CVE tracker
Scroll across the table to compare exploitation and severity.
| CVE / vulnerability | Exploitation | CVSS |
|---|---|---|
| CVE-2026-118711Microsoft Office Excel Remote Code Execution Vulnerability Microsoft Microsoft 365 Apps for Enterprise, Microsoft Microsoft Office 365 for Mac, Microsoft Microsoft Office LTSC 2021, Microsoft Microsoft Office LTSC 2024, Microsoft Microsoft Office LTSC for Mac 2021, Microsoft Microsoft Office LTSC for Mac 2024, Microsoft Office Online Server Versions & vendor guidance → |
Not in downloaded KEV | 8.8High |
| CVE-2026-118702Microsoft Office Excel Remote Code Execution Vulnerability Microsoft Microsoft 365 Apps for Enterprise, Microsoft Microsoft Office 365 for Mac, Microsoft Microsoft Office LTSC 2021, Microsoft Microsoft Office LTSC 2024, Microsoft Microsoft Office LTSC for Mac 2021, Microsoft Microsoft Office LTSC for Mac 2024 Versions & vendor guidance → |
Not in downloaded KEV | 8.8High |
| CVE-2026-118701Microsoft Office Excel Remote Code Execution Vulnerability Microsoft Microsoft 365 Apps for Enterprise, Microsoft Microsoft Office 365 for Mac, Microsoft Microsoft Office LTSC 2021, Microsoft Microsoft Office LTSC 2024, Microsoft Microsoft Office LTSC for Mac 2021, Microsoft Microsoft Office LTSC for Mac 2024, Microsoft Office Online Server Versions & vendor guidance → |
Not in downloaded KEV | 8.8High |
| CVE-2026-118527Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability Ivanti Connect Secure Versions & vendor guidance → |
Known exploitedCISA KEV | 4.3Medium |
| CVE-2026-118297Microsoft Office Excel Remote Code Execution Vulnerability Microsoft Microsoft 365 Apps for Enterprise, Microsoft Microsoft Office 365 for Mac, Microsoft Microsoft Office LTSC 2021, Microsoft Microsoft Office LTSC 2024, Microsoft Microsoft Office LTSC for Mac 2021, Microsoft Microsoft Office LTSC for Mac 2024, Microsoft Office Online Server Versions & vendor guidance → |
Not in downloaded KEV | 8.8High |
| CVE-2026-118296Microsoft Office Excel Remote Code Execution Vulnerability Microsoft Microsoft 365 Apps for Enterprise, Microsoft Microsoft Office 365 for Mac, Microsoft Microsoft Office LTSC 2021, Microsoft Microsoft Office LTSC 2024, Microsoft Microsoft Office LTSC for Mac 2021, Microsoft Microsoft Office LTSC for Mac 2024, Microsoft Office Online Server Versions & vendor guidance → |
Not in downloaded KEV | 8.8High |
| CVE-2026-118292Microsoft Office Excel Remote Code Execution Vulnerability Microsoft Microsoft 365 Apps for Enterprise, Microsoft Microsoft Office 365 for Mac, Microsoft Microsoft Office LTSC 2021, Microsoft Microsoft Office LTSC 2024, Microsoft Microsoft Office LTSC for Mac 2021, Microsoft Microsoft Office LTSC for Mac 2024, Microsoft Office Online Server Versions & vendor guidance → |
Not in downloaded KEV | 8.8High |
| CVE-2026-118288Microsoft Azure File Sync Elevation of Privilege Vulnerability Microsoft Azure File Sync, Microsoft Azure File Sync v22 Versions & vendor guidance → |
Not in downloaded KEV | 7High |
| CVE-2026-118207Microsoft Exchange Server Remote Code Execution Vulnerability Microsoft Microsoft Exchange Server Subscription Edition RTM Versions & vendor guidance → |
Not in downloaded KEV | 8.8High |
| CVE-2026-118148Active Directory Domain Services Elevation of Privilege Vulnerability Microsoft Windows 10 Version 1607, Microsoft Windows 10 Version 1809, Microsoft Windows 10 Version 21H2, Microsoft Windows 10 Version 22H2, Microsoft Windows 11 version 23H2, Microsoft Windows 11 Version 23H2, Microsoft Windows 11 Version 24H2, Microsoft Windows 11 Version 25H2, Microsoft Windows 11 version 26H1, Microsoft Windows 11 Version 26H2, Microsoft Windows Server 2016, Microsoft Windows Server 2016 (Server Core installation), Microsoft Windows Server 2019, Microsoft Windows Server 2019 (Server Core installation), Microsoft Windows Server 2022, Microsoft Windows Server 2025, Microsoft Windows Server 2025 (Server Core installation) Versions & vendor guidance → |
Not in downloaded KEV | 7.5High |
| CVE-2026-118146Windows Active Directory Domain Services Remote Code Execution Vulnerability Microsoft Windows 10 Version 1607, Microsoft Windows 10 Version 1809, Microsoft Windows 10 Version 21H2, Microsoft Windows 10 Version 22H2, Microsoft Windows 11 version 23H2, Microsoft Windows 11 Version 23H2, Microsoft Windows 11 Version 24H2, Microsoft Windows 11 Version 25H2, Microsoft Windows 11 version 26H1, Microsoft Windows 11 Version 26H2, Microsoft Windows Server 2016, Microsoft Windows Server 2016 (Server Core installation), Microsoft Windows Server 2019, Microsoft Windows Server 2019 (Server Core installation), Microsoft Windows Server 2022, Microsoft Windows Server 2025, Microsoft Windows Server 2025 (Server Core installation) Versions & vendor guidance → |
Not in downloaded KEV | 8.8High |
| CVE-2026-118145Windows Function Discovery SSDP Provider Remote Code Execution Vulnerability Microsoft Windows 10 Version 1607, Microsoft Windows 10 Version 1809, Microsoft Windows 10 Version 21H2, Microsoft Windows 10 Version 22H2, Microsoft Windows 11 version 23H2, Microsoft Windows 11 Version 23H2, Microsoft Windows 11 Version 24H2, Microsoft Windows 11 Version 25H2, Microsoft Windows 11 version 26H1, Microsoft Windows 11 Version 26H2, Microsoft Windows Server 2016, Microsoft Windows Server 2016 (Server Core installation), Microsoft Windows Server 2019, Microsoft Windows Server 2019 (Server Core installation), Microsoft Windows Server 2022, Microsoft Windows Server 2025, Microsoft Windows Server 2025 (Server Core installation) Versions & vendor guidance → |
Not in downloaded KEV | 7.5High |
| CVE-2026-11800Org.keycloak:keycloak-services: keycloak: authentication bypass via jwt algorithm confusion Red Hat Red Hat build of Keycloak 26.6, Red Hat Red Hat build of Keycloak 26.6.4, Red Hat Red Hat Build of Keycloak, Red Hat Red Hat Data Grid 8, Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack, Red Hat Red Hat Single Sign-On 7 Versions & vendor guidance → |
Not in downloaded KEV | 8.1High |
| CVE-2026-117523Dynific Addons for Elementor < 1.3.1 - Subscriber+ Module Settings Update via aep_module AJAX Action Unknown Dynific Addons for Elementor (formerly Anywhere Elementor) Versions & vendor guidance → |
Not in downloaded KEV | 4.3Medium |
| CVE-2026-117522Dynific Addons for Elementor < 1.3.1 - Author+ Stored XSS via Post Title in Post Image Widget Unknown Dynific Addons for Elementor (formerly Anywhere Elementor) Versions & vendor guidance → |
Not in downloaded KEV | 6.8Medium |
| CVE-2026-117521Dynific Addons for Elementor < 1.3.1 - Author+ Stored XSS via Display Name in Post Author Widget Unknown Dynific Addons for Elementor (formerly Anywhere Elementor) Versions & vendor guidance → |
Not in downloaded KEV | 6.8Medium |
| CVE-2026-116928Windows Search Remote Code Execution Vulnerability Microsoft Windows 10 Version 1607, Microsoft Windows 10 Version 1809, Microsoft Windows 10 Version 21H2, Microsoft Windows 10 Version 22H2, Microsoft Windows 11 version 23H2, Microsoft Windows 11 Version 23H2, Microsoft Windows 11 Version 24H2, Microsoft Windows 11 Version 25H2, Microsoft Windows 11 version 26H1, Microsoft Windows 11 Version 26H2, Microsoft Windows Server 2016, Microsoft Windows Server 2016 (Server Core installation), Microsoft Windows Server 2019, Microsoft Windows Server 2019 (Server Core installation), Microsoft Windows Server 2022, Microsoft Windows Server 2025, Microsoft Windows Server 2025 (Server Core installation) Versions & vendor guidance → |
Not in downloaded KEV | 9.8Critical |
| CVE-2026-116779FreeSWITCH: Inbound SIP MESSAGE can select the api chat proto and run FreeSWITCH API commands signalwire freeswitch Versions & vendor guidance → |
Known exploitedCISA KEV | 9.8Critical |
| CVE-2026-116714Windows AppX Deployment Service Elevation of Privilege Vulnerability Microsoft Windows 10 Version 21H2, Microsoft Windows 10 Version 22H2, Microsoft Windows 11 version 23H2, Microsoft Windows 11 Version 23H2, Microsoft Windows Server 2022 Versions & vendor guidance → |
Not in downloaded KEV | 7.8High |
| CVE-2026-116710Windows Message Queuing Remote Code Execution Vulnerability Microsoft Windows 10 Version 1607, Microsoft Windows 10 Version 1809, Microsoft Windows 10 Version 21H2, Microsoft Windows 10 Version 22H2, Microsoft Windows 11 version 23H2, Microsoft Windows 11 Version 23H2, Microsoft Windows 11 Version 24H2, Microsoft Windows 11 Version 25H2, Microsoft Windows 11 version 26H1, Microsoft Windows 11 Version 26H2, Microsoft Windows Server 2016, Microsoft Windows Server 2016 (Server Core installation), Microsoft Windows Server 2019, Microsoft Windows Server 2019 (Server Core installation), Microsoft Windows Server 2022, Microsoft Windows Server 2025, Microsoft Windows Server 2025 (Server Core installation) Versions & vendor guidance → |
Not in downloaded KEV | 8.1High |
| CVE-2026-116672Authlib RFC 7592 examples omit registration-access-token client binding authlib authlib Versions & vendor guidance → |
Not in downloaded KEV | 8.8High |
| CVE-2026-116606Authentication Bypass Allows Global Configuration Restore in Barracuda Email Security Gateway Barracuda Networks Barracuda Email Security Gateway (ESG) Versions & vendor guidance → |
Known exploitedCISA KEV | 9.3Critical |
| CVE-2026-11645Google Chromium V8 Out-of-Bounds Read and Write Vulnerability Google Chrome Versions & vendor guidance → |
Known exploitedCISA KEV | 8.8High |
| CVE-2026-115878Stanza: RCE via pickle deserialization in the lemmatizer stanfordnlp stanza Versions & vendor guidance → |
Not in downloaded KEV | 7.8High |
| CVE-2026-115770Pocket ID: Email verification token remains valid after address change, enabling arbitrary verified-email spoofing pocket-id pocket-id Versions & vendor guidance → |
Not in downloaded KEV | 9.6Critical |
Data sources, freshness & score definitions
The full downloaded KEV catalog is tracked, alongside CVEs found in monitored sources. This is not the entire CVE universe. CVE record enrichment rotates in bounded batches; missing fields remain unknown.
CISA KEV: checked 13 Nov 2026, 00:20 Jerusalem · 1779 records
CVE Program: checked 13 Nov 2026, 00:20 Jerusalem · 117 records · 3 records unavailable
FIRST EPSS: checked 13 Nov 2026, 00:20 Jerusalem · 2223 records
CVSS describes reported technical severity. EPSS estimates exploitation probability in the next 30 days. KEV inclusion records known exploitation, not whether your own systems are exposed.