CVE tracker
Scroll across the table to compare exploitation and severity.
| CVE / vulnerability | Exploitation | CVSS |
|---|---|---|
| CVE-2018-8405Microsoft DirectX Graphics Kernel Privilege Escalation Vulnerability Microsoft Windows Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Windows Server 2016, Microsoft Windows 8.1, Microsoft Windows 10, Microsoft Windows 10 Servers Versions & vendor guidance → |
Known exploitedCISA KEV | 7.8High |
| CVE-2018-8373Microsoft Scripting Engine Memory Corruption Vulnerability Microsoft Internet Explorer 9, Microsoft Internet Explorer 11, Microsoft Internet Explorer 10 Versions & vendor guidance → |
Known exploitedCISA KEV | 7.5High |
| CVE-2018-8298ChakraCore Scripting Engine Type Confusion Vulnerability Microsoft ChakraCore Versions & vendor guidance → |
Known exploitedCISA KEV | 7.5High |
| CVE-2018-8174Microsoft Windows VBScript Engine Out-of-Bounds Write Vulnerability Microsoft Windows 7, Microsoft Windows Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Windows Server 2008, Microsoft Windows Server 2012, Microsoft Windows 8.1, Microsoft Windows Server 2016, Microsoft Windows Server 2008 R2, Microsoft Windows 10, Microsoft Windows 10 Servers Versions & vendor guidance → |
Known exploitedCISA KEV | 7.5High |
| CVE-2018-8120Microsoft Win32k Privilege Escalation Vulnerability Microsoft Windows Server 2008, Microsoft Windows 7, Microsoft Windows Server 2008 R2 Versions & vendor guidance → |
Known exploitedCISA KEV | 7High |
| CVE-2018-7841Schneider Electric U.motion Builder SQL Injection Vulnerability U.motion U.motion Builder software version 1.3.4 Versions & vendor guidance → |
Known exploitedCISA KEV | 9.8Critical |
| CVE-2018-7602Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-004 Drupal core Reported fix guidance → |
Known exploitedCISA KEV | 8.1High |
| CVE-2018-7600Drupal Core Remote Code Execution Vulnerability n/a Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 Versions & vendor guidance → |
Known exploitedCISA KEV | 9.8Critical |
| CVE-2018-7445MikroTik RouterOS Stack-Based Buffer Overflow Vulnerability n/a n/a Versions & vendor guidance → |
Known exploitedCISA KEV | 9.8Critical |
| CVE-2018-6961VMware SD-WAN Edge by VeloCloud Command Injection Vulnerability VMware NSX SD-WAN by VeloCloud Versions & vendor guidance → |
Known exploitedCISA KEV | 8.1High |
| CVE-2018-6882Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability n/a n/a Versions & vendor guidance → |
Known exploitedCISA KEV | 6.1Medium |
| CVE-2018-6789Exim Buffer Overflow Vulnerability n/a n/a Versions & vendor guidance → |
Known exploitedCISA KEV | 9.8Critical |
| CVE-2018-6530D-Link Multiple Routers OS Command Injection Vulnerability n/a n/a Versions & vendor guidance → |
Known exploitedCISA KEV | 9.8Critical |
| CVE-2018-6065Google Chromium V8 Integer Overflow Vulnerability Google Chrome Versions & vendor guidance → |
Known exploitedCISA KEV | 8.8High |
| CVE-2018-5430TIBCO JasperReports Server Information Disclosure Vulnerability TIBCO Software Inc. TIBCO JasperReports Server, TIBCO Software Inc. TIBCO JasperReports Server Community Edition, TIBCO Software Inc. TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Software Inc. TIBCO Jaspersoft for AWS with Multi-Tenancy, TIBCO Software Inc. TIBCO Jaspersoft Reporting and Analytics for AWS Reported fix guidance → |
Known exploitedCISA KEV | 7.7High |
| CVE-2018-5002Adobe Flash Player Stack-based Buffer Overflow Vulnerability n/a Adobe Flash Player 29.0.0.171 and earlier versions Versions & vendor guidance → |
Known exploitedCISA KEV | 7.8High |
| CVE-2018-4990Adobe Acrobat and Reader Double Free Vulnerability n/a Adobe Acrobat and Reader 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlier versions Versions & vendor guidance → |
Known exploitedCISA KEV | 8.8High |
| CVE-2018-4939Adobe ColdFusion Deserialization of Untrusted Data Vulnerability n/a Adobe ColdFusion ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions Versions & vendor guidance → |
Known exploitedCISA KEV | 9.8Critical |
| CVE-2018-4878Adobe Flash Player Use-After-Free Vulnerability n/a Adobe Flash Player before 28.0.0.161 Versions & vendor guidance → |
Known exploitedCISA KEV | 7.8High |
| CVE-2018-4344Apple Multiple Products Memory Corruption Vulnerability n/a iOS, macOS, tvOS, watchOS Versions & vendor guidance → |
Known exploitedCISA KEV | 7.8High |
| CVE-2018-4063Sierra Wireless AirLink ALEOS Unrestricted Upload of File with Dangerous Type Vulnerability n/a Sierra Wireless Versions & vendor guidance → |
Known exploitedCISA KEV | 8.8High |
| CVE-2018-2628Oracle WebLogic Server Unspecified Vulnerability Oracle Corporation WebLogic Server Versions & vendor guidance → |
Known exploitedCISA KEV | 9.8Critical |
| CVE-2018-2380SAP Customer Relationship Management (CRM) Path Traversal Vulnerability SAP SE SAP CRM Versions & vendor guidance → |
Known exploitedCISA KEV | 6.6Medium |
| CVE-2018-20753Kaseya VSA Remote Code Execution Vulnerability n/a n/a Versions & vendor guidance → |
Known exploitedCISA KEV | 9.8Critical |
| CVE-2018-20250WinRAR Absolute Path Traversal Vulnerability Check Point Software Technologies Ltd. WinRAR Versions & vendor guidance → |
Known exploitedCISA KEV | 7.8High |
Data sources, freshness & score definitions
The full downloaded KEV catalog is tracked, alongside CVEs found in monitored sources. This is not the entire CVE universe. CVE record enrichment rotates in bounded batches; missing fields remain unknown.
CISA KEV: checked 13 Nov 2026, 00:20 Jerusalem · 1779 records
CVE Program: checked 13 Nov 2026, 00:20 Jerusalem · 117 records · 3 records unavailable
FIRST EPSS: checked 13 Nov 2026, 00:20 Jerusalem · 2223 records
CVSS describes reported technical severity. EPSS estimates exploitation probability in the next 30 days. KEV inclusion records known exploitation, not whether your own systems are exposed.