CVE tracker
Scroll across the table to compare exploitation and severity.
| CVE / vulnerability | Exploitation | CVSS |
|---|---|---|
| CVE-2026-86041ezBookkeeping: Source-IP allowlist (MCP & API token) is bypassable via a spoofed `X-Forwarded-For` header mayswind ezbookkeeping Versions & vendor guidance → |
Not in downloaded KEV | 5.3Medium |
| CVE-2026-85923Azure DevOps Server Elevation of Privilege Vulnerability Microsoft Azure DevOps Server Versions & vendor guidance → |
Not in downloaded KEV | 8.8High |
| CVE-2026-85737Velociraptor: Low-priv analyst reads arbitrary server files via ungated sql() VQL plugin Velocidex velociraptor Versions & vendor guidance → |
Not in downloaded KEV | 6.5Medium |
| CVE-2026-85046Google Chromium V8 Type Confusion Vulnerability Google Chrome Versions & vendor guidance → |
Known exploitedCISA KEV | 8.8High |
| CVE-2026-84005AMD Zen Information Disclosure Vulnerability Microsoft Windows 10 Version 1809, Microsoft Windows 11 version 23H2, Microsoft Windows 11 Version 23H2, Microsoft Windows 11 Version 24H2, Microsoft Windows 11 Version 25H2, Microsoft Windows 11 version 26H1, Microsoft Windows 11 Version 26H2, Microsoft Windows Server 2019, Microsoft Windows Server 2019 (Server Core installation), Microsoft Windows Server 2022, Microsoft Windows Server 2025, Microsoft Windows Server 2025 (Server Core installation) Versions & vendor guidance → |
Not in downloaded KEV | 5.5Medium |
| CVE-2026-84004AMD Zen Information Disclosure Vulnerability Microsoft Windows 10 Version 1607, Microsoft Windows 10 Version 1809, Microsoft Windows 10 Version 21H2, Microsoft Windows 10 Version 22H2, Microsoft Windows 11 version 23H2, Microsoft Windows 11 Version 23H2, Microsoft Windows 11 Version 24H2, Microsoft Windows 11 Version 25H2, Microsoft Windows 11 version 26H1, Microsoft Windows 11 Version 26H2, Microsoft Windows Server 2012, Microsoft Windows Server 2012 (Server Core installation), Microsoft Windows Server 2012 R2, Microsoft Windows Server 2012 R2 (Server Core installation), Microsoft Windows Server 2016, Microsoft Windows Server 2016 (Server Core installation), Microsoft Windows Server 2019, Microsoft Windows Server 2019 (Server Core installation), Microsoft Windows Server 2022, Microsoft Windows Server 2025, Microsoft Windows Server 2025 (Server Core installation) Versions & vendor guidance → |
Not in downloaded KEV | 5.5Medium |
| CVE-2026-83953GitHub Copilot for Jetbrains Information Disclosure Vulnerability Microsoft GitHub Copilot Plugin for JetBrains IDEs Versions & vendor guidance → |
Not in downloaded KEV | 5.5Medium |
| CVE-2026-83844Windows Paint Remote Code Execution Vulnerability Microsoft Microsoft Paint Versions & vendor guidance → |
Not in downloaded KEV | 7High |
| CVE-2026-8372CVE-2026-8372 Axis Communications AB AXIS Camera Station Pro Versions & vendor guidance → |
Not in downloaded KEV | 8.8High |
| CVE-2026-83563Winlogon Elevation of Privilege Vulnerability Microsoft Windows 11 version 23H2, Microsoft Windows 11 Version 23H2, Microsoft Windows 11 Version 24H2, Microsoft Windows 11 Version 25H2, Microsoft Windows 11 version 26H1, Microsoft Windows 11 Version 26H2, Microsoft Windows Server 2025, Microsoft Windows Server 2025 (Server Core installation) Versions & vendor guidance → |
Not in downloaded KEV | 7.8High |
| CVE-2026-8333TimePictra Stored Cross-site Scripting Microchip TimePictra Reported fix guidance → |
Not in downloaded KEV | 9.4Critical |
| CVE-2026-8332TimePictra root password hardcoded in installation files Microchip TimePictra Reported fix guidance → |
Not in downloaded KEV | 8.8High |
| CVE-2026-8331TimePictra ermote code execution via file upload Microchip TimePictra Reported fix guidance → |
Not in downloaded KEV | 8.8High |
| CVE-2026-82413ntopng: authenticated (non-admin) OS command injection via the vulnerability-scan `scan_ports` parameter (`nmap` argument reaches `popen`) ntop ntopng Versions & vendor guidance → |
Not in downloaded KEV | 8.8High |
| CVE-2026-82078PaperCut MF/NG: Unsafe Dynamic Class Loading in Database Connector PaperCut PaperCut MF/NG Versions & vendor guidance → |
Known exploitedCISA KEV | 9.4Critical |
| CVE-2026-81578PaperCut MF/NG: Authentication Bypass PaperCut PaperCut MF/NG Versions & vendor guidance → |
Known exploitedCISA KEV | 8.8High |
| CVE-2026-81384Windows DNS Server Remote Code Execution Vulnerability Microsoft Windows Server 2022, Microsoft Windows Server 2025, Microsoft Windows Server 2025 (Server Core installation) Versions & vendor guidance → |
Not in downloaded KEV | 8.1High |
| CVE-2026-77881Control Web Panel (CWP) < 1.29 Blind SQL Injection via user Parameter Control Web Panel Control Web Panel Versions & vendor guidance → |
Not in downloaded KEV | 6.8Medium |
| CVE-2026-77880Control Web Panel (CWP) < 1.16 OS Command Injection via /newpass/ Control Web Panel Control Web Panel Versions & vendor guidance → |
Not in downloaded KEV | 8.5High |
| CVE-2026-77879Control Web Panel (CWP) < 1.16 SQL Injection via access_token() API Control Web Panel Control Web Panel Versions & vendor guidance → |
Not in downloaded KEV | 8.4High |
| CVE-2026-77878Control Web Panel (CWP) < 1.29 OS Command Injection via restoredatabase API Control Web Panel Control Web Panel Versions & vendor guidance → |
Not in downloaded KEV | 8.5High |
| CVE-2026-77877Control Web Panel (CWP) < 1.29 Unauthenticated Loopback API Root Access Control Web Panel Control Web Panel Versions & vendor guidance → |
Not in downloaded KEV | 8.5High |
| CVE-2026-77876Control Web Panel (CWP) < 1.16 OS Command Injection via protected_directory Control Web Panel Control Web Panel Versions & vendor guidance → |
Not in downloaded KEV | 8.7High |
| CVE-2026-77604Code Graph RAG: MCP paginated read_file path traversal / arbitrary file read vitali87 code-graph-rag Versions & vendor guidance → |
Not in downloaded KEV | 7.5High |
| CVE-2026-77596Kubeflow Pipelines API server lacks authorization for shared pipeline uploads kubeflow pipelines Versions & vendor guidance → |
Not in downloaded KEV | 9.6Critical |
Data sources, freshness & score definitions
The full downloaded KEV catalog is tracked, alongside CVEs found in monitored sources. This is not the entire CVE universe. CVE record enrichment rotates in bounded batches; missing fields remain unknown.
CISA KEV: checked 13 Nov 2026, 00:20 Jerusalem · 1779 records
CVE Program: checked 13 Nov 2026, 00:20 Jerusalem · 117 records · 3 records unavailable
FIRST EPSS: checked 13 Nov 2026, 00:20 Jerusalem · 2223 records
CVSS describes reported technical severity. EPSS estimates exploitation probability in the next 30 days. KEV inclusion records known exploitation, not whether your own systems are exposed.