CVE tracker
Scroll across the table to compare exploitation and severity.
| CVE / vulnerability | Exploitation | CVSS |
|---|---|---|
| CVE-2026-111560OS Command Injection in Barracuda Appliances Barracuda Networks Barracuda Email Security Gateway (ESG), Barracuda Networks Barracuda Load Balancer Application Delivery Controller (ADC), Barracuda Networks Barracuda Web Application Firewall (WAF), Barracuda Networks Barracuda Web Security Gateway (WSG), Barracuda Networks Barracuda Message Archiver (BMA), Barracuda Networks Barracuda WAF Control Center (WCC) Versions & vendor guidance → |
Known exploitedCISA KEV | 8.6High |
| CVE-2026-111497Out-of-Bounds Write in Google Brotli Decoder Google Brotli Reported fix guidance → |
Known exploitedCISA KEV | 9.2Critical |
| CVE-2026-111357Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability Ivanti Connect Secure Versions & vendor guidance → |
Known exploitedCISA KEV | 7High |
| CVE-2026-111309Microsoft Office Outlook Remote Code Execution Vulnerability Microsoft Microsoft 365 Apps for Enterprise, Microsoft Microsoft Office LTSC 2021, Microsoft Microsoft Office LTSC 2024 Versions & vendor guidance → |
Not in downloaded KEV | 8.8High |
| CVE-2026-111289Microsoft Office Remote Code Execution Vulnerability Microsoft Microsoft 365 Apps for Enterprise, Microsoft Microsoft Office 365 for Mac, Microsoft Microsoft Office LTSC 2021, Microsoft Microsoft Office LTSC 2024, Microsoft Microsoft Office LTSC for Mac 2021, Microsoft Microsoft Office LTSC for Mac 2024 Versions & vendor guidance → |
Not in downloaded KEV | 8.8High |
| CVE-2026-111285Microsoft Office Word Remote Code Execution Vulnerability Microsoft Microsoft 365 Apps for Enterprise, Microsoft Microsoft Office 365 for Mac, Microsoft Microsoft Office LTSC 2021, Microsoft Microsoft Office LTSC 2024, Microsoft Microsoft Office LTSC for Mac 2021, Microsoft Microsoft Office LTSC for Mac 2024 Versions & vendor guidance → |
Not in downloaded KEV | 8.8High |
| CVE-2026-110936Siemens Software Center Uncontrolled Search Path Element Vulnerability Siemens Siemens Software Center Versions & vendor guidance → |
Known exploitedCISA KEV | 8.4High |
| CVE-2026-110447Collabora Online – Built-in CODE Server OS Command Injection Vulnerability Collabora Collabora Online - Built-in CODE Server Versions & vendor guidance → |
Known exploitedCISA KEV | 9.2Critical |
| CVE-2026-110068Microsoft Office Outlook Remote Code Execution Vulnerability Microsoft Microsoft 365 Apps for Enterprise, Microsoft Microsoft Office 365 for Mac, Microsoft Microsoft Office LTSC 2021, Microsoft Microsoft Office LTSC 2024, Microsoft Microsoft Office LTSC for Mac 2021, Microsoft Microsoft Office LTSC for Mac 2024 Versions & vendor guidance → |
Not in downloaded KEV | 8.8High |
| CVE-2026-110067Microsoft Office Word Remote Code Execution Vulnerability Microsoft Microsoft 365 Apps for Enterprise, Microsoft Microsoft Office 365 for Mac, Microsoft Microsoft Office LTSC 2021, Microsoft Microsoft Office LTSC 2024, Microsoft Microsoft Office LTSC for Mac 2021, Microsoft Microsoft Office LTSC for Mac 2024 Versions & vendor guidance → |
Not in downloaded KEV | 8.8High |
| CVE-2026-110047Microsoft Office Word Remote Code Execution Vulnerability Microsoft Microsoft 365 Apps for Enterprise, Microsoft Microsoft Office 365 for Mac, Microsoft Microsoft Office LTSC 2021, Microsoft Microsoft Office LTSC 2024, Microsoft Microsoft Office LTSC for Mac 2021, Microsoft Microsoft Office LTSC for Mac 2024 Versions & vendor guidance → |
Not in downloaded KEV | 8.8High |
| CVE-2026-110043Microsoft Office Outlook Remote Code Execution Vulnerability Microsoft Microsoft 365 Apps for Enterprise, Microsoft Microsoft Office LTSC 2021, Microsoft Microsoft Office LTSC 2024 Versions & vendor guidance → |
Not in downloaded KEV | 8.8High |
| CVE-2026-110005Moghtech Komodo contains an OS command injection vulnerability Komodo Komodo Versions & vendor guidance → |
Not in downloaded KEV | 8.8High |
| CVE-2026-109619RCE via stale global state PHP Group PHP Reported workaround → |
Known exploitedCISA KEV | 9.2Critical |
| CVE-2026-109618RCE via OOM corruption PHP Group PHP Reported workaround → |
Known exploitedCISA KEV | 9.2Critical |
| CVE-2026-109481ASP.NET Core Elevation of Privilege Vulnerability Microsoft .NET 11.0 installed on Linux, Microsoft .NET 11.0 installed on Mac OS, Microsoft .NET 11.0 installed on Windows, Microsoft Microsoft Visual Studio 2026 version 18.12 Versions & vendor guidance → |
Not in downloaded KEV | 7.5High |
| CVE-2026-109473Windows Kernel Elevation of Privilege Vulnerability Microsoft Windows 10 Version 1607, Microsoft Windows 10 Version 1809, Microsoft Windows 10 Version 21H2, Microsoft Windows 10 Version 22H2, Microsoft Windows 11 version 23H2, Microsoft Windows 11 Version 23H2, Microsoft Windows 11 Version 24H2, Microsoft Windows 11 Version 25H2, Microsoft Windows 11 version 26H1, Microsoft Windows 11 Version 26H2, Microsoft Windows Server 2016, Microsoft Windows Server 2016 (Server Core installation), Microsoft Windows Server 2019, Microsoft Windows Server 2019 (Server Core installation), Microsoft Windows Server 2022, Microsoft Windows Server 2025, Microsoft Windows Server 2025 (Server Core installation) Versions & vendor guidance → |
Not in downloaded KEV | 7.8High |
| CVE-2026-109469Entra Device Registration Elevation of Privilege Vulnerability Microsoft Entra Device Registration Versions & vendor guidance → |
Not in downloaded KEV | 10Critical |
| CVE-2026-109467Azure DevOps Server Remote Code Execution Vulnerability Microsoft Azure DevOps, Microsoft Azure DevOps Server 2025 Versions & vendor guidance → |
Not in downloaded KEV | 9.9Critical |
| CVE-2026-109462Azure Firmware Security Feature Bypass Vulnerability Microsoft Azure Virtual Machines Versions & vendor guidance → |
Not in downloaded KEV | 4.4Medium |
| CVE-2026-109459Windows Message Queuing Queue Manager Remote Code Execution Vulnerability Microsoft Windows 10 Version 1607, Microsoft Windows 10 Version 1809, Microsoft Windows 10 Version 21H2, Microsoft Windows 10 Version 22H2, Microsoft Windows 11 version 23H2, Microsoft Windows 11 Version 23H2, Microsoft Windows 11 Version 24H2, Microsoft Windows 11 Version 25H2, Microsoft Windows 11 version 26H1, Microsoft Windows 11 Version 26H2, Microsoft Windows Server 2016, Microsoft Windows Server 2016 (Server Core installation), Microsoft Windows Server 2019, Microsoft Windows Server 2019 (Server Core installation), Microsoft Windows Server 2022, Microsoft Windows Server 2025, Microsoft Windows Server 2025 (Server Core installation) Versions & vendor guidance → |
Not in downloaded KEV | 8.1High |
| CVE-2026-109457Azure CLI Remote Code Execution Vulnerability Microsoft Azure Machine Learning Versions & vendor guidance → |
Not in downloaded KEV | 8High |
| CVE-2026-108262DDEV incomplete tar symlink traversal fix allows host file overwrite - Incomplete fix of CVE-2026-32885 ddev ddev Versions & vendor guidance → |
Not in downloaded KEV | 6.5Medium |
| CVE-2026-107441CVE-2026-107441 Zyxel GS1900-24E firmware, Zyxel GS1900-8 firmware, Zyxel GS1900-8HP firmware, Zyxel GS1900-10HP firmware, Zyxel GS1900-16 firmware, Zyxel GS1900-24 firmware, Zyxel GS1900-24EP firmware, Zyxel GS1900-HPv2 firmware, Zyxel GS1900-48 firmware, Zyxel GS1900-48HPv2 firmware Versions & vendor guidance → |
Not in downloaded KEV | 8.8High |
| CVE-2026-107248CVE-2026-107248 Thelia Thelia Versions & vendor guidance → |
Not in downloaded KEV | 8.8High |
Data sources, freshness & score definitions
The full downloaded KEV catalog is tracked, alongside CVEs found in monitored sources. This is not the entire CVE universe. CVE record enrichment rotates in bounded batches; missing fields remain unknown.
CISA KEV: checked 13 Nov 2026, 00:20 Jerusalem · 1779 records
CVE Program: checked 13 Nov 2026, 00:20 Jerusalem · 117 records · 3 records unavailable
FIRST EPSS: checked 13 Nov 2026, 00:20 Jerusalem · 2223 records
CVSS describes reported technical severity. EPSS estimates exploitation probability in the next 30 days. KEV inclusion records known exploitation, not whether your own systems are exposed.