CVE tracker
Scroll across the table to compare exploitation and severity.
| CVE / vulnerability | Exploitation | CVSS |
|---|---|---|
| CVE-2026-106931EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability EG Secure Solutions Inc. SiteGuard Server Edition for Apache httpd, EG Secure Solutions Inc. SiteGuard Server Edition for Nginx, EG Secure Solutions Inc. SiteGuard Server Edition for IIS, EG Secure Solutions Inc. SiteGuard Server Edition for Apache httpd on FreeBSD, EG Secure Solutions Inc. SiteGuard Server Edition for Nginx on FreeBSD Versions & vendor guidance → |
Known exploitedCISA KEV | 8.5High |
| CVE-2026-105769kaniko can send the build's Azure (Entra ID) access token to lookalike ACR registry hosts chainguard kaniko Reported fix guidance → |
Not in downloaded KEV | 9.3Critical |
| CVE-2026-105734Azure Local Elevation of Privilege Vulnerability Microsoft Azure Local Versions & vendor guidance → |
Not in downloaded KEV | 7High |
| CVE-2026-105581Desktop Window Manager Elevation of Privilege Vulnerability Microsoft Windows 11 version 23H2, Microsoft Windows 11 Version 23H2, Microsoft Windows 11 Version 24H2, Microsoft Windows 11 Version 25H2, Microsoft Windows 11 version 26H1, Microsoft Windows 11 Version 26H2, Microsoft Windows Server 2022, Microsoft Windows Server 2025, Microsoft Windows Server 2025 (Server Core installation) Versions & vendor guidance → |
Not in downloaded KEV | 8.8High |
| CVE-2026-105568Windows Active Directory Domain Services Denial of Service Vulnerability Microsoft Windows 10 Version 1607, Microsoft Windows 10 Version 1809, Microsoft Windows 10 Version 21H2, Microsoft Windows 10 Version 22H2, Microsoft Windows 11 version 23H2, Microsoft Windows 11 Version 23H2, Microsoft Windows 11 Version 24H2, Microsoft Windows 11 Version 25H2, Microsoft Windows 11 version 26H1, Microsoft Windows 11 Version 26H2, Microsoft Windows Server 2016, Microsoft Windows Server 2016 (Server Core installation), Microsoft Windows Server 2019, Microsoft Windows Server 2019 (Server Core installation), Microsoft Windows Server 2022, Microsoft Windows Server 2025, Microsoft Windows Server 2025 (Server Core installation) Versions & vendor guidance → |
Not in downloaded KEV | 6.5Medium |
| CVE-2026-105537Mailslot File System Information Disclosure Vulnerability Microsoft Windows 10 Version 1607, Microsoft Windows 10 Version 1809, Microsoft Windows 10 Version 21H2, Microsoft Windows 10 Version 22H2, Microsoft Windows 11 version 23H2, Microsoft Windows 11 Version 23H2, Microsoft Windows 11 Version 24H2, Microsoft Windows 11 Version 25H2, Microsoft Windows 11 version 26H1, Microsoft Windows 11 Version 26H2, Microsoft Windows Server 2016, Microsoft Windows Server 2016 (Server Core installation), Microsoft Windows Server 2019, Microsoft Windows Server 2019 (Server Core installation), Microsoft Windows Server 2022, Microsoft Windows Server 2025, Microsoft Windows Server 2025 (Server Core installation) Versions & vendor guidance → |
Not in downloaded KEV | 5.5Medium |
| CVE-2026-105528Desktop Window Manager Elevation of Privilege Vulnerability Microsoft Windows 11 version 23H2, Microsoft Windows 11 Version 23H2, Microsoft Windows 11 Version 24H2, Microsoft Windows 11 Version 25H2, Microsoft Windows 11 version 26H1, Microsoft Windows 11 Version 26H2, Microsoft Windows Server 2025, Microsoft Windows Server 2025 (Server Core installation) Versions & vendor guidance → |
Not in downloaded KEV | 7.8High |
| CVE-2026-105524Windows Management Instrumentation Elevation of Privilege Vulnerability Microsoft Windows 10 Version 1607, Microsoft Windows 10 Version 1809, Microsoft Windows 10 Version 21H2, Microsoft Windows 10 Version 22H2, Microsoft Windows 11 version 23H2, Microsoft Windows 11 Version 23H2, Microsoft Windows 11 Version 24H2, Microsoft Windows 11 Version 25H2, Microsoft Windows 11 version 26H1, Microsoft Windows 11 Version 26H2, Microsoft Windows Server 2016, Microsoft Windows Server 2016 (Server Core installation), Microsoft Windows Server 2019, Microsoft Windows Server 2019 (Server Core installation), Microsoft Windows Server 2022, Microsoft Windows Server 2025, Microsoft Windows Server 2025 (Server Core installation) Versions & vendor guidance → |
Not in downloaded KEV | 7.8High |
| CVE-2026-105501Windows Installer Elevation of Privilege Vulnerability Microsoft Windows 10 Version 1607, Microsoft Windows 10 Version 1809, Microsoft Windows 10 Version 21H2, Microsoft Windows 10 Version 22H2, Microsoft Windows 11 version 23H2, Microsoft Windows 11 Version 23H2, Microsoft Windows 11 Version 24H2, Microsoft Windows 11 Version 25H2, Microsoft Windows 11 version 26H1, Microsoft Windows 11 Version 26H2, Microsoft Windows Server 2016, Microsoft Windows Server 2016 (Server Core installation), Microsoft Windows Server 2019, Microsoft Windows Server 2019 (Server Core installation), Microsoft Windows Server 2022, Microsoft Windows Server 2025, Microsoft Windows Server 2025 (Server Core installation) Versions & vendor guidance → |
Not in downloaded KEV | 7.8High |
| CVE-2026-105494Azure NFS mount helper (aznfs) Elevation of Privilege Vulnerability Microsoft aznfs Versions & vendor guidance → |
Not in downloaded KEV | 7.8High |
| CVE-2026-10520Ivanti Sentry OS Command Injection Vulnerability ivanti Sentry Versions & vendor guidance → |
Known exploitedCISA KEV | 10Critical |
| CVE-2026-105134Ahsay AhsayCBS Replication Receiver UpdateReceivers.do os command injection Ahsay AhsayCBS Versions & vendor guidance → |
Known exploitedCISA KEV | 10Critical |
| CVE-2026-105133Ahsay AhsayCBS API ApiStructsAction.java checkSysPwd improper authentication Ahsay AhsayCBS Versions & vendor guidance → |
Known exploitedCISA KEV | 6.9Medium |
| CVE-2026-104937CVE-2026-104937 Shopware Shopware Versions & vendor guidance → |
Not in downloaded KEV | 8.1High |
| CVE-2026-104935Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability Ivanti Connect Secure Versions & vendor guidance → |
Known exploitedCISA KEV | 8.6High |
| CVE-2026-104850MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server modelcontextprotocol typescript-sdk Versions & vendor guidance → |
Not in downloaded KEV | 7.5High |
| CVE-2026-104286Fortinet FortiMail Path Traversal Vulnerability Fortinet FortiMail Reported fix guidance → |
Known exploitedCISA KEV | 9.8Critical |
| CVE-2026-104120modelcontextprotocol mcp-server-fetch/mcp-server-everything Fetch Tool server.py fetch_url server-side request forgery modelcontextprotocol mcp-server-fetch, modelcontextprotocol mcp-server-everything Versions & vendor guidance → |
Not in downloaded KEV | 6.9Medium |
| CVE-2026-104080Control Web Panel (CWP) < 1.29 OS Command Injection via valid_token Control Web Panel Control Web Panel Versions & vendor guidance → |
Not in downloaded KEV | 8.5High |
| CVE-2026-103537CVE-2026-103537 Thelia Thelia Versions & vendor guidance → |
Not in downloaded KEV | 5.4Medium |
| CVE-2026-103535CVE-2026-103535 Thelia Thelia Versions & vendor guidance → |
Not in downloaded KEV | 8.8High |
| CVE-2026-103529CVE-2026-103529 Thelia Thelia Versions & vendor guidance → |
Not in downloaded KEV | 5.4Medium |
| CVE-2026-103528CVE-2026-103528 Thelia Thelia Versions & vendor guidance → |
Not in downloaded KEV | 5.4Medium |
| CVE-2026-103527CVE-2026-103527 Thelia Thelia Versions & vendor guidance → |
Not in downloaded KEV | 6.1Medium |
| CVE-2026-103526CVE-2026-103526 Thelia Thelia Versions & vendor guidance → |
Not in downloaded KEV | 3.7Low |
Data sources, freshness & score definitions
The full downloaded KEV catalog is tracked, alongside CVEs found in monitored sources. This is not the entire CVE universe. CVE record enrichment rotates in bounded batches; missing fields remain unknown.
CISA KEV: checked 13 Nov 2026, 00:20 Jerusalem · 1779 records
CVE Program: checked 13 Nov 2026, 00:20 Jerusalem · 117 records · 3 records unavailable
FIRST EPSS: checked 13 Nov 2026, 00:20 Jerusalem · 2223 records
CVSS describes reported technical severity. EPSS estimates exploitation probability in the next 30 days. KEV inclusion records known exploitation, not whether your own systems are exposed.