CVE tracker
Scroll across the table to compare exploitation and severity.
| CVE / vulnerability | Exploitation | CVSS |
|---|---|---|
| CVE-2026-119886Windows Telephony Service Elevation of Privilege Vulnerability Microsoft Windows 10 Version 1607, Microsoft Windows 10 Version 1809, Microsoft Windows 10 Version 21H2, Microsoft Windows 10 Version 22H2, Microsoft Windows 11 version 23H2, Microsoft Windows 11 Version 23H2, Microsoft Windows 11 Version 24H2, Microsoft Windows 11 Version 25H2, Microsoft Windows 11 version 26H1, Microsoft Windows 11 Version 26H2, Microsoft Windows Server 2016, Microsoft Windows Server 2016 (Server Core installation), Microsoft Windows Server 2019, Microsoft Windows Server 2019 (Server Core installation), Microsoft Windows Server 2022, Microsoft Windows Server 2025, Microsoft Windows Server 2025 (Server Core installation) Versions & vendor guidance → |
Not in downloaded KEV | 7.8High |
| CVE-2026-119883Data Deduplication Security Feature Bypass Vulnerability Microsoft Windows Server 2016, Microsoft Windows Server 2016 (Server Core installation), Microsoft Windows Server 2019, Microsoft Windows Server 2019 (Server Core installation), Microsoft Windows Server 2022, Microsoft Windows Server 2025, Microsoft Windows Server 2025 (Server Core installation) Versions & vendor guidance → |
Not in downloaded KEV | 3.3Low |
| CVE-2026-119853Remote Access API Elevation of Privilege Vulnerability Microsoft Windows 10 Version 1607, Microsoft Windows 10 Version 1809, Microsoft Windows 10 Version 21H2, Microsoft Windows 10 Version 22H2, Microsoft Windows 11 version 23H2, Microsoft Windows 11 Version 23H2, Microsoft Windows 11 Version 24H2, Microsoft Windows 11 Version 25H2, Microsoft Windows 11 version 26H1, Microsoft Windows 11 Version 26H2, Microsoft Windows Server 2016, Microsoft Windows Server 2016 (Server Core installation), Microsoft Windows Server 2019, Microsoft Windows Server 2019 (Server Core installation), Microsoft Windows Server 2022, Microsoft Windows Server 2025, Microsoft Windows Server 2025 (Server Core installation) Versions & vendor guidance → |
Not in downloaded KEV | 7.8High |
| CVE-2026-119818Windows Text Services Framework Elevation of Privilege Vulnerability Microsoft Windows 10 Version 1607, Microsoft Windows 10 Version 1809, Microsoft Windows 10 Version 21H2, Microsoft Windows 10 Version 22H2, Microsoft Windows 11 version 23H2, Microsoft Windows 11 Version 23H2, Microsoft Windows 11 Version 24H2, Microsoft Windows 11 Version 25H2, Microsoft Windows 11 version 26H1, Microsoft Windows 11 Version 26H2, Microsoft Windows Server 2016, Microsoft Windows Server 2016 (Server Core installation), Microsoft Windows Server 2019, Microsoft Windows Server 2019 (Server Core installation), Microsoft Windows Server 2022, Microsoft Windows Server 2025, Microsoft Windows Server 2025 (Server Core installation) Versions & vendor guidance → |
Not in downloaded KEV | 7.8High |
| CVE-2026-119618Apache HTTP Server: mod_http2: heap corruption and RCE in assign_headers Apache Software Foundation Apache HTTP Server Versions & vendor guidance → |
Not in downloaded KEV | Unknown |
| CVE-2026-119398Windows Installer Elevation of Privilege Vulnerability Microsoft Windows 10 Version 1607, Microsoft Windows 10 Version 1809, Microsoft Windows 10 Version 21H2, Microsoft Windows 10 Version 22H2, Microsoft Windows 11 version 23H2, Microsoft Windows 11 Version 23H2, Microsoft Windows 11 Version 24H2, Microsoft Windows 11 Version 25H2, Microsoft Windows 11 version 26H1, Microsoft Windows 11 Version 26H2, Microsoft Windows Server 2016, Microsoft Windows Server 2016 (Server Core installation), Microsoft Windows Server 2019, Microsoft Windows Server 2019 (Server Core installation), Microsoft Windows Server 2022, Microsoft Windows Server 2025, Microsoft Windows Server 2025 (Server Core installation) Versions & vendor guidance → |
Not in downloaded KEV | 7High |
| CVE-2026-119397Windows Kernel Transaction Manager Elevation of Privilege Vulnerability Microsoft Windows 10 Version 1607, Microsoft Windows 10 Version 1809, Microsoft Windows 10 Version 21H2, Microsoft Windows 10 Version 22H2, Microsoft Windows 11 version 23H2, Microsoft Windows 11 Version 23H2, Microsoft Windows 11 Version 24H2, Microsoft Windows 11 Version 25H2, Microsoft Windows 11 version 26H1, Microsoft Windows 11 Version 26H2, Microsoft Windows Server 2016, Microsoft Windows Server 2016 (Server Core installation), Microsoft Windows Server 2019, Microsoft Windows Server 2019 (Server Core installation), Microsoft Windows Server 2022, Microsoft Windows Server 2025, Microsoft Windows Server 2025 (Server Core installation) Versions & vendor guidance → |
Not in downloaded KEV | 7High |
| CVE-2026-119389Windows Storage Elevation of Privilege Vulnerability Microsoft Windows 11 version 23H2, Microsoft Windows 11 Version 23H2, Microsoft Windows 11 Version 24H2, Microsoft Windows 11 Version 25H2, Microsoft Windows 11 version 26H1, Microsoft Windows 11 Version 26H2, Microsoft Windows Server 2022, Microsoft Windows Server 2025, Microsoft Windows Server 2025 (Server Core installation) Versions & vendor guidance → |
Not in downloaded KEV | 7High |
| CVE-2026-119382Windows TPM Elevation of Privilege Vulnerability Microsoft Windows 10 Version 1607, Microsoft Windows 10 Version 1809, Microsoft Windows 10 Version 21H2, Microsoft Windows 10 Version 22H2, Microsoft Windows 11 version 23H2, Microsoft Windows 11 Version 23H2, Microsoft Windows 11 Version 24H2, Microsoft Windows 11 Version 25H2, Microsoft Windows 11 version 26H1, Microsoft Windows 11 Version 26H2, Microsoft Windows Server 2016, Microsoft Windows Server 2016 (Server Core installation), Microsoft Windows Server 2019, Microsoft Windows Server 2019 (Server Core installation), Microsoft Windows Server 2022, Microsoft Windows Server 2025, Microsoft Windows Server 2025 (Server Core installation) Versions & vendor guidance → |
Not in downloaded KEV | 7.8High |
| CVE-2026-119298croc: Overwrite-confirmation bypass via a crafted "croc-stdin-" filename on receive schollz croc Versions & vendor guidance → |
Not in downloaded KEV | 4.2Medium |
| CVE-2026-119209pypdf: Possible large memory usage when parsing cross-reference streams py-pdf pypdf Versions & vendor guidance → |
Not in downloaded KEV | 7.1High |
| CVE-2026-119208pypdf: Possible long runtimes/large memory usage for encrypted PDF files py-pdf pypdf Versions & vendor guidance → |
Not in downloaded KEV | 7.1High |
| CVE-2026-119207pypdf: Possible large memory usage for exceptions in strict mode py-pdf pypdf Versions & vendor guidance → |
Not in downloaded KEV | 7.1High |
| CVE-2026-119206pypdf: Possible long runtimes when retrieving page labels py-pdf pypdf Versions & vendor guidance → |
Not in downloaded KEV | 7.1High |
| CVE-2026-119205pypdf: Possible infinite loop when cloning dictionaries py-pdf pypdf Versions & vendor guidance → |
Not in downloaded KEV | 7.1High |
| CVE-2026-119204pypdf: Possible large memory usage when parsing page tree py-pdf pypdf Versions & vendor guidance → |
Not in downloaded KEV | 7.1High |
| CVE-2026-119203pypdf: Possible infinite loop when hitting EOF in standard xref table during trailer search py-pdf pypdf Versions & vendor guidance → |
Not in downloaded KEV | 7.1High |
| CVE-2026-119202@hapi/content: quadratic-time parsing of Content-Disposition parameters allows denial of service hapijs content Versions & vendor guidance → |
Not in downloaded KEV | 7.5High |
| CVE-2026-119197pyasn1: Quadratic-complexity denial of service in binary REAL decoding pyasn1 pyasn1 Versions & vendor guidance → |
Not in downloaded KEV | 7.5High |
| CVE-2026-119196pyasn1: Quadratic CPU consumption in constructed BIT STRING decoding pyasn1 pyasn1 Versions & vendor guidance → |
Not in downloaded KEV | 7.5High |
| CVE-2026-119195pyasn1: Quadratic-time denial of service in constructed string and indefinite-length ANY decoding pyasn1 pyasn1 Versions & vendor guidance → |
Not in downloaded KEV | 7.5High |
| CVE-2026-119194pyasn1: Quadratic CPU use in schemaless BER/CER/DER container decoding pyasn1 pyasn1 Versions & vendor guidance → |
Not in downloaded KEV | 7.5High |
| CVE-2026-119188Forge: Denial of service in TLS record processing via a record interleaved with a fragmented handshake message digitalbazaar forge Versions & vendor guidance → |
Not in downloaded KEV | 7.5High |
| CVE-2026-119187Forge: Denial of service in TLS record processing via call stack exhaustion digitalbazaar forge Versions & vendor guidance → |
Not in downloaded KEV | 7.5High |
| CVE-2026-119186Forge: AES-GCM authentication bypass via unvalidated tagLength option digitalbazaar forge Versions & vendor guidance → |
Not in downloaded KEV | 5.9Medium |
Data sources, freshness & score definitions
The full downloaded KEV catalog is tracked, alongside CVEs found in monitored sources. This is not the entire CVE universe. CVE record enrichment rotates in bounded batches; missing fields remain unknown.
CISA KEV: checked 13 Nov 2026, 00:20 Jerusalem · 1779 records
CVE Program: checked 13 Nov 2026, 00:20 Jerusalem · 117 records · 3 records unavailable
FIRST EPSS: checked 13 Nov 2026, 00:20 Jerusalem · 2223 records
CVSS describes reported technical severity. EPSS estimates exploitation probability in the next 30 days. KEV inclusion records known exploitation, not whether your own systems are exposed.