CVE tracker — Exploitation, versions & score history

Scroll across the table to compare exploitation and severity.

Matching CVEs and exploitation evidence. CVSS measures reported severity. Unknown scores are not zero.
CVE / vulnerability	Exploitation	CVSS
CVE-2026-102764 Improper Origin Validation in Internal Messaging Components of BeyondTrust Remote Support BeyondTrust Remote Support Versions & vendor guidance →	Known exploitedCISA KEV	9.3Critical
CVE-2026-102490 Local privilege escalation in Zammad v1.5.0 to v7.2.2 installed via DEB or RPM package Zammad GmbH Zammad Versions & vendor guidance →	Known exploitedCISA KEV	8.5High
CVE-2026-102489 Undisclosed RCE in Zammad v6.3 and higher Zammad GmbH Zammad Versions & vendor guidance →	Known exploitedCISA KEV	8.7High
CVE-2026-0770 Langflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution Vulnerability Langflow Langflow Versions & vendor guidance →	Known exploitedCISA KEV	9.8Critical
CVE-2026-0322 PAN-OS: Authenticated Remote Code Execution (RCE) in the Management Interface Palo Alto Networks Cloud NGFW, Palo Alto Networks PAN-OS, Palo Alto Networks Prisma Access Reported fix guidance →	Known exploitedCISA KEV	8.6High
CVE-2026-0300 PAN-OS: Unauthenticated user initiated Buffer Overflow Vulnerability in User-ID™ Authentication Portal Palo Alto Networks Cloud NGFW, Palo Alto Networks PAN-OS, Palo Alto Networks Prisma Access Reported fix guidance →	Known exploitedCISA KEV	9.3Critical
CVE-2026-0257 PAN-OS: GlobalProtect Authentication Bypass Vulnerabilities Palo Alto Networks Cloud NGFW, Palo Alto Networks PAN-OS, Palo Alto Networks Prisma Access Reported fix guidance →	Known exploitedCISA KEV	7.8High
CVE-2025-9377 Authenticated RCE via Parental Control command injection TP-Link Systems Inc. Archer C7(EU) V2, TP-Link Systems Inc. TL-WR841N/ND(MS) V9 Versions & vendor guidance →	Known exploitedCISA KEV	8.6High
CVE-2025-9242 WatchGuard Firebox iked Out of Bounds Write Vulnerability WatchGuard Fireware OS Reported fix guidance →	Known exploitedCISA KEV	9.3Critical
CVE-2025-8876 Command Injection Vulnerability N-able N-central Versions & vendor guidance →	Known exploitedCISA KEV	9.4Critical
CVE-2025-8875 Insecure Deserialization Vulnerability N-able N-central Versions & vendor guidance →	Known exploitedCISA KEV	9.4Critical
CVE-2025-8110 File overwrite in file update API in Gogs Gogs Gogs Versions & vendor guidance →	Known exploitedCISA KEV	8.7High
CVE-2025-8088 Path traversal vulnerability in WinRAR win.rar GmbH WinRAR Versions & vendor guidance →	Known exploitedCISA KEV	8.4High
CVE-2025-7775 Memory overflow vulnerability leading to Remote Code Execution and/or Denial of Service NetScaler ADC, NetScaler Gateway Versions & vendor guidance →	Known exploitedCISA KEV	9.2Critical
CVE-2025-68686 Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability Fortinet FortiOS Reported fix guidance →	Known exploitedCISA KEV	5.3Medium
CVE-2025-68645 Synacor Zimbra Collaboration Suite (ZCS) PHP Remote File Inclusion Vulnerability n/a n/a Versions & vendor guidance →	Known exploitedCISA KEV	8.8High
CVE-2025-68613 n8n Vulnerable to Remote Code Execution via Expression Injection n8n-io n8n Versions & vendor guidance →	Known exploitedCISA KEV	10Critical
CVE-2025-68461 RoundCube Webmail Cross-site Scripting Vulnerability Roundcube Webmail Versions & vendor guidance →	Known exploitedCISA KEV	7.2High
CVE-2025-67038 Lantronix EDS5000, G520, and X300 OS Command Injection Lantronix EDS5000 series, Lantronix G520 series, Lantronix X300 series, Lantronix E210 series, Lantronix E220 series Reported fix guidance →	Known exploitedCISA KEV	9.3Critical
CVE-2025-66644 Array Networks ArrayOS AG OS Command Injection Vulnerability Array Networks ArrayOS AG Versions & vendor guidance →	Known exploitedCISA KEV	7.2High
CVE-2025-66376 Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting Vulnerability Zimbra Collaboration Versions & vendor guidance →	Known exploitedCISA KEV	7.2High
CVE-2025-6558 Google Chromium ANGLE and GPU Improper Input Validation Vulnerability Google Chrome Versions & vendor guidance →	Known exploitedCISA KEV	8.8High
CVE-2025-6554 Google Chromium V8 Type Confusion Vulnerability Google Chrome Versions & vendor guidance →	Known exploitedCISA KEV	8.1High
CVE-2025-6543 Memory overflow vulnerability leading to unintended control flow and Denial of Service NetScaler ADC, NetScaler Gateway Versions & vendor guidance →	Known exploitedCISA KEV	9.2Critical
CVE-2025-64446 Fortinet FortiWeb Path Traversal Vulnerability Fortinet FortiWeb Reported fix guidance →	Known exploitedCISA KEV	9.4Critical

Data sources, freshness & score definitions

The full downloaded KEV catalog is tracked, alongside CVEs found in monitored sources. This is not the entire CVE universe. CVE record enrichment rotates in bounded batches; missing fields remain unknown.

CISA KEV: checked 13 Nov 2026, 00:20 Jerusalem · 1779 records

CVE Program: checked 13 Nov 2026, 00:20 Jerusalem · 117 records · 3 records unavailable

FIRST EPSS: checked 13 Nov 2026, 00:20 Jerusalem · 2223 records

CVSS describes reported technical severity. EPSS estimates exploitation probability in the next 30 days. KEV inclusion records known exploitation, not whether your own systems are exposed.