CVE tracker
Scroll across the table to compare exploitation and severity.
| CVE / vulnerability | Exploitation | CVSS |
|---|---|---|
| CVE-2026-25089Fortinet FortiSandbox OS Command Injection Vulnerability Fortinet FortiSandbox, Fortinet FortiSandbox Cloud, Fortinet FortiSandbox PaaS Reported fix guidance → |
Known exploitedCISA KEV | 9.1Critical |
| CVE-2026-24887Claude Code has a Command Injection in find Command Bypasses User Approval Prompt anthropics claude-code Versions & vendor guidance → |
Not in downloaded KEV | 7.7High |
| CVE-2026-24858Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability Fortinet FortiWeb, Fortinet FortiNAC-F, Fortinet FortiOS, Fortinet FortiAnalyzer, Fortinet FortiProxy, Fortinet FortiManager Reported fix guidance → |
Known exploitedCISA KEV | 9.4Critical |
| CVE-2026-24423SmarterTools SmarterMail < Build 9511 Unauthenticated RCE via ConnectToHub API SmarterTools SmarterMail Versions & vendor guidance → |
Known exploitedCISA KEV | 9.3Critical |
| CVE-2026-2441Google Chromium CSS Use-After-Free Vulnerability Google Chrome Versions & vendor guidance → |
Known exploitedCISA KEV | 8.8High |
| CVE-2026-24061GNU InetUtils Argument Injection Vulnerability GNU Inetutils Versions & vendor guidance → |
Known exploitedCISA KEV | 9.8Critical |
| CVE-2026-24053Cluade Code has a Path Restriction Bypass via ZSH Clobber which Allows Arbitrary File Writes anthropics claude-code Versions & vendor guidance → |
Not in downloaded KEV | 7.7High |
| CVE-2026-24052Claude Code has a Domain Validation Bypass which Allows Automatic Requests to Attacker-Controlled Domains anthropics claude-code Versions & vendor guidance → |
Not in downloaded KEV | 7.1High |
| CVE-2026-23760SmarterTools SmarterMail < Build 9511 Authentication Bypass via Password Reset API SmarterTools SmarterMail Versions & vendor guidance → |
Known exploitedCISA KEV | 9.3Critical |
| CVE-2026-22769Dell RecoverPoint for Virtual Machines (RP4VMs) Use of Hard-coded Credentials Vulnerability Dell RecoverPoint for Virtual Machines Versions & vendor guidance → |
Known exploitedCISA KEV | 10Critical |
| CVE-2026-22719VMware Aria Operations command injection vulnerability VMware VMware Aria Operations, VMware VMware Cloud Foundation Operations, VMware Telco Cloud Platform, VMware Telco Cloud Infrastructure Reported fix guidance → |
Known exploitedCISA KEV | 8.1High |
| CVE-2026-21962Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability Oracle Corporation Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in Versions & vendor guidance → |
Known exploitedCISA KEV | 10Critical |
| CVE-2026-21852Claude Code Leaks Data via Malicious Environment Configuration Before Trust Confirmation anthropics claude-code Versions & vendor guidance → |
Not in downloaded KEV | 5.3Medium |
| CVE-2026-21643Fortinet FortiClient EMS SQL Injection Vulnerability Fortinet FortiClientEMS Reported fix guidance → |
Known exploitedCISA KEV | 9.1Critical |
| CVE-2026-21589Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability Atlassian Bamboo Data Center, Atlassian Bitbucket Data Center, Atlassian Confluence Data Center, Atlassian Crowd Data Center, Atlassian Crucible Data Center, Atlassian Fisheye Data Center, Atlassian Jira Service Management Data Center, Atlassian Jira Software Data Center Versions & vendor guidance → |
Known exploitedCISA KEV | 9.3Critical |
| CVE-2026-21533Windows Remote Desktop Services Elevation of Privilege Vulnerability Microsoft Windows 10 Version 1607, Microsoft Windows 10 Version 1809, Microsoft Windows 10 Version 21H2, Microsoft Windows 10 Version 22H2, Microsoft Windows 11 version 22H3, Microsoft Windows 11 Version 23H2, Microsoft Windows 11 Version 24H2, Microsoft Windows 11 Version 25H2, Microsoft Windows 11 version 26H1, Microsoft Windows 11 Version 26H1, Microsoft Windows Server 2012, Microsoft Windows Server 2012 (Server Core installation), Microsoft Windows Server 2012 R2, Microsoft Windows Server 2012 R2 (Server Core installation), Microsoft Windows Server 2016, Microsoft Windows Server 2016 (Server Core installation), Microsoft Windows Server 2019, Microsoft Windows Server 2019 (Server Core installation), Microsoft Windows Server 2022, Microsoft Windows Server 2022, 23H2 Edition (Server Core installation), Microsoft Windows Server 2025, Microsoft Windows Server 2025 (Server Core installation) Versions & vendor guidance → |
Known exploitedCISA KEV | 7.8High |
| CVE-2026-21525Windows Remote Access Connection Manager Denial of Service Vulnerability Microsoft Windows 10 Version 1607, Microsoft Windows 10 Version 1809, Microsoft Windows 10 Version 21H2, Microsoft Windows 10 Version 22H2, Microsoft Windows 11 version 22H3, Microsoft Windows 11 Version 23H2, Microsoft Windows 11 Version 24H2, Microsoft Windows 11 Version 25H2, Microsoft Windows 11 version 26H1, Microsoft Windows 11 Version 26H1, Microsoft Windows Server 2012, Microsoft Windows Server 2012 (Server Core installation), Microsoft Windows Server 2012 R2, Microsoft Windows Server 2012 R2 (Server Core installation), Microsoft Windows Server 2016, Microsoft Windows Server 2016 (Server Core installation), Microsoft Windows Server 2019, Microsoft Windows Server 2019 (Server Core installation), Microsoft Windows Server 2022, Microsoft Windows Server 2022, 23H2 Edition (Server Core installation), Microsoft Windows Server 2025, Microsoft Windows Server 2025 (Server Core installation) Versions & vendor guidance → |
Known exploitedCISA KEV | 6.2Medium |
| CVE-2026-21519Desktop Window Manager Elevation of Privilege Vulnerability Microsoft Windows 10 Version 1607, Microsoft Windows 10 Version 1809, Microsoft Windows 10 Version 21H2, Microsoft Windows 10 Version 22H2, Microsoft Windows 11 version 22H3, Microsoft Windows 11 Version 23H2, Microsoft Windows 11 Version 24H2, Microsoft Windows 11 Version 25H2, Microsoft Windows 11 version 26H1, Microsoft Windows 11 Version 26H1, Microsoft Windows Server 2016, Microsoft Windows Server 2016 (Server Core installation), Microsoft Windows Server 2019, Microsoft Windows Server 2019 (Server Core installation), Microsoft Windows Server 2022, Microsoft Windows Server 2022, 23H2 Edition (Server Core installation), Microsoft Windows Server 2025, Microsoft Windows Server 2025 (Server Core installation) Versions & vendor guidance → |
Known exploitedCISA KEV | 7.8High |
| CVE-2026-21514Microsoft Word Security Feature Bypass Vulnerability Microsoft Microsoft 365 Apps for Enterprise, Microsoft Microsoft Office LTSC 2021, Microsoft Microsoft Office LTSC 2024, Microsoft Microsoft Office LTSC for Mac 2021, Microsoft Microsoft Office LTSC for Mac 2024 Versions & vendor guidance → |
Known exploitedCISA KEV | 7.8High |
| CVE-2026-21513MSHTML Framework Security Feature Bypass Vulnerability Microsoft Windows 10 Version 1607, Microsoft Windows 10 Version 1809, Microsoft Windows 10 Version 21H2, Microsoft Windows 10 Version 22H2, Microsoft Windows 11 version 22H3, Microsoft Windows 11 Version 23H2, Microsoft Windows 11 Version 24H2, Microsoft Windows 11 Version 25H2, Microsoft Windows 11 version 26H1, Microsoft Windows 11 Version 26H1, Microsoft Windows Server 2012, Microsoft Windows Server 2012 (Server Core installation), Microsoft Windows Server 2012 R2, Microsoft Windows Server 2012 R2 (Server Core installation), Microsoft Windows Server 2016, Microsoft Windows Server 2016 (Server Core installation), Microsoft Windows Server 2019, Microsoft Windows Server 2019 (Server Core installation), Microsoft Windows Server 2022, Microsoft Windows Server 2022, 23H2 Edition (Server Core installation), Microsoft Windows Server 2025, Microsoft Windows Server 2025 (Server Core installation) Versions & vendor guidance → |
Known exploitedCISA KEV | 8.8High |
| CVE-2026-21510Windows Shell Security Feature Bypass Vulnerability Microsoft Windows 10 Version 1607, Microsoft Windows 10 Version 1809, Microsoft Windows 10 Version 21H2, Microsoft Windows 10 Version 22H2, Microsoft Windows 11 version 22H3, Microsoft Windows 11 Version 23H2, Microsoft Windows 11 Version 24H2, Microsoft Windows 11 Version 25H2, Microsoft Windows 11 version 26H1, Microsoft Windows 11 Version 26H1, Microsoft Windows Server 2012, Microsoft Windows Server 2012 (Server Core installation), Microsoft Windows Server 2012 R2, Microsoft Windows Server 2012 R2 (Server Core installation), Microsoft Windows Server 2016, Microsoft Windows Server 2016 (Server Core installation), Microsoft Windows Server 2019, Microsoft Windows Server 2019 (Server Core installation), Microsoft Windows Server 2022, Microsoft Windows Server 2022, 23H2 Edition (Server Core installation), Microsoft Windows Server 2025, Microsoft Windows Server 2025 (Server Core installation) Versions & vendor guidance → |
Known exploitedCISA KEV | 8.8High |
| CVE-2026-21509Microsoft Office Security Feature Bypass Vulnerability Microsoft Microsoft 365 Apps for Enterprise, Microsoft Microsoft Office 2016, Microsoft Microsoft Office 2019, Microsoft Microsoft Office LTSC 2021, Microsoft Microsoft Office LTSC 2024 Versions & vendor guidance → |
Known exploitedCISA KEV | 7.8High |
| CVE-2026-21385Integer Overflow or Wraparound in Graphics Qualcomm, Inc. Snapdragon Versions & vendor guidance → |
Known exploitedCISA KEV | 7.8High |
| CVE-2026-20963Microsoft SharePoint Remote Code Execution Vulnerability Microsoft Microsoft SharePoint Enterprise Server 2016, Microsoft Microsoft SharePoint Server 2019, Microsoft Microsoft SharePoint Server Subscription Edition Versions & vendor guidance → |
Known exploitedCISA KEV | 9.8Critical |
| CVE-2026-20805Desktop Window Manager Information Disclosure Vulnerability Microsoft Windows 10 Version 1607, Microsoft Windows 10 Version 1809, Microsoft Windows 10 Version 21H2, Microsoft Windows 10 Version 22H2, Microsoft Windows 11 version 23H2, Microsoft Windows 11 Version 23H2, Microsoft Windows 11 Version 24H2, Microsoft Windows 11 Version 25H2, Microsoft Windows Server 2012, Microsoft Windows Server 2012 (Server Core installation), Microsoft Windows Server 2012 R2, Microsoft Windows Server 2012 R2 (Server Core installation), Microsoft Windows Server 2016, Microsoft Windows Server 2016 (Server Core installation), Microsoft Windows Server 2019, Microsoft Windows Server 2019 (Server Core installation), Microsoft Windows Server 2022, Microsoft Windows Server 2022, 23H2 Edition (Server Core installation), Microsoft Windows Server 2025, Microsoft Windows Server 2025 (Server Core installation) Versions & vendor guidance → |
Known exploitedCISA KEV | 5.5Medium |
Data sources, freshness & score definitions
The full downloaded KEV catalog is tracked, alongside CVEs found in monitored sources. This is not the entire CVE universe. CVE record enrichment rotates in bounded batches; missing fields remain unknown.
CISA KEV: checked 13 Nov 2026, 00:20 Jerusalem · 1779 records
CVE Program: checked 13 Nov 2026, 00:20 Jerusalem · 117 records · 3 records unavailable
FIRST EPSS: checked 13 Nov 2026, 00:20 Jerusalem · 2223 records
CVSS describes reported technical severity. EPSS estimates exploitation probability in the next 30 days. KEV inclusion records known exploitation, not whether your own systems are exposed.