CVE tracker — Exploitation, versions & score history

Scroll across the table to compare exploitation and severity.

Matching CVEs and exploitation evidence. CVSS measures reported severity. Unknown scores are not zero.
CVE / vulnerability	Exploitation	CVSS
CVE-2025-9377 Authenticated RCE via Parental Control command injection TP-Link Systems Inc. Archer C7(EU) V2, TP-Link Systems Inc. TL-WR841N/ND(MS) V9 Versions & vendor guidance →	Known exploitedCISA KEV	8.6High
CVE-2025-9242 WatchGuard Firebox iked Out of Bounds Write Vulnerability WatchGuard Fireware OS Reported fix guidance →	Known exploitedCISA KEV	9.3Critical
CVE-2025-8876 Command Injection Vulnerability N-able N-central Versions & vendor guidance →	Known exploitedCISA KEV	9.4Critical
CVE-2025-8875 Insecure Deserialization Vulnerability N-able N-central Versions & vendor guidance →	Known exploitedCISA KEV	9.4Critical
CVE-2025-8110 File overwrite in file update API in Gogs Gogs Gogs Versions & vendor guidance →	Known exploitedCISA KEV	8.7High
CVE-2025-8088 Path traversal vulnerability in WinRAR win.rar GmbH WinRAR Versions & vendor guidance →	Known exploitedCISA KEV	8.4High
CVE-2025-7775 Memory overflow vulnerability leading to Remote Code Execution and/or Denial of Service NetScaler ADC, NetScaler Gateway Versions & vendor guidance →	Known exploitedCISA KEV	9.2Critical
CVE-2025-68686 Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability Fortinet FortiOS Reported fix guidance →	Known exploitedCISA KEV	5.3Medium
CVE-2025-68645 Synacor Zimbra Collaboration Suite (ZCS) PHP Remote File Inclusion Vulnerability n/a n/a Versions & vendor guidance →	Known exploitedCISA KEV	8.8High
CVE-2025-68613 n8n Vulnerable to Remote Code Execution via Expression Injection n8n-io n8n Versions & vendor guidance →	Known exploitedCISA KEV	10Critical
CVE-2025-68461 RoundCube Webmail Cross-site Scripting Vulnerability Roundcube Webmail Versions & vendor guidance →	Known exploitedCISA KEV	7.2High
CVE-2025-68145 mcp-server-git has missing path validation when using --repository flag modelcontextprotocol servers Versions & vendor guidance →	Not in downloaded KEV	6.4Medium
CVE-2025-68144 mcp-server-git argument injection in git_diff and git_checkout functions allows overwriting local files modelcontextprotocol servers Versions & vendor guidance →	Not in downloaded KEV	6.3Medium
CVE-2025-68143 mcp-server-git's unrestricted git_init tool allows repository creation at arbitrary filesystem locations modelcontextprotocol servers Versions & vendor guidance →	Not in downloaded KEV	6.5Medium
CVE-2025-67038 Lantronix EDS5000, G520, and X300 OS Command Injection Lantronix EDS5000 series, Lantronix G520 series, Lantronix X300 series, Lantronix E210 series, Lantronix E220 series Reported fix guidance →	Known exploitedCISA KEV	9.3Critical
CVE-2025-66644 Array Networks ArrayOS AG OS Command Injection Vulnerability Array Networks ArrayOS AG Versions & vendor guidance →	Known exploitedCISA KEV	7.2High
CVE-2025-66414 DNS Rebinding Protection Disabled by Default in Model Context Protocol TypeScript SDK for Servers Running on Localhost modelcontextprotocol typescript-sdk Versions & vendor guidance →	Not in downloaded KEV	7.6High
CVE-2025-66376 Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting Vulnerability Zimbra Collaboration Versions & vendor guidance →	Known exploitedCISA KEV	7.2High
CVE-2025-66032 Claude Code Command Validation Bypass Allows Arbitrary Code Execution anthropics claude-code Versions & vendor guidance →	Not in downloaded KEV	8.7High
CVE-2025-66030 node-forge ASN.1 OID Integer Truncation digitalbazaar forge Versions & vendor guidance →	Not in downloaded KEV	6.3Medium
CVE-2025-6558 Google Chromium ANGLE and GPU Improper Input Validation Vulnerability Google Chrome Versions & vendor guidance →	Known exploitedCISA KEV	8.8High
CVE-2025-6554 Google Chromium V8 Type Confusion Vulnerability Google Chrome Versions & vendor guidance →	Known exploitedCISA KEV	8.1High
CVE-2025-6543 Memory overflow vulnerability leading to unintended control flow and Denial of Service NetScaler ADC, NetScaler Gateway Versions & vendor guidance →	Known exploitedCISA KEV	9.2Critical
CVE-2025-65099 Claude Code vulnerable to command execution prior to startup trust dialog anthropics claude-code Versions & vendor guidance →	Not in downloaded KEV	7.7High
CVE-2025-64755 @anthropic-ai/claude-code has Sed Command Validation Bypass that Allows Arbitrary File Writes anthropics claude-code Versions & vendor guidance →	Not in downloaded KEV	8.7High

Data sources, freshness & score definitions

The full downloaded KEV catalog is tracked, alongside CVEs found in monitored sources. This is not the entire CVE universe. CVE record enrichment rotates in bounded batches; missing fields remain unknown.

CISA KEV: checked 13 Nov 2026, 00:20 Jerusalem · 1779 records

CVE Program: checked 13 Nov 2026, 00:20 Jerusalem · 117 records · 3 records unavailable

FIRST EPSS: checked 13 Nov 2026, 00:20 Jerusalem · 2223 records

CVSS describes reported technical severity. EPSS estimates exploitation probability in the next 30 days. KEV inclusion records known exploitation, not whether your own systems are exposed.