CVE tracker
Scroll across the table to compare exploitation and severity.
| CVE / vulnerability | Exploitation | CVSS |
|---|---|---|
| CVE-2026-88066Claude Desktop: Uncontrolled Search Path Enables Arbitrary Code Execution via Malicious Git Executable anthropics claude-code Versions & vendor guidance → |
Not in downloaded KEV | 7.5High |
| CVE-2026-87902WordPress Core Remote File Inclusion Vulnerability WordPress WordPress Reported workaround → |
Known exploitedCISA KEV | 8.1High |
| CVE-2026-87886Acronis Backup Incorrect Default Permissions Vulnerability Acronis Acronis Backup plugin for cPanel & WHM, Acronis Acronis Backup extension for Plesk, Acronis Acronis Backup plugin for DirectAdmin Versions & vendor guidance → |
Known exploitedCISA KEV | 7.8High |
| CVE-2026-87772Unauthenticated Polkit Privilege Escalation in TÜBİTAK BİLGEM's Pardus About TÜBİTAK BİLGEM Software Technologies Research Institute Pardus About Versions & vendor guidance → |
Not in downloaded KEV | 7.8High |
| CVE-2026-87491Google Chromium V8 Out of Bounds Write Vulnerability Google Chrome Versions & vendor guidance → |
Known exploitedCISA KEV | 8.8High |
| CVE-2026-87008Code Graph RAG structural tools follow out-of-root symlinks vitali87 code-graph-rag Versions & vendor guidance → |
Not in downloaded KEV | 7.1High |
| CVE-2026-86990CVE-2026-86990 Apple iOS and iPadOS, Apple macOS, Apple visionOS Versions & vendor guidance → |
Not in downloaded KEV | 5.1Medium |
| CVE-2026-86950Apple Multiple Products Out-of-Bounds Write Vulnerability Apple iOS and iPadOS, Apple macOS Versions & vendor guidance → |
Known exploitedCISA KEV | 8.8High |
| CVE-2026-86218pre-authentication remote code execution N-able N-central Versions & vendor guidance → |
Known exploitedCISA KEV | 10Critical |
| CVE-2026-86063Claude Code: Plugin Hash Pin Bypass Allows Bypass of Hash Pinning anthropics claude-code Versions & vendor guidance → |
Not in downloaded KEV | 7.5High |
| CVE-2026-86060SSH session privilege manipulation via a crafted username in Mikrotik RouterOS Mikrotik RouterOS Versions & vendor guidance → |
Known exploitedCISA KEV | 9.2Critical |
| CVE-2026-86041ezBookkeeping: Source-IP allowlist (MCP & API token) is bypassable via a spoofed `X-Forwarded-For` header mayswind ezbookkeeping Versions & vendor guidance → |
Not in downloaded KEV | 5.3Medium |
| CVE-2026-85923Azure DevOps Server Elevation of Privilege Vulnerability Microsoft Azure DevOps Server Versions & vendor guidance → |
Not in downloaded KEV | 8.8High |
| CVE-2026-85880Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability Microsoft Windows 10 Version 1607, Microsoft Windows 10 Version 1809, Microsoft Windows 10 Version 21H2, Microsoft Windows 10 Version 22H2, Microsoft Windows Server 2012, Microsoft Windows Server 2012 (Server Core installation), Microsoft Windows Server 2012 R2, Microsoft Windows Server 2012 R2 (Server Core installation), Microsoft Windows Server 2016, Microsoft Windows Server 2016 (Server Core installation), Microsoft Windows Server 2019, Microsoft Windows Server 2019 (Server Core installation), Microsoft Windows Server 2022 Versions & vendor guidance → |
Known exploitedCISA KEV | 7.8High |
| CVE-2026-85737Velociraptor: Low-priv analyst reads arbitrary server files via ungated sql() VQL plugin Velocidex velociraptor Versions & vendor guidance → |
Not in downloaded KEV | 6.5Medium |
| CVE-2026-85706Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab GitLab GitLab Reported fix guidance → |
Known exploitedCISA KEV | 10Critical |
| CVE-2026-85102Improper Certificate Validation in Quantum Security Gateway checkpoint Quantum Security Gateway Versions & vendor guidance → |
Known exploitedCISA KEV | 9.8Critical |
| CVE-2026-85046Google Chromium V8 Type Confusion Vulnerability Google Chrome Versions & vendor guidance → |
Known exploitedCISA KEV | 8.8High |
| CVE-2026-84869ScreenConnect Client: Guest-to-Host File Execution via File-Transfer Actions ConnectWise ScreenConnect Reported fix guidance → |
Known exploitedCISA KEV | 9.9Critical |
| CVE-2026-8452Memory overflow vulnerability leading to unpredictable or erroneous behavior and Denial of Service NetScaler ADC, NetScaler Gateway Versions & vendor guidance → |
Known exploitedCISA KEV | 8.8High |
| CVE-2026-84005AMD Zen Information Disclosure Vulnerability Microsoft Windows 10 Version 1809, Microsoft Windows 11 version 23H2, Microsoft Windows 11 Version 23H2, Microsoft Windows 11 Version 24H2, Microsoft Windows 11 Version 25H2, Microsoft Windows 11 version 26H1, Microsoft Windows 11 Version 26H2, Microsoft Windows Server 2019, Microsoft Windows Server 2019 (Server Core installation), Microsoft Windows Server 2022, Microsoft Windows Server 2025, Microsoft Windows Server 2025 (Server Core installation) Versions & vendor guidance → |
Not in downloaded KEV | 5.5Medium |
| CVE-2026-84004AMD Zen Information Disclosure Vulnerability Microsoft Windows 10 Version 1607, Microsoft Windows 10 Version 1809, Microsoft Windows 10 Version 21H2, Microsoft Windows 10 Version 22H2, Microsoft Windows 11 version 23H2, Microsoft Windows 11 Version 23H2, Microsoft Windows 11 Version 24H2, Microsoft Windows 11 Version 25H2, Microsoft Windows 11 version 26H1, Microsoft Windows 11 Version 26H2, Microsoft Windows Server 2012, Microsoft Windows Server 2012 (Server Core installation), Microsoft Windows Server 2012 R2, Microsoft Windows Server 2012 R2 (Server Core installation), Microsoft Windows Server 2016, Microsoft Windows Server 2016 (Server Core installation), Microsoft Windows Server 2019, Microsoft Windows Server 2019 (Server Core installation), Microsoft Windows Server 2022, Microsoft Windows Server 2025, Microsoft Windows Server 2025 (Server Core installation) Versions & vendor guidance → |
Not in downloaded KEV | 5.5Medium |
| CVE-2026-8398Daemon Tools Lite Embedded Malicious Code Vulnerability AVB Disc Soft DAEMON Tools Lite Reported fix guidance → |
Known exploitedCISA KEV | 9.3Critical |
| CVE-2026-83953GitHub Copilot for Jetbrains Information Disclosure Vulnerability Microsoft GitHub Copilot Plugin for JetBrains IDEs Versions & vendor guidance → |
Not in downloaded KEV | 5.5Medium |
| CVE-2026-83844Windows Paint Remote Code Execution Vulnerability Microsoft Microsoft Paint Versions & vendor guidance → |
Not in downloaded KEV | 7High |
Data sources, freshness & score definitions
The full downloaded KEV catalog is tracked, alongside CVEs found in monitored sources. This is not the entire CVE universe. CVE record enrichment rotates in bounded batches; missing fields remain unknown.
CISA KEV: checked 13 Nov 2026, 00:20 Jerusalem · 1779 records
CVE Program: checked 13 Nov 2026, 00:20 Jerusalem · 117 records · 3 records unavailable
FIRST EPSS: checked 13 Nov 2026, 00:20 Jerusalem · 2223 records
CVSS describes reported technical severity. EPSS estimates exploitation probability in the next 30 days. KEV inclusion records known exploitation, not whether your own systems are exposed.