CVE tracker
Scroll across the table to compare exploitation and severity.
| CVE / vulnerability | Exploitation | CVSS |
|---|---|---|
| CVE-2026-118207Microsoft Exchange Server Remote Code Execution Vulnerability Microsoft Microsoft Exchange Server Subscription Edition RTM Versions & vendor guidance → |
Not in downloaded KEV | 8.8High |
| CVE-2026-118148Active Directory Domain Services Elevation of Privilege Vulnerability Microsoft Windows 10 Version 1607, Microsoft Windows 10 Version 1809, Microsoft Windows 10 Version 21H2, Microsoft Windows 10 Version 22H2, Microsoft Windows 11 version 23H2, Microsoft Windows 11 Version 23H2, Microsoft Windows 11 Version 24H2, Microsoft Windows 11 Version 25H2, Microsoft Windows 11 version 26H1, Microsoft Windows 11 Version 26H2, Microsoft Windows Server 2016, Microsoft Windows Server 2016 (Server Core installation), Microsoft Windows Server 2019, Microsoft Windows Server 2019 (Server Core installation), Microsoft Windows Server 2022, Microsoft Windows Server 2025, Microsoft Windows Server 2025 (Server Core installation) Versions & vendor guidance → |
Not in downloaded KEV | 7.5High |
| CVE-2026-118146Windows Active Directory Domain Services Remote Code Execution Vulnerability Microsoft Windows 10 Version 1607, Microsoft Windows 10 Version 1809, Microsoft Windows 10 Version 21H2, Microsoft Windows 10 Version 22H2, Microsoft Windows 11 version 23H2, Microsoft Windows 11 Version 23H2, Microsoft Windows 11 Version 24H2, Microsoft Windows 11 Version 25H2, Microsoft Windows 11 version 26H1, Microsoft Windows 11 Version 26H2, Microsoft Windows Server 2016, Microsoft Windows Server 2016 (Server Core installation), Microsoft Windows Server 2019, Microsoft Windows Server 2019 (Server Core installation), Microsoft Windows Server 2022, Microsoft Windows Server 2025, Microsoft Windows Server 2025 (Server Core installation) Versions & vendor guidance → |
Not in downloaded KEV | 8.8High |
| CVE-2026-118145Windows Function Discovery SSDP Provider Remote Code Execution Vulnerability Microsoft Windows 10 Version 1607, Microsoft Windows 10 Version 1809, Microsoft Windows 10 Version 21H2, Microsoft Windows 10 Version 22H2, Microsoft Windows 11 version 23H2, Microsoft Windows 11 Version 23H2, Microsoft Windows 11 Version 24H2, Microsoft Windows 11 Version 25H2, Microsoft Windows 11 version 26H1, Microsoft Windows 11 Version 26H2, Microsoft Windows Server 2016, Microsoft Windows Server 2016 (Server Core installation), Microsoft Windows Server 2019, Microsoft Windows Server 2019 (Server Core installation), Microsoft Windows Server 2022, Microsoft Windows Server 2025, Microsoft Windows Server 2025 (Server Core installation) Versions & vendor guidance → |
Not in downloaded KEV | 7.5High |
| CVE-2026-11800Org.keycloak:keycloak-services: keycloak: authentication bypass via jwt algorithm confusion Red Hat Red Hat build of Keycloak 26.6, Red Hat Red Hat build of Keycloak 26.6.4, Red Hat Red Hat Build of Keycloak, Red Hat Red Hat Data Grid 8, Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack, Red Hat Red Hat Single Sign-On 7 Versions & vendor guidance → |
Not in downloaded KEV | 8.1High |
| CVE-2026-117523Dynific Addons for Elementor < 1.3.1 - Subscriber+ Module Settings Update via aep_module AJAX Action Unknown Dynific Addons for Elementor (formerly Anywhere Elementor) Versions & vendor guidance → |
Not in downloaded KEV | 4.3Medium |
| CVE-2026-117522Dynific Addons for Elementor < 1.3.1 - Author+ Stored XSS via Post Title in Post Image Widget Unknown Dynific Addons for Elementor (formerly Anywhere Elementor) Versions & vendor guidance → |
Not in downloaded KEV | 6.8Medium |
| CVE-2026-117521Dynific Addons for Elementor < 1.3.1 - Author+ Stored XSS via Display Name in Post Author Widget Unknown Dynific Addons for Elementor (formerly Anywhere Elementor) Versions & vendor guidance → |
Not in downloaded KEV | 6.8Medium |
| CVE-2026-116928Windows Search Remote Code Execution Vulnerability Microsoft Windows 10 Version 1607, Microsoft Windows 10 Version 1809, Microsoft Windows 10 Version 21H2, Microsoft Windows 10 Version 22H2, Microsoft Windows 11 version 23H2, Microsoft Windows 11 Version 23H2, Microsoft Windows 11 Version 24H2, Microsoft Windows 11 Version 25H2, Microsoft Windows 11 version 26H1, Microsoft Windows 11 Version 26H2, Microsoft Windows Server 2016, Microsoft Windows Server 2016 (Server Core installation), Microsoft Windows Server 2019, Microsoft Windows Server 2019 (Server Core installation), Microsoft Windows Server 2022, Microsoft Windows Server 2025, Microsoft Windows Server 2025 (Server Core installation) Versions & vendor guidance → |
Not in downloaded KEV | 9.8Critical |
| CVE-2026-116779FreeSWITCH: Inbound SIP MESSAGE can select the api chat proto and run FreeSWITCH API commands signalwire freeswitch Versions & vendor guidance → |
Known exploitedCISA KEV | 9.8Critical |
| CVE-2026-116714Windows AppX Deployment Service Elevation of Privilege Vulnerability Microsoft Windows 10 Version 21H2, Microsoft Windows 10 Version 22H2, Microsoft Windows 11 version 23H2, Microsoft Windows 11 Version 23H2, Microsoft Windows Server 2022 Versions & vendor guidance → |
Not in downloaded KEV | 7.8High |
| CVE-2026-116710Windows Message Queuing Remote Code Execution Vulnerability Microsoft Windows 10 Version 1607, Microsoft Windows 10 Version 1809, Microsoft Windows 10 Version 21H2, Microsoft Windows 10 Version 22H2, Microsoft Windows 11 version 23H2, Microsoft Windows 11 Version 23H2, Microsoft Windows 11 Version 24H2, Microsoft Windows 11 Version 25H2, Microsoft Windows 11 version 26H1, Microsoft Windows 11 Version 26H2, Microsoft Windows Server 2016, Microsoft Windows Server 2016 (Server Core installation), Microsoft Windows Server 2019, Microsoft Windows Server 2019 (Server Core installation), Microsoft Windows Server 2022, Microsoft Windows Server 2025, Microsoft Windows Server 2025 (Server Core installation) Versions & vendor guidance → |
Not in downloaded KEV | 8.1High |
| CVE-2026-116672Authlib RFC 7592 examples omit registration-access-token client binding authlib authlib Versions & vendor guidance → |
Not in downloaded KEV | 8.8High |
| CVE-2026-116606Authentication Bypass Allows Global Configuration Restore in Barracuda Email Security Gateway Barracuda Networks Barracuda Email Security Gateway (ESG) Versions & vendor guidance → |
Known exploitedCISA KEV | 9.3Critical |
| CVE-2026-11645Google Chromium V8 Out-of-Bounds Read and Write Vulnerability Google Chrome Versions & vendor guidance → |
Known exploitedCISA KEV | 8.8High |
| CVE-2026-115878Stanza: RCE via pickle deserialization in the lemmatizer stanfordnlp stanza Versions & vendor guidance → |
Not in downloaded KEV | 7.8High |
| CVE-2026-115770Pocket ID: Email verification token remains valid after address change, enabling arbitrary verified-email spoofing pocket-id pocket-id Versions & vendor guidance → |
Not in downloaded KEV | 9.6Critical |
| CVE-2026-115735Somatic Framework <= 1.8.14 - Subscriber+ Arbitrary File Deletion Unknown Somatic Framework Versions & vendor guidance → |
Not in downloaded KEV | 9.6Critical |
| CVE-2026-115734Pay With a Tweet <= 1.0.5 - Subscriber+ Arbitrary File Deletion via Button Download Path Unknown Pay with a tweet Versions & vendor guidance → |
Not in downloaded KEV | 9.6Critical |
| CVE-2026-114625Security Advisory 0199 Arista Networks VeloCloud Orchestrator Reported fix guidance → |
Known exploitedCISA KEV | 9.4Critical |
| CVE-2026-114169Windows Raw Image Extension Remote Code Execution Vulnerability Microsoft Raw Image Extension Versions & vendor guidance → |
Not in downloaded KEV | 8.8High |
| CVE-2026-114161Azure CycleCloud Elevation of Privilege Vulnerability Microsoft Azure CycleCloud 8.9.2 Versions & vendor guidance → |
Not in downloaded KEV | 7.8High |
| CVE-2026-114160Azure Managed Grafana Elevation of Privilege Vulnerability Microsoft Azure Managed Grafana Versions & vendor guidance → |
Not in downloaded KEV | 9.8Critical |
| CVE-2026-114159Visual Studio Remote Code Execution Vulnerability Microsoft .NET 10.0 installed on Windows, Microsoft .NET 11.0 installed on Windows, Microsoft .NET 8.0 installed on Windows, Microsoft .NET 9.0 installed on Windows, Microsoft Microsoft Visual Studio 2026 version 18.11, Microsoft Microsoft Visual Studio 2026 version 18.12 Versions & vendor guidance → |
Not in downloaded KEV | 8.8High |
| CVE-2026-114158Visual Studio Remote Code Execution Vulnerability Microsoft .NET 10.0 installed on Windows, Microsoft .NET 11.0 installed on Windows, Microsoft .NET 8.0 installed on Windows, Microsoft .NET 9.0 installed on Windows, Microsoft Microsoft Visual Studio 2026 version 18.11, Microsoft Microsoft Visual Studio 2026 version 18.12 Versions & vendor guidance → |
Not in downloaded KEV | 8.8High |
Data sources, freshness & score definitions
The full downloaded KEV catalog is tracked, alongside CVEs found in monitored sources. This is not the entire CVE universe. CVE record enrichment rotates in bounded batches; missing fields remain unknown.
CISA KEV: checked 13 Nov 2026, 00:20 Jerusalem · 1779 records
CVE Program: checked 13 Nov 2026, 00:20 Jerusalem · 117 records · 3 records unavailable
FIRST EPSS: checked 13 Nov 2026, 00:20 Jerusalem · 2223 records
CVSS describes reported technical severity. EPSS estimates exploitation probability in the next 30 days. KEV inclusion records known exploitation, not whether your own systems are exposed.