CVE tracker — Exploitation, versions & score history

Scroll across the table to compare exploitation and severity.

Matching CVEs and exploitation evidence. CVSS measures reported severity. Unknown scores are not zero.
CVE / vulnerability	Exploitation	CVSS
CVE-2026-8372 CVE-2026-8372 Axis Communications AB AXIS Camera Station Pro Versions & vendor guidance →	Not in downloaded KEV	8.8High
CVE-2026-83563 Winlogon Elevation of Privilege Vulnerability Microsoft Windows 11 version 23H2, Microsoft Windows 11 Version 23H2, Microsoft Windows 11 Version 24H2, Microsoft Windows 11 Version 25H2, Microsoft Windows 11 version 26H1, Microsoft Windows 11 Version 26H2, Microsoft Windows Server 2025, Microsoft Windows Server 2025 (Server Core installation) Versions & vendor guidance →	Not in downloaded KEV	7.8High
CVE-2026-83549 SonicWall SMA1000 Appliances OS Command Injection Vulnerability SonicWall SMA1000 Versions & vendor guidance →	Known exploitedCISA KEV	7.8High
CVE-2026-83548 SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability SonicWall SMA1000 Versions & vendor guidance →	Known exploitedCISA KEV	10Critical
CVE-2026-8333 TimePictra Stored Cross-site Scripting Microchip TimePictra Reported fix guidance →	Not in downloaded KEV	9.4Critical
CVE-2026-8332 TimePictra root password hardcoded in installation files Microchip TimePictra Reported fix guidance →	Not in downloaded KEV	8.8High
CVE-2026-8331 TimePictra ermote code execution via file upload Microchip TimePictra Reported fix guidance →	Not in downloaded KEV	8.8High
CVE-2026-82413 ntopng: authenticated (non-admin) OS command injection via the vulnerability-scan `scan_ports` parameter (`nmap` argument reaches `popen`) ntop ntopng Versions & vendor guidance →	Not in downloaded KEV	8.8High
CVE-2026-82329 Potential authentication bypass leading to administrative access in Artifactory jfrog artifactory Versions & vendor guidance →	Known exploitedCISA KEV	9.8Critical
CVE-2026-82078 PaperCut MF/NG: Unsafe Dynamic Class Loading in Database Connector PaperCut PaperCut MF/NG Versions & vendor guidance →	Known exploitedCISA KEV	9.4Critical
CVE-2026-81963 Windows Update Stack Elevation of Privilege Vulnerability Microsoft Windows 11 version 23H2, Microsoft Windows 11 Version 23H2, Microsoft Windows 11 Version 24H2, Microsoft Windows 11 Version 25H2, Microsoft Windows 11 version 26H1, Microsoft Windows Server 2025, Microsoft Windows Server 2025 (Server Core installation) Versions & vendor guidance →	Known exploitedCISA KEV	7.8High
CVE-2026-81578 PaperCut MF/NG: Authentication Bypass PaperCut PaperCut MF/NG Versions & vendor guidance →	Known exploitedCISA KEV	8.8High
CVE-2026-81384 Windows DNS Server Remote Code Execution Vulnerability Microsoft Windows Server 2022, Microsoft Windows Server 2025, Microsoft Windows Server 2025 (Server Core installation) Versions & vendor guidance →	Not in downloaded KEV	8.1High
CVE-2026-8037 OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF Progress Software LoadMaster, Progress Software ECS Connections Manager, Progress Software Object Scale Connection Manager, Progress Software MOVEit WAF Versions & vendor guidance →	Known exploitedCISA KEV	9.6Critical
CVE-2026-77881 Control Web Panel (CWP) < 1.29 Blind SQL Injection via user Parameter Control Web Panel Control Web Panel Versions & vendor guidance →	Not in downloaded KEV	6.8Medium
CVE-2026-77880 Control Web Panel (CWP) < 1.16 OS Command Injection via /newpass/ Control Web Panel Control Web Panel Versions & vendor guidance →	Not in downloaded KEV	8.5High
CVE-2026-77879 Control Web Panel (CWP) < 1.16 SQL Injection via access_token() API Control Web Panel Control Web Panel Versions & vendor guidance →	Not in downloaded KEV	8.4High
CVE-2026-77878 Control Web Panel (CWP) < 1.29 OS Command Injection via restoredatabase API Control Web Panel Control Web Panel Versions & vendor guidance →	Not in downloaded KEV	8.5High
CVE-2026-77877 Control Web Panel (CWP) < 1.29 Unauthenticated Loopback API Root Access Control Web Panel Control Web Panel Versions & vendor guidance →	Not in downloaded KEV	8.5High
CVE-2026-77876 Control Web Panel (CWP) < 1.16 OS Command Injection via protected_directory Control Web Panel Control Web Panel Versions & vendor guidance →	Not in downloaded KEV	8.7High
CVE-2026-77604 Code Graph RAG: MCP paginated read_file path traversal / arbitrary file read vitali87 code-graph-rag Versions & vendor guidance →	Not in downloaded KEV	7.5High
CVE-2026-77596 Kubeflow Pipelines API server lacks authorization for shared pipeline uploads kubeflow pipelines Versions & vendor guidance →	Not in downloaded KEV	9.6Critical
CVE-2026-77463 Remark42: Rate limit bypass via unconditional trust of X-Forwarded-For/X-Real-IP headers in direct-internet deployment umputun remark42 Versions & vendor guidance →	Not in downloaded KEV	6.5Medium
CVE-2026-76893 tsParticles: A single anonymous MCP session can monopolize HTTP mode and deny new clients tsparticles tsparticles, @tsparticles mcp-server Versions & vendor guidance →	Not in downloaded KEV	6.9Medium
CVE-2026-76519 Cisco Secure Email Gateway Arbitrary File Write Vulnerability Cisco Cisco Secure Email Versions & vendor guidance →	Known exploitedCISA KEV	9.8Critical

Data sources, freshness & score definitions

The full downloaded KEV catalog is tracked, alongside CVEs found in monitored sources. This is not the entire CVE universe. CVE record enrichment rotates in bounded batches; missing fields remain unknown.

CISA KEV: checked 13 Nov 2026, 00:20 Jerusalem · 1779 records

CVE Program: checked 13 Nov 2026, 00:20 Jerusalem · 117 records · 3 records unavailable

FIRST EPSS: checked 13 Nov 2026, 00:20 Jerusalem · 2223 records

CVSS describes reported technical severity. EPSS estimates exploitation probability in the next 30 days. KEV inclusion records known exploitation, not whether your own systems are exposed.