.8CVSS 3.1
CVE-2026-31843
goodoneuz/pay-uz Unauthenticated PHP File Overwrite via /payment/api/editable/update Leading to Remote Code Execution
Goodoneuz · pay-uz
EPSS
1.4%
1 story
4 months ago
9.8CVSS 3.1
CVE-2026-3844
Breeze Cache <= 2.4.4 - Unauthenticated Arbitrary File Upload via fetch_gravatar_from_remote
Cloudways · Breeze Cache
EPSS
28%
1 story
4 months ago
Scores and exploit data come from the CVE Program, NVD, CISA and FIRST.org. Each CVE links to SECBORN's reporting on it.