CVE tracker
Scroll across the table to compare exploitation and severity.
| CVE / vulnerability | Exploitation | CVSS |
|---|---|---|
| CVE-2026-25536@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse modelcontextprotocol typescript-sdk Versions & vendor guidance → |
Not in downloaded KEV | 7.1High |
| CVE-2026-24887Claude Code has a Command Injection in find Command Bypasses User Approval Prompt anthropics claude-code Versions & vendor guidance → |
Not in downloaded KEV | 7.7High |
| CVE-2026-2441Google Chromium CSS Use-After-Free Vulnerability Google Chrome Versions & vendor guidance → |
Known exploitedCISA KEV | 8.8High |
| CVE-2026-24053Cluade Code has a Path Restriction Bypass via ZSH Clobber which Allows Arbitrary File Writes anthropics claude-code Versions & vendor guidance → |
Not in downloaded KEV | 7.7High |
| CVE-2026-24052Claude Code has a Domain Validation Bypass which Allows Automatic Requests to Attacker-Controlled Domains anthropics claude-code Versions & vendor guidance → |
Not in downloaded KEV | 7.1High |
| CVE-2026-21852Claude Code Leaks Data via Malicious Environment Configuration Before Trust Confirmation anthropics claude-code Versions & vendor guidance → |
Not in downloaded KEV | 5.3Medium |
| CVE-2026-21589Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability Atlassian Bamboo Data Center, Atlassian Bitbucket Data Center, Atlassian Confluence Data Center, Atlassian Crowd Data Center, Atlassian Crucible Data Center, Atlassian Fisheye Data Center, Atlassian Jira Service Management Data Center, Atlassian Jira Software Data Center Versions & vendor guidance → |
Known exploitedCISA KEV | 9.3Critical |
| CVE-2026-20320Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability Cisco Cisco BroadWorks Versions & vendor guidance → |
Known exploitedCISA KEV | 7.5High |
| CVE-2026-19868SonicWall SonicOS SSLVPN Use of Single-factor Authentication Vulnerability SonicWall SonicOS Versions & vendor guidance → |
Known exploitedCISA KEV | 7.5High |
| CVE-2026-1731Remote code execution vulnerability in BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) BeyondTrust Remote Support(RS) & Privileged Remote Access(PRA) Versions & vendor guidance → |
Known exploitedCISA KEV | 9.9Critical |
| CVE-2026-16753CVE-2026-16753 Lowcoder Lowcoder Versions & vendor guidance → |
Not in downloaded KEV | 8.8High |
| CVE-2026-16454Privilege Escalation in Eclipse hawkBit DDI allows Tenant-Isolated Firmware Exfiltration Eclipse Foundation eclipse-hawkbit/hawkbit Versions & vendor guidance → |
Not in downloaded KEV | 4.3Medium |
| CVE-2026-16306CVE-2026-16306 INFINITT Healthcare System Manager Versions & vendor guidance → |
Not in downloaded KEV | 9.8Critical |
| CVE-2026-16305CVE-2026-16305 INFINITT Healthcare System Manager Versions & vendor guidance → |
Not in downloaded KEV | 7.8High |
| CVE-2026-15410SonicWall SMA1000 Appliances Code Injection Vulnerability SonicWall SMA1000 Versions & vendor guidance → |
Known exploitedCISA KEV | 7.2High |
| CVE-2026-15409SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability SonicWall SMA1000 Versions & vendor guidance → |
Known exploitedCISA KEV | 10Critical |
| CVE-2026-14918CVE-2026-14918 Axis Communications AB Signed Video Framework, Axis Communications AB Signed media verifier, Axis Communications AB Axis File Player Versions & vendor guidance → |
Not in downloaded KEV | 5.3Medium |
| CVE-2026-13242Geolocation Field - Critical - SQL Injection - SA-CONTRIB-2026-062 Drupal Geolocation Field Versions & vendor guidance → |
Not in downloaded KEV | 6.5Medium |
| CVE-2026-12964CVE-2026-12964 Axis Communications AB AXIS Camera Station Pro Versions & vendor guidance → |
Not in downloaded KEV | 8High |
| CVE-2026-12963CVE-2026-12963 Axis Communications AB AXIS Camera Station Pro, Axis Communications AB AXIS Camera Station 5 Versions & vendor guidance → |
Not in downloaded KEV | 7.4High |
| CVE-2026-12855H19WMIHandlerSmm: unvalidated memory boundary could result in arbitrary code execution. Insyde Software InsydeH2O Reported fix guidance → |
Not in downloaded KEV | 8.2High |
| CVE-2026-126187React: Unauthenticated Remote Code Execution in React Server Components react react Versions & vendor guidance → |
Not in downloaded KEV | 9.5Critical |
| CVE-2026-125350Google Chromium Use-After-Free Vulnerability Google Chrome Versions & vendor guidance → |
Known exploitedCISA KEV | 8.8High |
| CVE-2026-125137Windows Graphics Kernel Elevation of Privilege Vulnerability Microsoft Windows 10 Version 1809, Microsoft Windows 10 Version 21H2, Microsoft Windows 10 Version 22H2, Microsoft Windows 11 version 23H2, Microsoft Windows 11 Version 23H2, Microsoft Windows 11 Version 24H2, Microsoft Windows 11 Version 25H2, Microsoft Windows 11 version 26H1, Microsoft Windows 11 Version 26H2, Microsoft Windows Server 2019, Microsoft Windows Server 2019 (Server Core installation), Microsoft Windows Server 2022, Microsoft Windows Server 2025, Microsoft Windows Server 2025 (Server Core installation) Versions & vendor guidance → |
Not in downloaded KEV | 7.8High |
| CVE-2026-125136Windows Network Connected Devices Auto-Setup Service Remote Code Execution Vulnerability Microsoft Windows 10 Version 1607, Microsoft Windows 10 Version 1809, Microsoft Windows 10 Version 21H2, Microsoft Windows 10 Version 22H2, Microsoft Windows 11 version 23H2, Microsoft Windows 11 Version 23H2, Microsoft Windows 11 Version 24H2, Microsoft Windows 11 Version 25H2, Microsoft Windows 11 version 26H1, Microsoft Windows 11 Version 26H2 Versions & vendor guidance → |
Not in downloaded KEV | 8.8High |
Data sources, freshness & score definitions
The full downloaded KEV catalog is tracked, alongside CVEs found in monitored sources. This is not the entire CVE universe. CVE record enrichment rotates in bounded batches; missing fields remain unknown.
CISA KEV: checked 13 Nov 2026, 00:20 Jerusalem · 1779 records
CVE Program: checked 13 Nov 2026, 00:20 Jerusalem · 117 records · 3 records unavailable
FIRST EPSS: checked 13 Nov 2026, 00:20 Jerusalem · 2223 records
CVSS describes reported technical severity. EPSS estimates exploitation probability in the next 30 days. KEV inclusion records known exploitation, not whether your own systems are exposed.