CVE tracker — Exploitation, versions & score history

Scroll across the table to compare exploitation and severity.

Matching CVEs and exploitation evidence. CVSS measures reported severity. Unknown scores are not zero.
CVE / vulnerability	Exploitation	CVSS
CVE-2026-119382 Windows TPM Elevation of Privilege Vulnerability Microsoft Windows 10 Version 1607, Microsoft Windows 10 Version 1809, Microsoft Windows 10 Version 21H2, Microsoft Windows 10 Version 22H2, Microsoft Windows 11 version 23H2, Microsoft Windows 11 Version 23H2, Microsoft Windows 11 Version 24H2, Microsoft Windows 11 Version 25H2, Microsoft Windows 11 version 26H1, Microsoft Windows 11 Version 26H2, Microsoft Windows Server 2016, Microsoft Windows Server 2016 (Server Core installation), Microsoft Windows Server 2019, Microsoft Windows Server 2019 (Server Core installation), Microsoft Windows Server 2022, Microsoft Windows Server 2025, Microsoft Windows Server 2025 (Server Core installation) Versions & vendor guidance →	Not in downloaded KEV	7.8High
CVE-2026-119298 croc: Overwrite-confirmation bypass via a crafted "croc-stdin-" filename on receive schollz croc Versions & vendor guidance →	Not in downloaded KEV	4.2Medium
CVE-2026-119209 pypdf: Possible large memory usage when parsing cross-reference streams py-pdf pypdf Versions & vendor guidance →	Not in downloaded KEV	7.1High
CVE-2026-119208 pypdf: Possible long runtimes/large memory usage for encrypted PDF files py-pdf pypdf Versions & vendor guidance →	Not in downloaded KEV	7.1High
CVE-2026-119207 pypdf: Possible large memory usage for exceptions in strict mode py-pdf pypdf Versions & vendor guidance →	Not in downloaded KEV	7.1High
CVE-2026-119206 pypdf: Possible long runtimes when retrieving page labels py-pdf pypdf Versions & vendor guidance →	Not in downloaded KEV	7.1High
CVE-2026-119205 pypdf: Possible infinite loop when cloning dictionaries py-pdf pypdf Versions & vendor guidance →	Not in downloaded KEV	7.1High
CVE-2026-119204 pypdf: Possible large memory usage when parsing page tree py-pdf pypdf Versions & vendor guidance →	Not in downloaded KEV	7.1High
CVE-2026-119203 pypdf: Possible infinite loop when hitting EOF in standard xref table during trailer search py-pdf pypdf Versions & vendor guidance →	Not in downloaded KEV	7.1High
CVE-2026-119202 @hapi/content: quadratic-time parsing of Content-Disposition parameters allows denial of service hapijs content Versions & vendor guidance →	Not in downloaded KEV	7.5High
CVE-2026-119197 pyasn1: Quadratic-complexity denial of service in binary REAL decoding pyasn1 pyasn1 Versions & vendor guidance →	Not in downloaded KEV	7.5High
CVE-2026-119196 pyasn1: Quadratic CPU consumption in constructed BIT STRING decoding pyasn1 pyasn1 Versions & vendor guidance →	Not in downloaded KEV	7.5High
CVE-2026-119195 pyasn1: Quadratic-time denial of service in constructed string and indefinite-length ANY decoding pyasn1 pyasn1 Versions & vendor guidance →	Not in downloaded KEV	7.5High
CVE-2026-119194 pyasn1: Quadratic CPU use in schemaless BER/CER/DER container decoding pyasn1 pyasn1 Versions & vendor guidance →	Not in downloaded KEV	7.5High
CVE-2026-119188 Forge: Denial of service in TLS record processing via a record interleaved with a fragmented handshake message digitalbazaar forge Versions & vendor guidance →	Not in downloaded KEV	7.5High
CVE-2026-119187 Forge: Denial of service in TLS record processing via call stack exhaustion digitalbazaar forge Versions & vendor guidance →	Not in downloaded KEV	7.5High
CVE-2026-119186 Forge: AES-GCM authentication bypass via unvalidated tagLength option digitalbazaar forge Versions & vendor guidance →	Not in downloaded KEV	5.9Medium
CVE-2026-118782 Forge: PKCS#12 MAC forgery and constant-key PBE via zero iteration count digitalbazaar forge Versions & vendor guidance →	Not in downloaded KEV	7.5High
CVE-2026-118781 Forge: Denial of Service via infinite loop in BigInteger.modInverse() with negative input (incomplete fix of CVE-2026-33891) digitalbazaar forge Versions & vendor guidance →	Not in downloaded KEV	2.9Low
CVE-2026-118780 Forge: verifyCertificateChain() removes trusted CA certificates with the same subject from the CA store digitalbazaar forge Versions & vendor guidance →	Not in downloaded KEV	3.7Low
CVE-2026-118779 Forge: Regular expression denial of service in PEM decoding (pem.decode) digitalbazaar forge Versions & vendor guidance →	Not in downloaded KEV	7.5High
CVE-2026-118778 Forge: TLS client crash when the server sends no certificate digitalbazaar forge Versions & vendor guidance →	Not in downloaded KEV	5.9Medium
CVE-2026-118777 Forge: Prototype Pollution in forge.http cookie handling via a malicious Set-Cookie digitalbazaar forge Versions & vendor guidance →	Not in downloaded KEV	4.8Medium
CVE-2026-118775 Forge: ASN.1 OID first arc truncation in asn1.oidToDer digitalbazaar forge Versions & vendor guidance →	Not in downloaded KEV	3.7Low
CVE-2026-118773 Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversal isaacs node-glob Versions & vendor guidance →	Not in downloaded KEV	6.3Medium

Data sources, freshness & score definitions

The full downloaded KEV catalog is tracked, alongside CVEs found in monitored sources. This is not the entire CVE universe. CVE record enrichment rotates in bounded batches; missing fields remain unknown.

CISA KEV: checked 13 Nov 2026, 00:20 Jerusalem · 1779 records

CVE Program: checked 13 Nov 2026, 00:20 Jerusalem · 117 records · 3 records unavailable

FIRST EPSS: checked 13 Nov 2026, 00:20 Jerusalem · 2223 records

CVSS describes reported technical severity. EPSS estimates exploitation probability in the next 30 days. KEV inclusion records known exploitation, not whether your own systems are exposed.