CVE tracker
Scroll across the table to compare exploitation and severity.
| CVE / vulnerability | Exploitation | CVSS |
|---|---|---|
| CVE-2026-41091Microsoft Defender Elevation of Privilege Vulnerability Microsoft Microsoft Malware Protection Engine Versions & vendor guidance → |
Known exploitedCISA KEV | 7.8High |
| CVE-2026-39987marimo Affected by Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass marimo-team marimo Versions & vendor guidance → |
Known exploitedCISA KEV | 9.3Critical |
| CVE-2026-39808Fortinet FortiSandbox OS Command Injection Vulnerability Fortinet FortiSandbox, Fortinet FortiSandbox PaaS Reported fix guidance → |
Known exploitedCISA KEV | 9.1Critical |
| CVE-2026-3910Google Chromium V8 Improper Restriction of Operations Within the Bounds of a Memory Buffer Vulnerability Google Chrome Versions & vendor guidance → |
Known exploitedCISA KEV | 8.8High |
| CVE-2026-3909Google Skia Out-of-Bounds Write Vulnerability Google Chrome Versions & vendor guidance → |
Known exploitedCISA KEV | 8.8High |
| CVE-2026-35616Fortinet FortiClient EMS Improper Access Control Vulnerability Fortinet FortiClientEMS Reported fix guidance → |
Known exploitedCISA KEV | 9.1Critical |
| CVE-2026-35273Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability Oracle Corporation PeopleSoft Enterprise PeopleTools Versions & vendor guidance → |
Known exploitedCISA KEV | 9.8Critical |
| CVE-2026-3502TrueConf Client Update Integrity Verification Bypass TrueConf TrueConf Client Versions & vendor guidance → |
Known exploitedCISA KEV | 7.8High |
| CVE-2026-34926Trend Micro Apex One (On-Premise) Directory Traversal Vulnerability Trend Micro, Inc. TrendAI Apex One, Trend Micro, Inc. TrendAI Apex One as a Service Versions & vendor guidance → |
Known exploitedCISA KEV | 6.7Medium |
| CVE-2026-34910Ubiquiti UniFi OS Improper Input Validation Vulnerability Ubiquiti Inc UniFi OS Server, Ubiquiti Inc UDM, Ubiquiti Inc UDM-Pro, Ubiquiti Inc UDM-SE, Ubiquiti Inc UDM-Pro-Max, Ubiquiti Inc UDM-Beast, Ubiquiti Inc EFG, Ubiquiti Inc UDW, Ubiquiti Inc UDR, Ubiquiti Inc UDR7, Ubiquiti Inc UDR-5G, Ubiquiti Inc Express 7, Ubiquiti Inc UNVR, Ubiquiti Inc UNVR-Pro, Ubiquiti Inc UNVR-Instant, Ubiquiti Inc UNVR-G2, Ubiquiti Inc UNVR-G2-Pro, Ubiquiti Inc ENVR, Ubiquiti Inc ENVR-Core, Ubiquiti Inc UNAS-2, Ubiquiti Inc UNAS-4, Ubiquiti Inc UNAS-Pro, Ubiquiti Inc UNAS-Pro-4, Ubiquiti Inc UNAS-Pro-8, Ubiquiti Inc UCKP, Ubiquiti Inc UCK, Ubiquiti Inc UCK-Enterprise, Ubiquiti Inc UCG-Ultra, Ubiquiti Inc UCG-Max, Ubiquiti Inc UCG-Fiber, Ubiquiti Inc UCG-Industrial Versions & vendor guidance → |
Known exploitedCISA KEV | 10Critical |
| CVE-2026-34909Ubiquiti UniFi OS Path Traversal Vulnerability Ubiquiti Inc UniFi OS Server, Ubiquiti Inc Express, Ubiquiti Inc UDM, Ubiquiti Inc UDM-Pro, Ubiquiti Inc UDM-SE, Ubiquiti Inc UDM-Pro-Max, Ubiquiti Inc UDM-Beast, Ubiquiti Inc EFG, Ubiquiti Inc UDW, Ubiquiti Inc UDR, Ubiquiti Inc UDR7, Ubiquiti Inc UDR-5G, Ubiquiti Inc Express 7, Ubiquiti Inc UNVR, Ubiquiti Inc UNVR-Pro, Ubiquiti Inc UNVR-Instant, Ubiquiti Inc UNVR-G2, Ubiquiti Inc UNVR-G2-Pro, Ubiquiti Inc ENVR, Ubiquiti Inc ENVR-Core, Ubiquiti Inc UNAS-2, Ubiquiti Inc UNAS-4, Ubiquiti Inc UNAS-Pro, Ubiquiti Inc UNAS-Pro-4, Ubiquiti Inc UNAS-Pro-8, Ubiquiti Inc UCKP, Ubiquiti Inc UCK, Ubiquiti Inc UCK-Enterprise, Ubiquiti Inc UCG-Ultra, Ubiquiti Inc UCG-Max, Ubiquiti Inc UCG-Fiber, Ubiquiti Inc UCG-Industrial Versions & vendor guidance → |
Known exploitedCISA KEV | 10Critical |
| CVE-2026-34908Ubiquiti UniFi OS Improper Access Control Vulnerability Ubiquiti Inc UniFi OS Server, Ubiquiti Inc UDM, Ubiquiti Inc UDM-Pro, Ubiquiti Inc UDM-SE, Ubiquiti Inc UDM-Pro-Max, Ubiquiti Inc UDM-Beast, Ubiquiti Inc EFG, Ubiquiti Inc UDW, Ubiquiti Inc UDR, Ubiquiti Inc UDR7, Ubiquiti Inc UDR-5G, Ubiquiti Inc Express 7, Ubiquiti Inc UNVR, Ubiquiti Inc UNVR-Pro, Ubiquiti Inc UNVR-Instant, Ubiquiti Inc UNVR-G2, Ubiquiti Inc UNVR-G2-Pro, Ubiquiti Inc ENVR, Ubiquiti Inc ENVR-Core, Ubiquiti Inc UNAS-2, Ubiquiti Inc UNAS-4, Ubiquiti Inc UNAS-Pro, Ubiquiti Inc UNAS-Pro-4, Ubiquiti Inc UNAS-Pro-8, Ubiquiti Inc UCKP, Ubiquiti Inc UCK, Ubiquiti Inc UCK-Enterprise, Ubiquiti Inc UCG-Ultra, Ubiquiti Inc UCG-Max, Ubiquiti Inc UCG-Fiber, Ubiquiti Inc UCG-Industrial Versions & vendor guidance → |
Known exploitedCISA KEV | 10Critical |
| CVE-2026-34621Acrobat Reader | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321) Adobe Acrobat DC, Adobe Acrobat Reader DC, Adobe Acrobat 2024 Versions & vendor guidance → |
Known exploitedCISA KEV | 8.6High |
| CVE-2026-34486Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor Apache Software Foundation Apache Tomcat Versions & vendor guidance → |
Known exploitedCISA KEV | 7.5High |
| CVE-2026-34197Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeans Apache Software Foundation Apache ActiveMQ Broker, Apache Software Foundation Apache ActiveMQ All, Apache Software Foundation Apache ActiveMQ Versions & vendor guidance → |
Known exploitedCISA KEV | 8.8High |
| CVE-2026-33825Microsoft Defender Elevation of Privilege Vulnerability Microsoft Microsoft Defender Antimalware Platform Versions & vendor guidance → |
Known exploitedCISA KEV | 7.8High |
| CVE-2026-33824Windows Internet Key Exchange (IKE) Service Extensions Remote Code Execution Vulnerability Microsoft Windows 10 Version 1607, Microsoft Windows 10 Version 1809, Microsoft Windows 10 Version 21H2, Microsoft Windows 10 Version 22H2, Microsoft Windows 11 version 23H2, Microsoft Windows 11 Version 23H2, Microsoft Windows 11 Version 24H2, Microsoft Windows 11 Version 25H2, Microsoft Windows 11 version 26H1, Microsoft Windows Server 2016, Microsoft Windows Server 2016 (Server Core installation), Microsoft Windows Server 2019, Microsoft Windows Server 2019 (Server Core installation), Microsoft Windows Server 2022, Microsoft Windows Server 2022, 23H2 Edition (Server Core installation), Microsoft Windows Server 2025, Microsoft Windows Server 2025 (Server Core installation) Versions & vendor guidance → |
Known exploitedCISA KEV | 9.8Critical |
| CVE-2026-33634Trivy ecosystem supply chain briefly compromised aquasecurity setup-trivy, aquasecurity trivy-action, aquasecurity trivy, BerriAI LiteLLM, team-telnyx telnyx Versions & vendor guidance → |
Known exploitedCISA KEV | 9.4Critical |
| CVE-2026-33017Langflow has Unauthenticated Remote Code Execution via Public Flow Build Endpoint langflow-ai langflow Versions & vendor guidance → |
Known exploitedCISA KEV | 9.3Critical |
| CVE-2026-32202Windows Shell Spoofing Vulnerability Microsoft Windows 10 Version 1607, Microsoft Windows 10 Version 1809, Microsoft Windows 10 Version 21H2, Microsoft Windows 10 Version 22H2, Microsoft Windows 11 version 23H2, Microsoft Windows 11 Version 23H2, Microsoft Windows 11 Version 24H2, Microsoft Windows 11 Version 25H2, Microsoft Windows 11 version 26H1, Microsoft Windows Server 2012, Microsoft Windows Server 2012 (Server Core installation), Microsoft Windows Server 2012 R2, Microsoft Windows Server 2012 R2 (Server Core installation), Microsoft Windows Server 2016, Microsoft Windows Server 2016 (Server Core installation), Microsoft Windows Server 2019, Microsoft Windows Server 2019 (Server Core installation), Microsoft Windows Server 2022, Microsoft Windows Server 2025, Microsoft Windows Server 2025 (Server Core installation) Versions & vendor guidance → |
Known exploitedCISA KEV | 4.3Medium |
| CVE-2026-32201Microsoft SharePoint Server Spoofing Vulnerability Microsoft Microsoft SharePoint Enterprise Server 2016, Microsoft Microsoft SharePoint Server 2019, Microsoft Microsoft SharePoint Server Subscription Edition Versions & vendor guidance → |
Known exploitedCISA KEV | 6.5Medium |
| CVE-2026-31431crypto: algif_aead - Revert to operating out-of-place Linux Linux Versions & vendor guidance → |
Known exploitedCISA KEV | 7.8High |
| CVE-2026-3055Insufficient input validation leading to memory overread NetScaler ADC, NetScaler Gateway Versions & vendor guidance → |
Known exploitedCISA KEV | 9.3Critical |
| CVE-2026-28318SolarWinds Serv-U Unauthenticated Denial of Service Vulnerability SolarWinds Serv-U Reported fix guidance → |
Known exploitedCISA KEV | 7.5High |
| CVE-2026-25108Soliton Systems K.K FileZen OS Command Injection Vulnerability Soliton Systems K.K. FileZen Versions & vendor guidance → |
Known exploitedCISA KEV | 8.7High |
Data sources, freshness & score definitions
The full downloaded KEV catalog is tracked, alongside CVEs found in monitored sources. This is not the entire CVE universe. CVE record enrichment rotates in bounded batches; missing fields remain unknown.
CISA KEV: checked 13 Nov 2026, 00:20 Jerusalem · 1779 records
CVE Program: checked 13 Nov 2026, 00:20 Jerusalem · 117 records · 3 records unavailable
FIRST EPSS: checked 13 Nov 2026, 00:20 Jerusalem · 2223 records
CVSS describes reported technical severity. EPSS estimates exploitation probability in the next 30 days. KEV inclusion records known exploitation, not whether your own systems are exposed.