CVE tracker
Scroll across the table to compare exploitation and severity.
| CVE / vulnerability | Exploitation | CVSS |
|---|---|---|
| CVE-2026-120792Aspire Information Disclosure Vulnerability Microsoft Aspire.Cli Versions & vendor guidance → |
Not in downloaded KEV | 7.3High |
| CVE-2026-120789Microsoft Office Excel Remote Code Execution Vulnerability Microsoft Microsoft 365 Apps for Enterprise, Microsoft Microsoft Office 365 for Mac, Microsoft Microsoft Office LTSC 2021, Microsoft Microsoft Office LTSC 2024, Microsoft Microsoft Office LTSC for Mac 2021, Microsoft Microsoft Office LTSC for Mac 2024, Microsoft Office Online Server Versions & vendor guidance → |
Not in downloaded KEV | 8.8High |
| CVE-2026-120788Microsoft Office Excel Remote Code Execution Vulnerability Microsoft Microsoft 365 Apps for Enterprise, Microsoft Microsoft Office 365 for Mac, Microsoft Microsoft Office LTSC 2021, Microsoft Microsoft Office LTSC 2024, Microsoft Microsoft Office LTSC for Mac 2021, Microsoft Microsoft Office LTSC for Mac 2024, Microsoft Office Online Server Versions & vendor guidance → |
Not in downloaded KEV | 8.8High |
| CVE-2026-120786Microsoft Office Excel Remote Code Execution Vulnerability Microsoft Microsoft 365 Apps for Enterprise, Microsoft Microsoft Office 365 for Mac, Microsoft Microsoft Office LTSC 2021, Microsoft Microsoft Office LTSC 2024, Microsoft Microsoft Office LTSC for Mac 2021, Microsoft Microsoft Office LTSC for Mac 2024, Microsoft Office Online Server Versions & vendor guidance → |
Not in downloaded KEV | 8.8High |
| CVE-2026-120783Azure DevOps Server Elevation of Privilege Vulnerability Microsoft Azure DevOps Server 2025 Versions & vendor guidance → |
Not in downloaded KEV | 6.4Medium |
| CVE-2026-120778Aspire Elevation of Privilege Vulnerability Microsoft Aspire.Cli Versions & vendor guidance → |
Not in downloaded KEV | 7.3High |
| CVE-2026-120758NULL Pointer Dereference in H5HL_unprotect via Corrupted File The HDF Group HDF5 Versions & vendor guidance → |
Not in downloaded KEV | 5.4Medium |
| CVE-2026-120756Heap Buffer Over-read via Malformed Message Size in HDF5's H5O__chunk_deserialize The HDF Group HDF5 Versions & vendor guidance → |
Not in downloaded KEV | 1.9Low |
| CVE-2026-120755Integer Underflow Leads to Out-of-Bounds Read via Truncated Chunk in HDF5 Szip Filter The HDF Group Szip Filter Versions & vendor guidance → |
Not in downloaded KEV | 4.7Medium |
| CVE-2026-120754Uninitialized Heap Memory Disclosure via Truncated Chunk in HDF5 Scale-Offset Filter The HDF Group Scale-Offset Filter Versions & vendor guidance → |
Not in downloaded KEV | 1.9Low |
| CVE-2026-120689Uncontrolled Recursion in HDF5 H5B__iterate_helper() via Crafted File The HDF Group HDF5 Versions & vendor guidance → |
Not in downloaded KEV | 4.3Medium |
| CVE-2026-120651CGI versions before 5.00 for Perl allow an infinite loop on a short request body when $DISABLE_UPLOADS is set Product details not yet enriched Reported fix guidance → |
Not in downloaded KEV | 7.5High |
| CVE-2026-120650CGI versions before 5.00 for Perl allow memory, CPU and disk exhaustion via missing or unenforced request size, parameter and upload limits Product details not yet enriched Reported fix guidance → |
Not in downloaded KEV | 6.5Medium |
| CVE-2026-120648CGI versions before 5.00 for Perl allow HTML injection via text containing --> in comment Product details not yet enriched Reported fix guidance → |
Not in downloaded KEV | 6.1Medium |
| CVE-2026-120647CGI versions before 5.00 for Perl allow Content-Disposition parameter injection via unescaped double quotes in the header attachment filename Product details not yet enriched Reported fix guidance → |
Not in downloaded KEV | 9.8Critical |
| CVE-2026-120645CGI versions before 5.00 for Perl allow denial of service via submitted values used as a regex for optgroup selection in scrolling_list Product details not yet enriched Reported fix guidance → |
Not in downloaded KEV | 7.5High |
| CVE-2026-120644CGI::Cookie versions before 5.00 for Perl allow cookie attribute injection via unvalidated path, domain and expires values Product details not yet enriched Reported fix guidance → |
Not in downloaded KEV | 9.1Critical |
| CVE-2026-120642CGI versions before 5.00 for Perl return request-derived values untainted under taint mode Product details not yet enriched Reported fix guidance → |
Not in downloaded KEV | 9.1Critical |
| CVE-2026-120422Insecure HTTP configuration retrieval in Sogou Input Method allows arbitrary code execution Sogou Sogou Input Method Versions & vendor guidance → |
Not in downloaded KEV | 8.9High |
| CVE-2026-120006Aspire Elevation of Privilege Vulnerability Microsoft Aspire.Hosting, Microsoft Aspire.Hosting.AppHost Versions & vendor guidance → |
Not in downloaded KEV | 7.5High |
| CVE-2026-120005Microsoft PowerPoint Remote Code Execution Vulnerability Microsoft Microsoft 365 Apps for Enterprise, Microsoft Microsoft Office LTSC 2021, Microsoft Microsoft Office LTSC 2024 Versions & vendor guidance → |
Not in downloaded KEV | 8.8High |
| CVE-2026-120003Microsoft Office Remote Code Execution Vulnerability Microsoft Microsoft 365 Apps for Enterprise, Microsoft Microsoft Office 365 for Mac, Microsoft Microsoft Office LTSC 2021, Microsoft Microsoft Office LTSC 2024, Microsoft Microsoft Office LTSC for Mac 2021, Microsoft Microsoft Office LTSC for Mac 2024 Versions & vendor guidance → |
Not in downloaded KEV | 8.8High |
| CVE-2026-119992Windows HTTP.sys Elevation of Privilege Vulnerability Microsoft Windows 10 Version 1607, Microsoft Windows 10 Version 1809, Microsoft Windows 10 Version 21H2, Microsoft Windows 10 Version 22H2, Microsoft Windows 11 version 23H2, Microsoft Windows 11 Version 23H2, Microsoft Windows 11 Version 24H2, Microsoft Windows 11 Version 25H2, Microsoft Windows 11 version 26H1, Microsoft Windows 11 Version 26H2, Microsoft Windows Server 2016, Microsoft Windows Server 2016 (Server Core installation), Microsoft Windows Server 2019, Microsoft Windows Server 2019 (Server Core installation), Microsoft Windows Server 2022, Microsoft Windows Server 2025, Microsoft Windows Server 2025 (Server Core installation) Versions & vendor guidance → |
Not in downloaded KEV | 7High |
| CVE-2026-119990Azure OpenAI Elevation of Privilege Vulnerability Microsoft Azure Open AI Versions & vendor guidance → |
Not in downloaded KEV | 9.8Critical |
| CVE-2026-119989Azure Pipelines Remote Code Execution Vulnerability Microsoft Azure Web Apps Versions & vendor guidance → |
Not in downloaded KEV | 8.2High |
Data sources, freshness & score definitions
The full downloaded KEV catalog is tracked, alongside CVEs found in monitored sources. This is not the entire CVE universe. CVE record enrichment rotates in bounded batches; missing fields remain unknown.
CISA KEV: checked 13 Nov 2026, 00:20 Jerusalem · 1779 records
CVE Program: checked 13 Nov 2026, 00:20 Jerusalem · 117 records · 3 records unavailable
FIRST EPSS: checked 13 Nov 2026, 00:20 Jerusalem · 2223 records
CVSS describes reported technical severity. EPSS estimates exploitation probability in the next 30 days. KEV inclusion records known exploitation, not whether your own systems are exposed.