CVE Tools
Track your stack

Core

169 CVEs tracked. 2 of them are in CISA KEV.

This hub aggregates every CVE we track for Core, a product in the web cms plugins space. Use it to gauge the current risk picture and drill into individual advisories.

Core CVEs per month

Nov 2024 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
Core CVEs per month
MonthCVEs
2024-110
2024-120
2025-010
2025-021
2025-031
2025-043
2025-050
2025-060
2025-070
2025-080
2025-091
2025-103
2025-110
2025-120
2026-011
2026-024
2026-0317
2026-045
2026-0514
2026-064
2026-074
2026-089
2026-0943
2026-1015

Severity

How the 169 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical2012%
  • High7043%
  • Medium6943%
  • Low32%

Latest CVEs

The 15 most recently published vulnerabilities affecting Core.

  1. CVE-2026-116186OpenRemote before 1.31.0 Gateway Authorization Bypass via Reversible mapAssetId—
  2. CVE-2026-116185OpenRemote before 1.31.0 Cross-Realm Information Disclosure via getGatewayActiveTunnelInfos5.0
  3. CVE-2026-116184OpenRemote before 1.31.0 Cross-Realm Gateway Impersonation via Websocket—
  4. CVE-2026-71490OPNsense: Direct comma-separated user privileges bypass OPNsense MVC read-only write protection7.1
  5. CVE-2026-63442OPNsense: Log Forgery via Login Username CRLF in WebGUI Authentication → Pf Table IP Blocking8.1
  6. CVE-2026-58390OPNsense: Stored XSS to root RCE via OpenVPN client common_name in status views8.0
  7. CVE-2026-58394OPNsense: Stored XSS in Administration Settings via Certificate Description5.2
  8. CVE-2026-58392OPNsense: Stored XSS in Services: NTP GPS5.4
  9. CVE-2026-58395OPNsense: XPath injection in MVC safe-delete4.3
  10. CVE-2026-58393OPNsense: OpenVPN Client Specific Override common_name allows path traversal in generated CSO files5.9
  11. CVE-2026-57155OPNsense: Root RCE via Arbitrary File Write in GeoIP Alias Importer9.9
  12. CVE-2026-58391OPNsense: Stored XSS in Firewall Rules/NAT pages via a HTML-attribute breakout5.4
  13. CVE-2026-53582OPNsense: XPATH Injection can disclose any secret in config.xml7.1
  14. CVE-2026-108725Cheshire Cat AI core through 2.0.23 Stored XSS via uploads plugin5.4
  15. CVE-2026-103922Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path9.3

Product grouping is registry-driven, with AI assist and human review. How it works