CVE tracker
Scroll across the table to compare exploitation and severity.
| CVE / vulnerability | Exploitation | CVSS |
|---|---|---|
| CVE-2026-109469Entra Device Registration Elevation of Privilege Vulnerability Microsoft Entra Device Registration Versions & vendor guidance → |
Not in downloaded KEV | 10Critical |
| CVE-2026-109467Azure DevOps Server Remote Code Execution Vulnerability Microsoft Azure DevOps, Microsoft Azure DevOps Server 2025 Versions & vendor guidance → |
Not in downloaded KEV | 9.9Critical |
| CVE-2026-109462Azure Firmware Security Feature Bypass Vulnerability Microsoft Azure Virtual Machines Versions & vendor guidance → |
Not in downloaded KEV | 4.4Medium |
| CVE-2026-109459Windows Message Queuing Queue Manager Remote Code Execution Vulnerability Microsoft Windows 10 Version 1607, Microsoft Windows 10 Version 1809, Microsoft Windows 10 Version 21H2, Microsoft Windows 10 Version 22H2, Microsoft Windows 11 version 23H2, Microsoft Windows 11 Version 23H2, Microsoft Windows 11 Version 24H2, Microsoft Windows 11 Version 25H2, Microsoft Windows 11 version 26H1, Microsoft Windows 11 Version 26H2, Microsoft Windows Server 2016, Microsoft Windows Server 2016 (Server Core installation), Microsoft Windows Server 2019, Microsoft Windows Server 2019 (Server Core installation), Microsoft Windows Server 2022, Microsoft Windows Server 2025, Microsoft Windows Server 2025 (Server Core installation) Versions & vendor guidance → |
Not in downloaded KEV | 8.1High |
| CVE-2026-109457Azure CLI Remote Code Execution Vulnerability Microsoft Azure Machine Learning Versions & vendor guidance → |
Not in downloaded KEV | 8High |
| CVE-2026-108262DDEV incomplete tar symlink traversal fix allows host file overwrite - Incomplete fix of CVE-2026-32885 ddev ddev Versions & vendor guidance → |
Not in downloaded KEV | 6.5Medium |
| CVE-2026-107441CVE-2026-107441 Zyxel GS1900-24E firmware, Zyxel GS1900-8 firmware, Zyxel GS1900-8HP firmware, Zyxel GS1900-10HP firmware, Zyxel GS1900-16 firmware, Zyxel GS1900-24 firmware, Zyxel GS1900-24EP firmware, Zyxel GS1900-HPv2 firmware, Zyxel GS1900-48 firmware, Zyxel GS1900-48HPv2 firmware Versions & vendor guidance → |
Not in downloaded KEV | 8.8High |
| CVE-2026-107248CVE-2026-107248 Thelia Thelia Versions & vendor guidance → |
Not in downloaded KEV | 8.8High |
| CVE-2026-106931EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability EG Secure Solutions Inc. SiteGuard Server Edition for Apache httpd, EG Secure Solutions Inc. SiteGuard Server Edition for Nginx, EG Secure Solutions Inc. SiteGuard Server Edition for IIS, EG Secure Solutions Inc. SiteGuard Server Edition for Apache httpd on FreeBSD, EG Secure Solutions Inc. SiteGuard Server Edition for Nginx on FreeBSD Versions & vendor guidance → |
Known exploitedCISA KEV | 8.5High |
| CVE-2026-105769kaniko can send the build's Azure (Entra ID) access token to lookalike ACR registry hosts chainguard kaniko Reported fix guidance → |
Not in downloaded KEV | 9.3Critical |
| CVE-2026-105734Azure Local Elevation of Privilege Vulnerability Microsoft Azure Local Versions & vendor guidance → |
Not in downloaded KEV | 7High |
| CVE-2026-105581Desktop Window Manager Elevation of Privilege Vulnerability Microsoft Windows 11 version 23H2, Microsoft Windows 11 Version 23H2, Microsoft Windows 11 Version 24H2, Microsoft Windows 11 Version 25H2, Microsoft Windows 11 version 26H1, Microsoft Windows 11 Version 26H2, Microsoft Windows Server 2022, Microsoft Windows Server 2025, Microsoft Windows Server 2025 (Server Core installation) Versions & vendor guidance → |
Not in downloaded KEV | 8.8High |
| CVE-2026-105568Windows Active Directory Domain Services Denial of Service Vulnerability Microsoft Windows 10 Version 1607, Microsoft Windows 10 Version 1809, Microsoft Windows 10 Version 21H2, Microsoft Windows 10 Version 22H2, Microsoft Windows 11 version 23H2, Microsoft Windows 11 Version 23H2, Microsoft Windows 11 Version 24H2, Microsoft Windows 11 Version 25H2, Microsoft Windows 11 version 26H1, Microsoft Windows 11 Version 26H2, Microsoft Windows Server 2016, Microsoft Windows Server 2016 (Server Core installation), Microsoft Windows Server 2019, Microsoft Windows Server 2019 (Server Core installation), Microsoft Windows Server 2022, Microsoft Windows Server 2025, Microsoft Windows Server 2025 (Server Core installation) Versions & vendor guidance → |
Not in downloaded KEV | 6.5Medium |
| CVE-2026-105537Mailslot File System Information Disclosure Vulnerability Microsoft Windows 10 Version 1607, Microsoft Windows 10 Version 1809, Microsoft Windows 10 Version 21H2, Microsoft Windows 10 Version 22H2, Microsoft Windows 11 version 23H2, Microsoft Windows 11 Version 23H2, Microsoft Windows 11 Version 24H2, Microsoft Windows 11 Version 25H2, Microsoft Windows 11 version 26H1, Microsoft Windows 11 Version 26H2, Microsoft Windows Server 2016, Microsoft Windows Server 2016 (Server Core installation), Microsoft Windows Server 2019, Microsoft Windows Server 2019 (Server Core installation), Microsoft Windows Server 2022, Microsoft Windows Server 2025, Microsoft Windows Server 2025 (Server Core installation) Versions & vendor guidance → |
Not in downloaded KEV | 5.5Medium |
| CVE-2026-105528Desktop Window Manager Elevation of Privilege Vulnerability Microsoft Windows 11 version 23H2, Microsoft Windows 11 Version 23H2, Microsoft Windows 11 Version 24H2, Microsoft Windows 11 Version 25H2, Microsoft Windows 11 version 26H1, Microsoft Windows 11 Version 26H2, Microsoft Windows Server 2025, Microsoft Windows Server 2025 (Server Core installation) Versions & vendor guidance → |
Not in downloaded KEV | 7.8High |
| CVE-2026-105524Windows Management Instrumentation Elevation of Privilege Vulnerability Microsoft Windows 10 Version 1607, Microsoft Windows 10 Version 1809, Microsoft Windows 10 Version 21H2, Microsoft Windows 10 Version 22H2, Microsoft Windows 11 version 23H2, Microsoft Windows 11 Version 23H2, Microsoft Windows 11 Version 24H2, Microsoft Windows 11 Version 25H2, Microsoft Windows 11 version 26H1, Microsoft Windows 11 Version 26H2, Microsoft Windows Server 2016, Microsoft Windows Server 2016 (Server Core installation), Microsoft Windows Server 2019, Microsoft Windows Server 2019 (Server Core installation), Microsoft Windows Server 2022, Microsoft Windows Server 2025, Microsoft Windows Server 2025 (Server Core installation) Versions & vendor guidance → |
Not in downloaded KEV | 7.8High |
| CVE-2026-105501Windows Installer Elevation of Privilege Vulnerability Microsoft Windows 10 Version 1607, Microsoft Windows 10 Version 1809, Microsoft Windows 10 Version 21H2, Microsoft Windows 10 Version 22H2, Microsoft Windows 11 version 23H2, Microsoft Windows 11 Version 23H2, Microsoft Windows 11 Version 24H2, Microsoft Windows 11 Version 25H2, Microsoft Windows 11 version 26H1, Microsoft Windows 11 Version 26H2, Microsoft Windows Server 2016, Microsoft Windows Server 2016 (Server Core installation), Microsoft Windows Server 2019, Microsoft Windows Server 2019 (Server Core installation), Microsoft Windows Server 2022, Microsoft Windows Server 2025, Microsoft Windows Server 2025 (Server Core installation) Versions & vendor guidance → |
Not in downloaded KEV | 7.8High |
| CVE-2026-105494Azure NFS mount helper (aznfs) Elevation of Privilege Vulnerability Microsoft aznfs Versions & vendor guidance → |
Not in downloaded KEV | 7.8High |
| CVE-2026-105134Ahsay AhsayCBS Replication Receiver UpdateReceivers.do os command injection Ahsay AhsayCBS Versions & vendor guidance → |
Known exploitedCISA KEV | 10Critical |
| CVE-2026-105133Ahsay AhsayCBS API ApiStructsAction.java checkSysPwd improper authentication Ahsay AhsayCBS Versions & vendor guidance → |
Known exploitedCISA KEV | 6.9Medium |
| CVE-2026-104937CVE-2026-104937 Shopware Shopware Versions & vendor guidance → |
Not in downloaded KEV | 8.1High |
| CVE-2026-104935Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability Ivanti Connect Secure Versions & vendor guidance → |
Known exploitedCISA KEV | 8.6High |
| CVE-2026-104850MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server modelcontextprotocol typescript-sdk Versions & vendor guidance → |
Not in downloaded KEV | 7.5High |
| CVE-2026-104120modelcontextprotocol mcp-server-fetch/mcp-server-everything Fetch Tool server.py fetch_url server-side request forgery modelcontextprotocol mcp-server-fetch, modelcontextprotocol mcp-server-everything Versions & vendor guidance → |
Not in downloaded KEV | 6.9Medium |
| CVE-2026-104080Control Web Panel (CWP) < 1.29 OS Command Injection via valid_token Control Web Panel Control Web Panel Versions & vendor guidance → |
Not in downloaded KEV | 8.5High |
Data sources, freshness & score definitions
The full downloaded KEV catalog is tracked, alongside CVEs found in monitored sources. This is not the entire CVE universe. CVE record enrichment rotates in bounded batches; missing fields remain unknown.
CISA KEV: checked 13 Nov 2026, 00:20 Jerusalem · 1779 records
CVE Program: checked 13 Nov 2026, 00:20 Jerusalem · 117 records · 3 records unavailable
FIRST EPSS: checked 13 Nov 2026, 00:20 Jerusalem · 2223 records
CVSS describes reported technical severity. EPSS estimates exploitation probability in the next 30 days. KEV inclusion records known exploitation, not whether your own systems are exposed.