CVE tracker
Scroll across the table to compare exploitation and severity.
| CVE / vulnerability | Exploitation | CVSS |
|---|---|---|
| CVE-2026-16305CVE-2026-16305 INFINITT Healthcare System Manager Versions & vendor guidance → |
Not in downloaded KEV | 7.8High |
| CVE-2026-16232Authentication Bypass in the SmartConsole Login Process Using an Application Token checkpoint Quantum Security Management, checkpoint Multi-Domain Security Management Versions & vendor guidance → |
Known exploitedCISA KEV | 9.3Critical |
| CVE-2026-1603Ivanti Endpoint Manager (EPM) Authentication Bypass Vulnerability Ivanti Endpoint Manager Versions & vendor guidance → |
Known exploitedCISA KEV | 8.6High |
| CVE-2026-15410SonicWall SMA1000 Appliances Code Injection Vulnerability SonicWall SMA1000 Versions & vendor guidance → |
Known exploitedCISA KEV | 7.2High |
| CVE-2026-15409SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability SonicWall SMA1000 Versions & vendor guidance → |
Known exploitedCISA KEV | 10Critical |
| CVE-2026-14918CVE-2026-14918 Axis Communications AB Signed Video Framework, Axis Communications AB Signed media verifier, Axis Communications AB Axis File Player Versions & vendor guidance → |
Not in downloaded KEV | 5.3Medium |
| CVE-2026-1340Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability Ivanti Endpoint Manager Mobile Versions & vendor guidance → |
Known exploitedCISA KEV | 9.8Critical |
| CVE-2026-13242Geolocation Field - Critical - SQL Injection - SA-CONTRIB-2026-062 Drupal Geolocation Field Versions & vendor guidance → |
Not in downloaded KEV | 6.5Medium |
| CVE-2026-12964CVE-2026-12964 Axis Communications AB AXIS Camera Station Pro Versions & vendor guidance → |
Not in downloaded KEV | 8High |
| CVE-2026-12963CVE-2026-12963 Axis Communications AB AXIS Camera Station Pro, Axis Communications AB AXIS Camera Station 5 Versions & vendor guidance → |
Not in downloaded KEV | 7.4High |
| CVE-2026-12855H19WMIHandlerSmm: unvalidated memory boundary could result in arbitrary code execution. Insyde Software InsydeH2O Reported fix guidance → |
Not in downloaded KEV | 8.2High |
| CVE-2026-1281Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability Ivanti Endpoint Manager Mobile Versions & vendor guidance → |
Known exploitedCISA KEV | 9.8Critical |
| CVE-2026-126187React: Unauthenticated Remote Code Execution in React Server Components react react Versions & vendor guidance → |
Not in downloaded KEV | 9.5Critical |
| CVE-2026-12569Remote Code Execution (RCE) vulnerability in Windchill PDMlink PTC Windchill PDMLink, PTC FlexPLM Versions & vendor guidance → |
Known exploitedCISA KEV | 9.3Critical |
| CVE-2026-125350Google Chromium Use-After-Free Vulnerability Google Chrome Versions & vendor guidance → |
Known exploitedCISA KEV | 8.8High |
| CVE-2026-125137Windows Graphics Kernel Elevation of Privilege Vulnerability Microsoft Windows 10 Version 1809, Microsoft Windows 10 Version 21H2, Microsoft Windows 10 Version 22H2, Microsoft Windows 11 version 23H2, Microsoft Windows 11 Version 23H2, Microsoft Windows 11 Version 24H2, Microsoft Windows 11 Version 25H2, Microsoft Windows 11 version 26H1, Microsoft Windows 11 Version 26H2, Microsoft Windows Server 2019, Microsoft Windows Server 2019 (Server Core installation), Microsoft Windows Server 2022, Microsoft Windows Server 2025, Microsoft Windows Server 2025 (Server Core installation) Versions & vendor guidance → |
Not in downloaded KEV | 7.8High |
| CVE-2026-125136Windows Network Connected Devices Auto-Setup Service Remote Code Execution Vulnerability Microsoft Windows 10 Version 1607, Microsoft Windows 10 Version 1809, Microsoft Windows 10 Version 21H2, Microsoft Windows 10 Version 22H2, Microsoft Windows 11 version 23H2, Microsoft Windows 11 Version 23H2, Microsoft Windows 11 Version 24H2, Microsoft Windows 11 Version 25H2, Microsoft Windows 11 version 26H1, Microsoft Windows 11 Version 26H2 Versions & vendor guidance → |
Not in downloaded KEV | 8.8High |
| CVE-2026-125135HID Parser Library Elevation of Privilege Vulnerability Microsoft Windows 10 Version 1607, Microsoft Windows 10 Version 1809, Microsoft Windows 10 Version 21H2, Microsoft Windows 10 Version 22H2, Microsoft Windows 11 version 23H2, Microsoft Windows 11 Version 23H2, Microsoft Windows 11 Version 24H2, Microsoft Windows 11 Version 25H2, Microsoft Windows 11 version 26H1, Microsoft Windows 11 Version 26H2, Microsoft Windows Server 2016, Microsoft Windows Server 2016 (Server Core installation), Microsoft Windows Server 2019, Microsoft Windows Server 2019 (Server Core installation), Microsoft Windows Server 2022, Microsoft Windows Server 2025, Microsoft Windows Server 2025 (Server Core installation) Versions & vendor guidance → |
Not in downloaded KEV | 6.8Medium |
| CVE-2026-125134Windows Function Discovery Resource Publication Remote Code Execution Vulnerability Microsoft Windows 10 Version 1607, Microsoft Windows 10 Version 1809, Microsoft Windows 10 Version 21H2, Microsoft Windows 10 Version 22H2, Microsoft Windows 11 version 23H2, Microsoft Windows 11 Version 23H2, Microsoft Windows 11 Version 24H2, Microsoft Windows 11 Version 25H2, Microsoft Windows 11 version 26H1, Microsoft Windows 11 Version 26H2, Microsoft Windows Server 2016, Microsoft Windows Server 2016 (Server Core installation), Microsoft Windows Server 2019, Microsoft Windows Server 2019 (Server Core installation), Microsoft Windows Server 2022, Microsoft Windows Server 2025, Microsoft Windows Server 2025 (Server Core installation) Versions & vendor guidance → |
Not in downloaded KEV | 7.5High |
| CVE-2026-125125compose-lint: A symlink in a pull request can issue workflow commands through the compose-lint Action's SARIF-directory error message tmatens compose-lint Versions & vendor guidance → |
Not in downloaded KEV | 2.3Low |
| CVE-2026-125123compose-lint: A file path in a pull request can issue CI workflow commands through compose-lint 0.31.0's command-line error messages tmatens compose-lint Versions & vendor guidance → |
Not in downloaded KEV | 2.3Low |
| CVE-2026-124916PrestaShop Performance Debug Configuration PHP Code Injection PrestaShop PrestaShop Versions & vendor guidance → |
Not in downloaded KEV | 5.4Medium |
| CVE-2026-124586Tencent RapidJSON diyfp.h GetCachedPowerByIndex out-of-bounds Tencent RapidJSON Versions & vendor guidance → |
Not in downloaded KEV | 6.9Medium |
| CVE-2026-124499Fengoffice Feng Office Translation Tool ToolController.class.php write_translations code injection Fengoffice Feng Office Versions & vendor guidance → |
Not in downloaded KEV | 5.1Medium |
| CVE-2026-124498Convene Azeus Convene Board Management Portal dummy_launcher.jsp cross site scripting Convene Azeus Convene Board Management Portal Versions & vendor guidance → |
Not in downloaded KEV | 5.1Medium |
Data sources, freshness & score definitions
The full downloaded KEV catalog is tracked, alongside CVEs found in monitored sources. This is not the entire CVE universe. CVE record enrichment rotates in bounded batches; missing fields remain unknown.
CISA KEV: checked 13 Nov 2026, 00:20 Jerusalem · 1779 records
CVE Program: checked 13 Nov 2026, 00:20 Jerusalem · 117 records · 3 records unavailable
FIRST EPSS: checked 13 Nov 2026, 00:20 Jerusalem · 2223 records
CVSS describes reported technical severity. EPSS estimates exploitation probability in the next 30 days. KEV inclusion records known exploitation, not whether your own systems are exposed.