CVE tracker — Exploitation, versions & score history

Scroll across the table to compare exploitation and severity.

Matching CVEs and exploitation evidence. CVSS measures reported severity. Unknown scores are not zero.
CVE / vulnerability	Exploitation	CVSS
CVE-2026-103537 CVE-2026-103537 Thelia Thelia Versions & vendor guidance →	Not in downloaded KEV	5.4Medium
CVE-2026-103535 CVE-2026-103535 Thelia Thelia Versions & vendor guidance →	Not in downloaded KEV	8.8High
CVE-2026-103529 CVE-2026-103529 Thelia Thelia Versions & vendor guidance →	Not in downloaded KEV	5.4Medium
CVE-2026-103528 CVE-2026-103528 Thelia Thelia Versions & vendor guidance →	Not in downloaded KEV	5.4Medium
CVE-2026-103527 CVE-2026-103527 Thelia Thelia Versions & vendor guidance →	Not in downloaded KEV	6.1Medium
CVE-2026-103526 CVE-2026-103526 Thelia Thelia Versions & vendor guidance →	Not in downloaded KEV	3.7Low
CVE-2026-103524 CVE-2026-103524 Thelia Thelia Versions & vendor guidance →	Not in downloaded KEV	4.8Medium
CVE-2026-103523 CVE-2026-103523 Thelia Thelia Versions & vendor guidance →	Not in downloaded KEV	6.1Medium
CVE-2026-103522 CVE-2026-103522 Thelia Thelia Versions & vendor guidance →	Not in downloaded KEV	7.2High
CVE-2026-103521 CVE-2026-103521 Thelia Thelia Versions & vendor guidance →	Not in downloaded KEV	7.2High
CVE-2026-103435 Arbitrary File Write via Write-Time Symlink Following (TOCTOU) in Claude Code Anthropic @anthropic-ai/claude-code Versions & vendor guidance →	Not in downloaded KEV	7.7High
CVE-2026-103022 Urwid: handle_short_request() crashes on non-ASCII POST body (UnicodeEncodeError DoS) urwid urwid Versions & vendor guidance →	Not in downloaded KEV	5.3Medium
CVE-2026-103012 CVE-2026-103012 Anthropic @anthropic-ai/claude-code Versions & vendor guidance →	Not in downloaded KEV	2Low
CVE-2026-102895 GPUStack: Authentication bypass via trusted loopback source (reverse-proxy TCP peer or X-GPUStack-Real-IP header) grants unauthenticated admin gpustack gpustack Versions & vendor guidance →	Known exploitedCISA KEV	9.8Critical
CVE-2026-102764 Improper Origin Validation in Internal Messaging Components of BeyondTrust Remote Support BeyondTrust Remote Support Versions & vendor guidance →	Known exploitedCISA KEV	9.3Critical
CVE-2026-102657 esm.sh: web.NewHandler allows arbitrary file read via encoded dot-segment path traversal esm-dev esm.sh Versions & vendor guidance →	Not in downloaded KEV	7.5High
CVE-2026-102610 fast-agent: `fast-agent serve` binds HTTP to 0.0.0.0 with no authentication by default; with --shell this is unauthenticated remote command execution evalstate fast-agent Versions & vendor guidance →	Not in downloaded KEV	6.4Medium
CVE-2026-102340 Telepresence: Traffic Manager gRPC has no auth — any pod claims arbitrary namespace and intercepts services, receiving victim environment secrets telepresenceio telepresence Versions & vendor guidance →	Not in downloaded KEV	8.5High
CVE-2026-102339 Telepresence: Tunnel endpoint accepts caller-supplied session ID with no ownership proof — active client sessions hijackable telepresenceio telepresence Versions & vendor guidance →	Not in downloaded KEV	8.2High
CVE-2026-102289 zizmor: Debug logging prints available GitHub credentials in cleartext zizmorcore zizmor Versions & vendor guidance →	Not in downloaded KEV	7High
CVE-2026-102255 CVE-2026-102255 SonicWall SMA1000 Versions & vendor guidance →	Not in downloaded KEV	10Critical
CVE-2026-102224 Azure CycleCloud Elevation of Privilege Vulnerability Microsoft Azure CycleCloud 8.9.1 Versions & vendor guidance →	Not in downloaded KEV	8.4High
CVE-2026-100408 Git for Windows: git-credential-wincred Erase Path Heap Overflow git-for-windows git Versions & vendor guidance →	Not in downloaded KEV	4.4Medium
CVE-2026-100204 HEIF Image Extensions Remote Code Execution Vulnerability Microsoft HEIF Image Extension Versions & vendor guidance →	Not in downloaded KEV	7High
CVE-2026-0621 MCP TypeScript SDK UriTemplate Exploded Array Pattern ReDoS Anthropic MCP TypeScript SDK Versions & vendor guidance →	Not in downloaded KEV	8.7High

Data sources, freshness & score definitions

The full downloaded KEV catalog is tracked, alongside CVEs found in monitored sources. This is not the entire CVE universe. CVE record enrichment rotates in bounded batches; missing fields remain unknown.

CISA KEV: checked 13 Nov 2026, 00:20 Jerusalem · 1779 records

CVE Program: checked 13 Nov 2026, 00:20 Jerusalem · 117 records · 3 records unavailable

FIRST EPSS: checked 13 Nov 2026, 00:20 Jerusalem · 2223 records

CVSS describes reported technical severity. EPSS estimates exploitation probability in the next 30 days. KEV inclusion records known exploitation, not whether your own systems are exposed.