CVE tracker
Scroll across the table to compare exploitation and severity.
| CVE / vulnerability | Exploitation | CVSS |
|---|---|---|
| CVE-2025-40536SolarWinds Web Help Desk Security Control Bypass Vulnerability SolarWinds Web Help Desk Reported fix guidance → |
Known exploitedCISA KEV | 8.1High |
| CVE-2025-4008Arbitrary Command Injection in Smartbedded MeteoBridge Smartbedded MeteoBridge Versions & vendor guidance → |
Known exploitedCISA KEV | 8.7High |
| CVE-2025-39964crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg Linux Linux Versions & vendor guidance → |
Known exploitedCISA KEV | 7.8High |
| CVE-2025-39682tls: fix handling of zero-length records on the rx_list Linux Linux Versions & vendor guidance → |
Known exploitedCISA KEV | 9.8Critical |
| CVE-2025-3935ScreenConnect Exposure to ASP.NET ViewState Code Injection ConnectWise ScreenConnect Reported fix guidance → |
Known exploitedCISA KEV | 8.1High |
| CVE-2025-3928Commvault Web Server unspecified vulnerability Commvault Web Server Versions & vendor guidance → |
Known exploitedCISA KEV | 8.7High |
| CVE-2025-38352posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() Linux Linux Versions & vendor guidance → |
Known exploitedCISA KEV | 7.8High |
| CVE-2025-37164Hewlett Packard Enterprise (HPE) OneView Code Injection Vulnerability Hewlett Packard Enterprise (HPE) HPE OneView Versions & vendor guidance → |
Known exploitedCISA KEV | 10Critical |
| CVE-2025-35939Craft CMS stores user-provided content in session files Craft CMS Versions & vendor guidance → |
Known exploitedCISA KEV | 6.9Medium |
| CVE-2025-34291Langflow <= 1.6.9 CORS Misconfiguration to Token Hijack & RCE Langflow Langflow Versions & vendor guidance → |
Known exploitedCISA KEV | 9.4Critical |
| CVE-2025-34028Commvault Command Center Innovation Release <= 11.38.25 Unathenticated Install Package Path Traversal Commvault Command Center Innovation Release Versions & vendor guidance → |
Known exploitedCISA KEV | 9.3Critical |
| CVE-2025-34026Versa Concerto Actuator Authentication Bypass Information Leak Versa Concerto Versions & vendor guidance → |
Known exploitedCISA KEV | 9.2Critical |
| CVE-2025-33073Windows SMB Client Elevation of Privilege Vulnerability Microsoft Windows 10 Version 1507, Microsoft Windows 10 Version 1607, Microsoft Windows 10 Version 1809, Microsoft Windows 10 Version 21H2, Microsoft Windows 10 Version 22H2, Microsoft Windows 11 version 22H2, Microsoft Windows 11 version 22H3, Microsoft Windows 11 Version 23H2, Microsoft Windows 11 Version 24H2, Microsoft Windows Server 2008 R2 Service Pack 1, Microsoft Windows Server 2008 R2 Service Pack 1 (Server Core installation), Microsoft Windows Server 2008 Service Pack 2, Microsoft Windows Server 2008 Service Pack 2 (Server Core installation), Microsoft Windows Server 2012, Microsoft Windows Server 2012 (Server Core installation), Microsoft Windows Server 2012 R2, Microsoft Windows Server 2012 R2 (Server Core installation), Microsoft Windows Server 2016, Microsoft Windows Server 2016 (Server Core installation), Microsoft Windows Server 2019, Microsoft Windows Server 2019 (Server Core installation), Microsoft Windows Server 2022, Microsoft Windows Server 2022, 23H2 Edition (Server Core installation), Microsoft Windows Server 2025, Microsoft Windows Server 2025 (Server Core installation) Versions & vendor guidance → |
Known exploitedCISA KEV | 8.8High |
| CVE-2025-33053Internet Shortcut Files Remote Code Execution Vulnerability Microsoft Windows 10 Version 1507, Microsoft Windows 10 Version 1607, Microsoft Windows 10 Version 1809, Microsoft Windows 10 Version 21H2, Microsoft Windows 10 Version 22H2, Microsoft Windows 11 version 22H2, Microsoft Windows 11 version 22H3, Microsoft Windows 11 Version 23H2, Microsoft Windows 11 Version 24H2, Microsoft Windows Server 2008 R2 Service Pack 1, Microsoft Windows Server 2008 R2 Service Pack 1 (Server Core installation), Microsoft Windows Server 2008 Service Pack 2, Microsoft Windows Server 2008 Service Pack 2 (Server Core installation), Microsoft Windows Server 2012, Microsoft Windows Server 2012 (Server Core installation), Microsoft Windows Server 2012 R2, Microsoft Windows Server 2012 R2 (Server Core installation), Microsoft Windows Server 2016, Microsoft Windows Server 2016 (Server Core installation), Microsoft Windows Server 2019, Microsoft Windows Server 2019 (Server Core installation), Microsoft Windows Server 2022, Microsoft Windows Server 2022, 23H2 Edition (Server Core installation), Microsoft Windows Server 2025, Microsoft Windows Server 2025 (Server Core installation) Versions & vendor guidance → |
Known exploitedCISA KEV | 8.8High |
| CVE-2025-32975Quest KACE Systems Management Appliance (SMA) Improper Authentication Vulnerability n/a n/a Versions & vendor guidance → |
Known exploitedCISA KEV | 10Critical |
| CVE-2025-32756Fortinet Multiple Products Stack-Based Buffer Overflow Vulnerability Fortinet FortiNDR, Fortinet FortiCamera, Fortinet FortiRecorder, Fortinet FortiVoice, Fortinet FortiMail Reported fix guidance → |
Known exploitedCISA KEV | 9.6Critical |
| CVE-2025-32709Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability Microsoft Windows 10 Version 1507, Microsoft Windows 10 Version 1607, Microsoft Windows 10 Version 1809, Microsoft Windows 10 Version 21H2, Microsoft Windows 10 Version 22H2, Microsoft Windows 11 version 22H2, Microsoft Windows 11 version 22H3, Microsoft Windows 11 Version 23H2, Microsoft Windows 11 Version 24H2, Microsoft Windows Server 2008 R2 Service Pack 1, Microsoft Windows Server 2008 R2 Service Pack 1 (Server Core installation), Microsoft Windows Server 2008 Service Pack 2, Microsoft Windows Server 2008 Service Pack 2 (Server Core installation), Microsoft Windows Server 2012, Microsoft Windows Server 2012 (Server Core installation), Microsoft Windows Server 2012 R2, Microsoft Windows Server 2012 R2 (Server Core installation), Microsoft Windows Server 2016, Microsoft Windows Server 2016 (Server Core installation), Microsoft Windows Server 2019, Microsoft Windows Server 2019 (Server Core installation), Microsoft Windows Server 2022, Microsoft Windows Server 2022, 23H2 Edition (Server Core installation), Microsoft Windows Server 2025, Microsoft Windows Server 2025 (Server Core installation) Versions & vendor guidance → |
Known exploitedCISA KEV | 7.8High |
| CVE-2025-32706Windows Common Log File System Driver Elevation of Privilege Vulnerability Microsoft Windows 10 Version 1507, Microsoft Windows 10 Version 1607, Microsoft Windows 10 Version 1809, Microsoft Windows 10 Version 21H2, Microsoft Windows 10 Version 22H2, Microsoft Windows 11 version 22H2, Microsoft Windows 11 version 22H3, Microsoft Windows 11 Version 23H2, Microsoft Windows 11 Version 24H2, Microsoft Windows Server 2008 R2 Service Pack 1, Microsoft Windows Server 2008 R2 Service Pack 1 (Server Core installation), Microsoft Windows Server 2008 Service Pack 2, Microsoft Windows Server 2008 Service Pack 2 (Server Core installation), Microsoft Windows Server 2012, Microsoft Windows Server 2012 (Server Core installation), Microsoft Windows Server 2012 R2, Microsoft Windows Server 2012 R2 (Server Core installation), Microsoft Windows Server 2016, Microsoft Windows Server 2016 (Server Core installation), Microsoft Windows Server 2019, Microsoft Windows Server 2019 (Server Core installation), Microsoft Windows Server 2022, Microsoft Windows Server 2022, 23H2 Edition (Server Core installation), Microsoft Windows Server 2025, Microsoft Windows Server 2025 (Server Core installation) Versions & vendor guidance → |
Known exploitedCISA KEV | 7.8High |
| CVE-2025-32701Windows Common Log File System Driver Elevation of Privilege Vulnerability Microsoft Windows 10 Version 1507, Microsoft Windows 10 Version 1607, Microsoft Windows 10 Version 1809, Microsoft Windows 10 Version 21H2, Microsoft Windows 10 Version 22H2, Microsoft Windows 11 version 22H2, Microsoft Windows 11 version 22H3, Microsoft Windows 11 Version 23H2, Microsoft Windows 11 Version 24H2, Microsoft Windows Server 2008 R2 Service Pack 1, Microsoft Windows Server 2008 R2 Service Pack 1 (Server Core installation), Microsoft Windows Server 2008 Service Pack 2, Microsoft Windows Server 2008 Service Pack 2 (Server Core installation), Microsoft Windows Server 2012, Microsoft Windows Server 2012 (Server Core installation), Microsoft Windows Server 2012 R2, Microsoft Windows Server 2012 R2 (Server Core installation), Microsoft Windows Server 2016, Microsoft Windows Server 2016 (Server Core installation), Microsoft Windows Server 2019, Microsoft Windows Server 2019 (Server Core installation), Microsoft Windows Server 2022, Microsoft Windows Server 2022, 23H2 Edition (Server Core installation), Microsoft Windows Server 2025, Microsoft Windows Server 2025 (Server Core installation) Versions & vendor guidance → |
Known exploitedCISA KEV | 7.8High |
| CVE-2025-3248Langflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/code langflow-ai langflow Versions & vendor guidance → |
Known exploitedCISA KEV | 9.8Critical |
| CVE-2025-32463Sudo Inclusion of Functionality from Untrusted Control Sphere Vulnerability Sudo project Sudo Versions & vendor guidance → |
Known exploitedCISA KEV | 9.3Critical |
| CVE-2025-32433Erlang/OTP SSH Vulnerable to Pre-Authentication RCE erlang otp Versions & vendor guidance → |
Known exploitedCISA KEV | 10Critical |
| CVE-2025-32432Craft CMS Allows Remote Code Execution craftcms cms Versions & vendor guidance → |
Known exploitedCISA KEV | 10Critical |
| CVE-2025-31324Missing Authorization check in SAP NetWeaver (Visual Composer development server) SAP_SE SAP NetWeaver (Visual Composer development server) Versions & vendor guidance → |
Known exploitedCISA KEV | 10Critical |
| CVE-2025-31277Apple Multiple Products Buffer Overflow Vulnerability Apple Safari, Apple iOS and iPadOS, Apple macOS, Apple tvOS, Apple visionOS, Apple watchOS Versions & vendor guidance → |
Known exploitedCISA KEV | 8.8High |
Data sources, freshness & score definitions
The full downloaded KEV catalog is tracked, alongside CVEs found in monitored sources. This is not the entire CVE universe. CVE record enrichment rotates in bounded batches; missing fields remain unknown.
CISA KEV: checked 13 Nov 2026, 00:20 Jerusalem · 1779 records
CVE Program: checked 13 Nov 2026, 00:20 Jerusalem · 117 records · 3 records unavailable
FIRST EPSS: checked 13 Nov 2026, 00:20 Jerusalem · 2223 records
CVSS describes reported technical severity. EPSS estimates exploitation probability in the next 30 days. KEV inclusion records known exploitation, not whether your own systems are exposed.