CVE Tools
Track your stack

Core

166 CVEs tracked. 2 of them are in CISA KEV.

This hub aggregates every CVE we track for Core, a product in the operating systems space. Use it to gauge the current risk picture and drill into individual advisories.

Core CVEs per month

Nov 2024 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
Core CVEs per month
MonthCVEs
2024-110
2024-120
2025-010
2025-021
2025-031
2025-043
2025-050
2025-060
2025-070
2025-080
2025-091
2025-103
2025-110
2025-120
2026-011
2026-024
2026-0317
2026-045
2026-0514
2026-064
2026-074
2026-089
2026-0943
2026-1012

Severity

How the 166 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical2012%
  • High7043%
  • Medium6842%
  • Low32%

Latest CVEs

The 15 most recently published vulnerabilities affecting Core.

  1. CVE-2026-71490OPNsense: Direct comma-separated user privileges bypass OPNsense MVC read-only write protection7.1
  2. CVE-2026-63442OPNsense: Log Forgery via Login Username CRLF in WebGUI Authentication → Pf Table IP Blocking8.1
  3. CVE-2026-58390OPNsense: Stored XSS to root RCE via OpenVPN client common_name in status views8.0
  4. CVE-2026-58394OPNsense: Stored XSS in Administration Settings via Certificate Description5.2
  5. CVE-2026-58392OPNsense: Stored XSS in Services: NTP GPS5.4
  6. CVE-2026-58395OPNsense: XPath injection in MVC safe-delete4.3
  7. CVE-2026-58393OPNsense: OpenVPN Client Specific Override common_name allows path traversal in generated CSO files5.9
  8. CVE-2026-57155OPNsense: Root RCE via Arbitrary File Write in GeoIP Alias Importer9.9
  9. CVE-2026-58391OPNsense: Stored XSS in Firewall Rules/NAT pages via a HTML-attribute breakout5.4
  10. CVE-2026-53582OPNsense: XPATH Injection can disclose any secret in config.xml7.1
  11. CVE-2026-108725Cheshire Cat AI core through 2.0.23 Stored XSS via uploads plugin5.4
  12. CVE-2026-103922Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path9.3
  13. CVE-2026-102107Kiteworks Core user impersonation in a file-request feature4.6
  14. CVE-2026-102110Missing authentication on a Kiteworks appliance setup function5.9
  15. CVE-2026-102111Kiteworks Core Improper Validation of Specified Quantity in Input4.9

Product grouping is registry-driven, with AI assist and human review. How it works