CVE tracker
Scroll across the table to compare exploitation and severity.
| CVE / vulnerability | Exploitation | CVSS |
|---|---|---|
| CVE-2026-42271LiteLLM: Authenticated command execution via MCP stdio test endpoints BerriAI litellm Versions & vendor guidance → |
Known exploitedCISA KEV | 8.7High |
| CVE-2026-42208LiteLLM: SQL injection in Proxy API key verification BerriAI litellm Versions & vendor guidance → |
Known exploitedCISA KEV | 9.3Critical |
| CVE-2026-42018Anonymous user token generation exposure in JFrog Artifactory jfrog artifactory Versions & vendor guidance → |
Known exploitedCISA KEV | 7.5High |
| CVE-2026-42016Incorrect authorization validation of user token in JFrog Artifactory allows Privilege Escalation jfrog artifactory Versions & vendor guidance → |
Known exploitedCISA KEV | 8.1High |
| CVE-2026-41940WebPros cPanel and WHM Authentication Bypass via Login Flow WebPros cPanel, WebPros WP Squared, WebPros WHM Versions & vendor guidance → |
Known exploitedCISA KEV | 9.3Critical |
| CVE-2026-41709ESX insufficient logging vulnerability VMware Cloud Foundation, VMware vSphere Foundation, VMware ESX, VMware Telco Cloud Platform Versions & vendor guidance → |
Known exploitedCISA KEV | 2.7Low |
| CVE-2026-41091Microsoft Defender Elevation of Privilege Vulnerability Microsoft Microsoft Malware Protection Engine Versions & vendor guidance → |
Known exploitedCISA KEV | 7.8High |
| CVE-2026-40217CVE-2026-40217 BerriAI LiteLLM Versions & vendor guidance → |
Not in downloaded KEV | 8.8High |
| CVE-2026-40197Incus nil-pointer dereference in custom volume import allows denial of service lxc incus Versions & vendor guidance → |
Not in downloaded KEV | 7.1High |
| CVE-2026-40068Claude Code arbitrary code execution via git worktree commondir trust dialog bypass anthropics claude-code Versions & vendor guidance → |
Not in downloaded KEV | 7.7High |
| CVE-2026-39987marimo Affected by Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass marimo-team marimo Versions & vendor guidance → |
Known exploitedCISA KEV | 9.3Critical |
| CVE-2026-39861Claude Code: Sandbox Escape via Symlink Following Allows Arbitrary File Write Outside Workspace anthropics claude-code Versions & vendor guidance → |
Not in downloaded KEV | 7.7High |
| CVE-2026-39808Fortinet FortiSandbox OS Command Injection Vulnerability Fortinet FortiSandbox, Fortinet FortiSandbox PaaS Reported fix guidance → |
Known exploitedCISA KEV | 9.1Critical |
| CVE-2026-3910Google Chromium V8 Improper Restriction of Operations Within the Bounds of a Memory Buffer Vulnerability Google Chrome Versions & vendor guidance → |
Known exploitedCISA KEV | 8.8High |
| CVE-2026-3909Google Skia Out-of-Bounds Write Vulnerability Google Chrome Versions & vendor guidance → |
Known exploitedCISA KEV | 8.8High |
| CVE-2026-3833Gnutls: gnutls: policy bypass due to case-sensitive nameconstraints comparison , Red Hat Red Hat Enterprise Linux 10, Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support, Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support, Red Hat Red Hat Enterprise Linux 8, Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On, Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On, Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service, Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions, Red Hat Red Hat Enterprise Linux 9, Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions, Red Hat Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions, Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support, Red Hat Red Hat OpenShift Container Platform 4.12, Red Hat Red Hat OpenShift Container Platform 4.13, Red Hat Red Hat OpenShift Container Platform 4.14, Red Hat Red Hat OpenShift Container Platform 4.15, Red Hat Red Hat OpenShift Container Platform 4.16, Red Hat Red Hat OpenShift Container Platform 4.17, Red Hat Red Hat OpenShift Container Platform 4.18, Red Hat Red Hat OpenShift Container Platform 4.19, Red Hat Cert Manager support for Red Hat OpenShift release 1.17, Red Hat Cert Manager support for Red Hat OpenShift release 1.18, Red Hat Cert Manager support for Red Hat OpenShift release 1.20, Red Hat Red Hat Discovery 2, Red Hat Red Hat Hardened Images, Red Hat Red Hat OpenShift AI 3.4, Red Hat Red Hat Update Infrastructure 5, Red Hat Red Hat Enterprise Linux 6, Red Hat Red Hat OpenShift Container Platform 4 Reported workaround → |
Not in downloaded KEV | 6.5Medium |
| CVE-2026-35616Fortinet FortiClient EMS Improper Access Control Vulnerability Fortinet FortiClientEMS Reported fix guidance → |
Known exploitedCISA KEV | 9.1Critical |
| CVE-2026-35603Claude Code: Insecure System-Wide Configuration Loading Enables Local Privilege Escalation on Windows anthropics claude-code Versions & vendor guidance → |
Not in downloaded KEV | 5.4Medium |
| CVE-2026-3547wolfSSL: out-of-bounds read (DoS) in ALPN parsing due to incomplete validation wolfSSL wolfSSL Reported fix guidance → |
Not in downloaded KEV | 7.5High |
| CVE-2026-35273Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability Oracle Corporation PeopleSoft Enterprise PeopleTools Versions & vendor guidance → |
Known exploitedCISA KEV | 9.8Critical |
| CVE-2026-3502TrueConf Client Update Integrity Verification Bypass TrueConf TrueConf Client Versions & vendor guidance → |
Known exploitedCISA KEV | 7.8High |
| CVE-2026-34926Trend Micro Apex One (On-Premise) Directory Traversal Vulnerability Trend Micro, Inc. TrendAI Apex One, Trend Micro, Inc. TrendAI Apex One as a Service Versions & vendor guidance → |
Known exploitedCISA KEV | 6.7Medium |
| CVE-2026-34910Ubiquiti UniFi OS Improper Input Validation Vulnerability Ubiquiti Inc UniFi OS Server, Ubiquiti Inc UDM, Ubiquiti Inc UDM-Pro, Ubiquiti Inc UDM-SE, Ubiquiti Inc UDM-Pro-Max, Ubiquiti Inc UDM-Beast, Ubiquiti Inc EFG, Ubiquiti Inc UDW, Ubiquiti Inc UDR, Ubiquiti Inc UDR7, Ubiquiti Inc UDR-5G, Ubiquiti Inc Express 7, Ubiquiti Inc UNVR, Ubiquiti Inc UNVR-Pro, Ubiquiti Inc UNVR-Instant, Ubiquiti Inc UNVR-G2, Ubiquiti Inc UNVR-G2-Pro, Ubiquiti Inc ENVR, Ubiquiti Inc ENVR-Core, Ubiquiti Inc UNAS-2, Ubiquiti Inc UNAS-4, Ubiquiti Inc UNAS-Pro, Ubiquiti Inc UNAS-Pro-4, Ubiquiti Inc UNAS-Pro-8, Ubiquiti Inc UCKP, Ubiquiti Inc UCK, Ubiquiti Inc UCK-Enterprise, Ubiquiti Inc UCG-Ultra, Ubiquiti Inc UCG-Max, Ubiquiti Inc UCG-Fiber, Ubiquiti Inc UCG-Industrial Versions & vendor guidance → |
Known exploitedCISA KEV | 10Critical |
| CVE-2026-34909Ubiquiti UniFi OS Path Traversal Vulnerability Ubiquiti Inc UniFi OS Server, Ubiquiti Inc Express, Ubiquiti Inc UDM, Ubiquiti Inc UDM-Pro, Ubiquiti Inc UDM-SE, Ubiquiti Inc UDM-Pro-Max, Ubiquiti Inc UDM-Beast, Ubiquiti Inc EFG, Ubiquiti Inc UDW, Ubiquiti Inc UDR, Ubiquiti Inc UDR7, Ubiquiti Inc UDR-5G, Ubiquiti Inc Express 7, Ubiquiti Inc UNVR, Ubiquiti Inc UNVR-Pro, Ubiquiti Inc UNVR-Instant, Ubiquiti Inc UNVR-G2, Ubiquiti Inc UNVR-G2-Pro, Ubiquiti Inc ENVR, Ubiquiti Inc ENVR-Core, Ubiquiti Inc UNAS-2, Ubiquiti Inc UNAS-4, Ubiquiti Inc UNAS-Pro, Ubiquiti Inc UNAS-Pro-4, Ubiquiti Inc UNAS-Pro-8, Ubiquiti Inc UCKP, Ubiquiti Inc UCK, Ubiquiti Inc UCK-Enterprise, Ubiquiti Inc UCG-Ultra, Ubiquiti Inc UCG-Max, Ubiquiti Inc UCG-Fiber, Ubiquiti Inc UCG-Industrial Versions & vendor guidance → |
Known exploitedCISA KEV | 10Critical |
| CVE-2026-34908Ubiquiti UniFi OS Improper Access Control Vulnerability Ubiquiti Inc UniFi OS Server, Ubiquiti Inc UDM, Ubiquiti Inc UDM-Pro, Ubiquiti Inc UDM-SE, Ubiquiti Inc UDM-Pro-Max, Ubiquiti Inc UDM-Beast, Ubiquiti Inc EFG, Ubiquiti Inc UDW, Ubiquiti Inc UDR, Ubiquiti Inc UDR7, Ubiquiti Inc UDR-5G, Ubiquiti Inc Express 7, Ubiquiti Inc UNVR, Ubiquiti Inc UNVR-Pro, Ubiquiti Inc UNVR-Instant, Ubiquiti Inc UNVR-G2, Ubiquiti Inc UNVR-G2-Pro, Ubiquiti Inc ENVR, Ubiquiti Inc ENVR-Core, Ubiquiti Inc UNAS-2, Ubiquiti Inc UNAS-4, Ubiquiti Inc UNAS-Pro, Ubiquiti Inc UNAS-Pro-4, Ubiquiti Inc UNAS-Pro-8, Ubiquiti Inc UCKP, Ubiquiti Inc UCK, Ubiquiti Inc UCK-Enterprise, Ubiquiti Inc UCG-Ultra, Ubiquiti Inc UCG-Max, Ubiquiti Inc UCG-Fiber, Ubiquiti Inc UCG-Industrial Versions & vendor guidance → |
Known exploitedCISA KEV | 10Critical |
Data sources, freshness & score definitions
The full downloaded KEV catalog is tracked, alongside CVEs found in monitored sources. This is not the entire CVE universe. CVE record enrichment rotates in bounded batches; missing fields remain unknown.
CISA KEV: checked 13 Nov 2026, 00:20 Jerusalem · 1779 records
CVE Program: checked 13 Nov 2026, 00:20 Jerusalem · 117 records · 3 records unavailable
FIRST EPSS: checked 13 Nov 2026, 00:20 Jerusalem · 2223 records
CVSS describes reported technical severity. EPSS estimates exploitation probability in the next 30 days. KEV inclusion records known exploitation, not whether your own systems are exposed.