CVE tracker
Scroll across the table to compare exploitation and severity.
| CVE / vulnerability | Exploitation | CVSS |
|---|---|---|
| CVE-2026-44265Elo: Code injection in Elo backends via unvalidated emission of programmatic AST fields enspirit elo Versions & vendor guidance → |
Not in downloaded KEV | 7.4High |
| CVE-2026-44209Banks: Critical Remote Code Execution (RCE) via Jinja2 SSTI masci banks Versions & vendor guidance → |
Not in downloaded KEV | 7.5High |
| CVE-2026-43284xfrm: esp: avoid in-place decrypt on shared skb frags Linux Linux Versions & vendor guidance → |
Not in downloaded KEV | 8.8High |
| CVE-2026-41709ESX insufficient logging vulnerability VMware Cloud Foundation, VMware vSphere Foundation, VMware ESX, VMware Telco Cloud Platform Versions & vendor guidance → |
Known exploitedCISA KEV | 2.7Low |
| CVE-2026-40217CVE-2026-40217 BerriAI LiteLLM Versions & vendor guidance → |
Not in downloaded KEV | 8.8High |
| CVE-2026-40197Incus nil-pointer dereference in custom volume import allows denial of service lxc incus Versions & vendor guidance → |
Not in downloaded KEV | 7.1High |
| CVE-2026-40068Claude Code arbitrary code execution via git worktree commondir trust dialog bypass anthropics claude-code Versions & vendor guidance → |
Not in downloaded KEV | 7.7High |
| CVE-2026-39861Claude Code: Sandbox Escape via Symlink Following Allows Arbitrary File Write Outside Workspace anthropics claude-code Versions & vendor guidance → |
Not in downloaded KEV | 7.7High |
| CVE-2026-3910Google Chromium V8 Improper Restriction of Operations Within the Bounds of a Memory Buffer Vulnerability Google Chrome Versions & vendor guidance → |
Known exploitedCISA KEV | 8.8High |
| CVE-2026-3909Google Skia Out-of-Bounds Write Vulnerability Google Chrome Versions & vendor guidance → |
Known exploitedCISA KEV | 8.8High |
| CVE-2026-3833Gnutls: gnutls: policy bypass due to case-sensitive nameconstraints comparison , Red Hat Red Hat Enterprise Linux 10, Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support, Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support, Red Hat Red Hat Enterprise Linux 8, Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On, Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On, Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service, Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions, Red Hat Red Hat Enterprise Linux 9, Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions, Red Hat Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions, Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support, Red Hat Red Hat OpenShift Container Platform 4.12, Red Hat Red Hat OpenShift Container Platform 4.13, Red Hat Red Hat OpenShift Container Platform 4.14, Red Hat Red Hat OpenShift Container Platform 4.15, Red Hat Red Hat OpenShift Container Platform 4.16, Red Hat Red Hat OpenShift Container Platform 4.17, Red Hat Red Hat OpenShift Container Platform 4.18, Red Hat Red Hat OpenShift Container Platform 4.19, Red Hat Cert Manager support for Red Hat OpenShift release 1.17, Red Hat Cert Manager support for Red Hat OpenShift release 1.18, Red Hat Cert Manager support for Red Hat OpenShift release 1.20, Red Hat Red Hat Discovery 2, Red Hat Red Hat Hardened Images, Red Hat Red Hat OpenShift AI 3.4, Red Hat Red Hat Update Infrastructure 5, Red Hat Red Hat Enterprise Linux 6, Red Hat Red Hat OpenShift Container Platform 4 Reported workaround → |
Not in downloaded KEV | 6.5Medium |
| CVE-2026-35603Claude Code: Insecure System-Wide Configuration Loading Enables Local Privilege Escalation on Windows anthropics claude-code Versions & vendor guidance → |
Not in downloaded KEV | 5.4Medium |
| CVE-2026-3547wolfSSL: out-of-bounds read (DoS) in ALPN parsing due to incomplete validation wolfSSL wolfSSL Reported fix guidance → |
Not in downloaded KEV | 7.5High |
| CVE-2026-35273Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability Oracle Corporation PeopleSoft Enterprise PeopleTools Versions & vendor guidance → |
Known exploitedCISA KEV | 9.8Critical |
| CVE-2026-34073cryptography has incomplete DNS name constraint enforcement on peer names pyca cryptography Versions & vendor guidance → |
Not in downloaded KEV | 1.7Low |
| CVE-2026-33891Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Input digitalbazaar forge Versions & vendor guidance → |
Not in downloaded KEV | 7.5High |
| CVE-2026-33068Claude Code has a Workspace Trust Dialog Bypass via Repo-Controlled Settings File anthropics claude-code Versions & vendor guidance → |
Not in downloaded KEV | 7.7High |
| CVE-2026-33050GeoNode: OS command injection via uploaded file layer name GeoNode geonode Versions & vendor guidance → |
Not in downloaded KEV | 8.8High |
| CVE-2026-32885DDEV has ZipSlip path traversal in tar and zip archive extraction ddev ddev Versions & vendor guidance → |
Not in downloaded KEV | 6.5Medium |
| CVE-2026-28385SSRF via image import from URL allows internal network probing by authenticated users Canonical lxd Versions & vendor guidance → |
Not in downloaded KEV | 5Medium |
| CVE-2026-27735mcp-server-git : Path traversal in git_add allows staging files outside repository boundaries modelcontextprotocol servers Versions & vendor guidance → |
Not in downloaded KEV | 6.4Medium |
| CVE-2026-25725Claude Code Has Sandbox Escape via Persistent Configuration Injection in settings.json anthropics claude-code Versions & vendor guidance → |
Not in downloaded KEV | 7.7High |
| CVE-2026-25724Claude Code Has Permission Deny Bypass Through Symbolic Links anthropics claude-code Versions & vendor guidance → |
Not in downloaded KEV | 2.3Low |
| CVE-2026-25723Claude Code Vulnerable to Command Injection via Piped sed Command Bypasses File Write Restrictions anthropics claude-code Versions & vendor guidance → |
Not in downloaded KEV | 7.7High |
| CVE-2026-25722Claude Code Vulnerable to Command Injection via Directory Change Bypasses Write Protection anthropics claude-code Versions & vendor guidance → |
Not in downloaded KEV | 7.7High |
Data sources, freshness & score definitions
The full downloaded KEV catalog is tracked, alongside CVEs found in monitored sources. This is not the entire CVE universe. CVE record enrichment rotates in bounded batches; missing fields remain unknown.
CISA KEV: checked 13 Nov 2026, 00:20 Jerusalem · 1779 records
CVE Program: checked 13 Nov 2026, 00:20 Jerusalem · 117 records · 3 records unavailable
FIRST EPSS: checked 13 Nov 2026, 00:20 Jerusalem · 2223 records
CVSS describes reported technical severity. EPSS estimates exploitation probability in the next 30 days. KEV inclusion records known exploitation, not whether your own systems are exposed.