CVE tracker
Scroll across the table to compare exploitation and severity.
| CVE / vulnerability | Exploitation | CVSS |
|---|---|---|
| CVE-2026-112745Azure DevOps Server Information Disclosure Vulnerability Microsoft Azure DevOps, Microsoft Azure DevOps Server Versions & vendor guidance → |
Not in downloaded KEV | 6.5Medium |
| CVE-2026-111793Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability Openwave Messaging (Ireland) Limited Webtop Media Transcoder Versions & vendor guidance → |
Known exploitedCISA KEV | 4.3Medium |
| CVE-2026-111771Model Context Protocol TypeScript SDK: Server bearer authentication accepted tokens issued for another service modelcontextprotocol typescript-sdk, @modelcontextprotocol sdk, @modelcontextprotocol server, @modelcontextprotocol express, @modelcontextprotocol server-legacy Versions & vendor guidance → |
Not in downloaded KEV | 6.8Medium |
| CVE-2026-111770Model Context Protocol TypeScript SDK: Shared transport or server instances delivered one HTTP client's messages to another modelcontextprotocol typescript-sdk, @modelcontextprotocol server Versions & vendor guidance → |
Not in downloaded KEV | 7.7High |
| CVE-2026-111769Model Context Protocol TypeScript SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request bodies modelcontextprotocol typescript-sdk, @modelcontextprotocol sdk, @modelcontextprotocol client Versions & vendor guidance → |
Not in downloaded KEV | 6.5Medium |
| CVE-2026-111768Model Context Protocol TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation modelcontextprotocol typescript-sdk, @modelcontextprotocol server, @modelcontextprotocol sdk Versions & vendor guidance → |
Not in downloaded KEV | 7.5High |
| CVE-2026-111767MCP TypeScript SDK: Experimental tasks were not tied to the session that created them modelcontextprotocol typescript-sdk Versions & vendor guidance → |
Not in downloaded KEV | 8.6High |
| CVE-2026-111579Forminator Forms 1.58.0 - 1.58.3 - Unauthenticated Privilege Escalation via Paid Registration Form When Stripe Gateway Unavailable Unknown Forminator Forms Versions & vendor guidance → |
Not in downloaded KEV | 8.1High |
| CVE-2026-111560OS Command Injection in Barracuda Appliances Barracuda Networks Barracuda Email Security Gateway (ESG), Barracuda Networks Barracuda Load Balancer Application Delivery Controller (ADC), Barracuda Networks Barracuda Web Application Firewall (WAF), Barracuda Networks Barracuda Web Security Gateway (WSG), Barracuda Networks Barracuda Message Archiver (BMA), Barracuda Networks Barracuda WAF Control Center (WCC) Versions & vendor guidance → |
Known exploitedCISA KEV | 8.6High |
| CVE-2026-111497Out-of-Bounds Write in Google Brotli Decoder Google Brotli Reported fix guidance → |
Known exploitedCISA KEV | 9.2Critical |
| CVE-2026-111357Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability Ivanti Connect Secure Versions & vendor guidance → |
Known exploitedCISA KEV | 7High |
| CVE-2026-111309Microsoft Office Outlook Remote Code Execution Vulnerability Microsoft Microsoft 365 Apps for Enterprise, Microsoft Microsoft Office LTSC 2021, Microsoft Microsoft Office LTSC 2024 Versions & vendor guidance → |
Not in downloaded KEV | 8.8High |
| CVE-2026-111289Microsoft Office Remote Code Execution Vulnerability Microsoft Microsoft 365 Apps for Enterprise, Microsoft Microsoft Office 365 for Mac, Microsoft Microsoft Office LTSC 2021, Microsoft Microsoft Office LTSC 2024, Microsoft Microsoft Office LTSC for Mac 2021, Microsoft Microsoft Office LTSC for Mac 2024 Versions & vendor guidance → |
Not in downloaded KEV | 8.8High |
| CVE-2026-111285Microsoft Office Word Remote Code Execution Vulnerability Microsoft Microsoft 365 Apps for Enterprise, Microsoft Microsoft Office 365 for Mac, Microsoft Microsoft Office LTSC 2021, Microsoft Microsoft Office LTSC 2024, Microsoft Microsoft Office LTSC for Mac 2021, Microsoft Microsoft Office LTSC for Mac 2024 Versions & vendor guidance → |
Not in downloaded KEV | 8.8High |
| CVE-2026-110936Siemens Software Center Uncontrolled Search Path Element Vulnerability Siemens Siemens Software Center Versions & vendor guidance → |
Known exploitedCISA KEV | 8.4High |
| CVE-2026-110447Collabora Online – Built-in CODE Server OS Command Injection Vulnerability Collabora Collabora Online - Built-in CODE Server Versions & vendor guidance → |
Known exploitedCISA KEV | 9.2Critical |
| CVE-2026-110068Microsoft Office Outlook Remote Code Execution Vulnerability Microsoft Microsoft 365 Apps for Enterprise, Microsoft Microsoft Office 365 for Mac, Microsoft Microsoft Office LTSC 2021, Microsoft Microsoft Office LTSC 2024, Microsoft Microsoft Office LTSC for Mac 2021, Microsoft Microsoft Office LTSC for Mac 2024 Versions & vendor guidance → |
Not in downloaded KEV | 8.8High |
| CVE-2026-110067Microsoft Office Word Remote Code Execution Vulnerability Microsoft Microsoft 365 Apps for Enterprise, Microsoft Microsoft Office 365 for Mac, Microsoft Microsoft Office LTSC 2021, Microsoft Microsoft Office LTSC 2024, Microsoft Microsoft Office LTSC for Mac 2021, Microsoft Microsoft Office LTSC for Mac 2024 Versions & vendor guidance → |
Not in downloaded KEV | 8.8High |
| CVE-2026-110047Microsoft Office Word Remote Code Execution Vulnerability Microsoft Microsoft 365 Apps for Enterprise, Microsoft Microsoft Office 365 for Mac, Microsoft Microsoft Office LTSC 2021, Microsoft Microsoft Office LTSC 2024, Microsoft Microsoft Office LTSC for Mac 2021, Microsoft Microsoft Office LTSC for Mac 2024 Versions & vendor guidance → |
Not in downloaded KEV | 8.8High |
| CVE-2026-110043Microsoft Office Outlook Remote Code Execution Vulnerability Microsoft Microsoft 365 Apps for Enterprise, Microsoft Microsoft Office LTSC 2021, Microsoft Microsoft Office LTSC 2024 Versions & vendor guidance → |
Not in downloaded KEV | 8.8High |
| CVE-2026-110005Moghtech Komodo contains an OS command injection vulnerability Komodo Komodo Versions & vendor guidance → |
Not in downloaded KEV | 8.8High |
| CVE-2026-109619RCE via stale global state PHP Group PHP Reported workaround → |
Known exploitedCISA KEV | 9.2Critical |
| CVE-2026-109618RCE via OOM corruption PHP Group PHP Reported workaround → |
Known exploitedCISA KEV | 9.2Critical |
| CVE-2026-109481ASP.NET Core Elevation of Privilege Vulnerability Microsoft .NET 11.0 installed on Linux, Microsoft .NET 11.0 installed on Mac OS, Microsoft .NET 11.0 installed on Windows, Microsoft Microsoft Visual Studio 2026 version 18.12 Versions & vendor guidance → |
Not in downloaded KEV | 7.5High |
| CVE-2026-109473Windows Kernel Elevation of Privilege Vulnerability Microsoft Windows 10 Version 1607, Microsoft Windows 10 Version 1809, Microsoft Windows 10 Version 21H2, Microsoft Windows 10 Version 22H2, Microsoft Windows 11 version 23H2, Microsoft Windows 11 Version 23H2, Microsoft Windows 11 Version 24H2, Microsoft Windows 11 Version 25H2, Microsoft Windows 11 version 26H1, Microsoft Windows 11 Version 26H2, Microsoft Windows Server 2016, Microsoft Windows Server 2016 (Server Core installation), Microsoft Windows Server 2019, Microsoft Windows Server 2019 (Server Core installation), Microsoft Windows Server 2022, Microsoft Windows Server 2025, Microsoft Windows Server 2025 (Server Core installation) Versions & vendor guidance → |
Not in downloaded KEV | 7.8High |
Data sources, freshness & score definitions
The full downloaded KEV catalog is tracked, alongside CVEs found in monitored sources. This is not the entire CVE universe. CVE record enrichment rotates in bounded batches; missing fields remain unknown.
CISA KEV: checked 13 Nov 2026, 00:20 Jerusalem · 1779 records
CVE Program: checked 13 Nov 2026, 00:20 Jerusalem · 117 records · 3 records unavailable
FIRST EPSS: checked 13 Nov 2026, 00:20 Jerusalem · 2223 records
CVSS describes reported technical severity. EPSS estimates exploitation probability in the next 30 days. KEV inclusion records known exploitation, not whether your own systems are exposed.