CVE tracker
Scroll across the table to compare exploitation and severity.
| CVE / vulnerability | Exploitation | CVSS |
|---|---|---|
| CVE-2026-48710Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks Kludex starlette Versions & vendor guidance → |
Known exploitedCISA KEV | 6.5Medium |
| CVE-2026-48558SimpleHelp Authentication Bypass via Missing OIDC JWT Signature Verification SimpleHelp SimpleHelp Versions & vendor guidance → |
Known exploitedCISA KEV | 9.5Critical |
| CVE-2026-48356Adobe Commerce | Unrestricted Upload of File with Dangerous Type (CWE-434) Adobe Adobe Commerce, Adobe Adobe Commerce B2B, Adobe Magento Open Source, Adobe Adobe Commerce Events Versions & vendor guidance → |
Known exploitedCISA KEV | 9.3Critical |
| CVE-2026-48282ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) Adobe ColdFusion 2025, Adobe ColdFusion 2023 Versions & vendor guidance → |
Known exploitedCISA KEV | 10Critical |
| CVE-2026-48172LiteSpeed cPanel Plugin Privilege Escalation Vulnerability LiteSpeed Technologies cPanel Plugin, LiteSpeed Technologies WHM Plugin Reported fix guidance → |
Known exploitedCISA KEV | 10Critical |
| CVE-2026-48027Compromised Nx Console version 18.95.0 nrwl nx-console Versions & vendor guidance → |
Known exploitedCISA KEV | 9.3Critical |
| CVE-2026-47735Arc has an authenticated arbitrary local-file read via DuckDB I/O functions that bypasses RBAC table-level checks Basekick-Labs arc Versions & vendor guidance → |
Not in downloaded KEV | 7.1High |
| CVE-2026-4762CVE-2026-4762 Axis Communications AB AXIS Camera Station Pro Versions & vendor guidance → |
Not in downloaded KEV | 8.8High |
| CVE-2026-46817Oracle E-Business Suite Improper Privilege Management Vulnerability Oracle Corporation Oracle Payments Versions & vendor guidance → |
Known exploitedCISA KEV | 9.8Critical |
| CVE-2026-46429GeoNode: Unrestricted File Upload GeoNode geonode Versions & vendor guidance → |
Not in downloaded KEV | 5.5Medium |
| CVE-2026-46406Claude Code: Insecure Temporary File in /copy Command Enables Response Disclosure and Symlink-Based File Write anthropics claude-code Versions & vendor guidance → |
Not in downloaded KEV | 4.4Medium |
| CVE-2026-46300net: skbuff: preserve shared-frag marker during coalescing Linux Linux Versions & vendor guidance → |
Known exploitedCISA KEV | 7.8High |
| CVE-2026-45659Microsoft SharePoint Remote Code Execution Vulnerability Microsoft Microsoft SharePoint Enterprise Server 2016, Microsoft Microsoft SharePoint Server 2019, Microsoft Microsoft SharePoint Server Subscription Edition Versions & vendor guidance → |
Known exploitedCISA KEV | 8.8High |
| CVE-2026-45498Microsoft Defender Denial of Service Vulnerability Microsoft Microsoft Defender Antimalware Platform Versions & vendor guidance → |
Known exploitedCISA KEV | 4Medium |
| CVE-2026-45321Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys @tanstack arktype-adapter, @tanstack eslint-plugin-router, @tanstack eslint-plugin-start, @tanstack history, @tanstack nitro-v2-vite-plugin, @tanstack react-router, @tanstack react-router-devtools, @tanstack react-router-ssr-query, @tanstack react-start, @tanstack react-start-client, @tanstack react-start-rsc, @tanstack react-start-server, @tanstack router-cli, @tanstack router-core, @tanstack router-devtools, @tanstack router-devtools-core, @tanstack router-generator, @tanstack router-plugin, @tanstack router-ssr-query-core, @tanstack router-utils, @tanstack outer-vite-plugin, @tanstack solid-router, @tanstack solid-router-devtools, @tanstack solid-router-ssr-query, @tanstack solid-start, @tanstack solid-start-client, @tanstack solid-start-server, @tanstack start-client-core, @tanstack start-fn-stubs, @tanstack start-plugin-core, @tanstack start-server-core, @tanstack start-static-server-functions, @tanstack start-storage-context, @tanstack valibot-adapter, @tanstack virtual-file-routes, @tanstack vue-router, @tanstack vue-router-devtools, @tanstack vue-router-ssr-query, @tanstack vue-start, @tanstack vue-start-client, @tanstack vue-start-server, @tanstack zod-adapter Versions & vendor guidance → |
Known exploitedCISA KEV | 9.6Critical |
| CVE-2026-45247Mirasvit Cache Warmer for Magento < 1.11.12 PHP Object Injection Mirasvit Full Page Cache Warmer for Magento 2 Versions & vendor guidance → |
Known exploitedCISA KEV | 9.3Critical |
| CVE-2026-45033GitHub Copilot CLI: Nested Bare Repository Can Execute Arbitrary Commands via core.fsmonitor github copilot-cli Versions & vendor guidance → |
Not in downloaded KEV | 8.5High |
| CVE-2026-44470Claude Desktop: Local Privilege Escalation via Directory Junction in CoworkVMService anthropics claude-code Versions & vendor guidance → |
Not in downloaded KEV | 8.5High |
| CVE-2026-44467Claude Desktop: SSH Host Key Verification Bypass Allows Man-in-the-Middle Attack on Remote Sessions anthropics claude-code Versions & vendor guidance → |
Not in downloaded KEV | 7.4High |
| CVE-2026-44267Elo: Sandbox escape to arbitrary Node.js / browser code execution via unfiltered `.constructor` member access in Elo JavaScript emitter enspirit elo Versions & vendor guidance → |
Not in downloaded KEV | 9.8Critical |
| CVE-2026-44266Elo: Remote Code Execution in Elo Ruby backend via unescaped `#{...}` interpolation in emitted string literals and subtype-constraint labels enspirit elo Versions & vendor guidance → |
Not in downloaded KEV | 9.8Critical |
| CVE-2026-44265Elo: Code injection in Elo backends via unvalidated emission of programmatic AST fields enspirit elo Versions & vendor guidance → |
Not in downloaded KEV | 7.4High |
| CVE-2026-44209Banks: Critical Remote Code Execution (RCE) via Jinja2 SSTI masci banks Versions & vendor guidance → |
Not in downloaded KEV | 7.5High |
| CVE-2026-43284xfrm: esp: avoid in-place decrypt on shared skb frags Linux Linux Versions & vendor guidance → |
Not in downloaded KEV | 8.8High |
| CVE-2026-42897Microsoft Exchange Server Spoofing Vulnerability Microsoft Microsoft Exchange Server 2016 Cumulative Update 23, Microsoft Microsoft Exchange Server 2019 Cumulative Update 14, Microsoft Microsoft Exchange Server 2019 Cumulative Update 15, Microsoft Microsoft Exchange Server Subscription Edition RTM Versions & vendor guidance → |
Known exploitedCISA KEV | 8.1High |
Data sources, freshness & score definitions
The full downloaded KEV catalog is tracked, alongside CVEs found in monitored sources. This is not the entire CVE universe. CVE record enrichment rotates in bounded batches; missing fields remain unknown.
CISA KEV: checked 13 Nov 2026, 00:20 Jerusalem · 1779 records
CVE Program: checked 13 Nov 2026, 00:20 Jerusalem · 117 records · 3 records unavailable
FIRST EPSS: checked 13 Nov 2026, 00:20 Jerusalem · 2223 records
CVSS describes reported technical severity. EPSS estimates exploitation probability in the next 30 days. KEV inclusion records known exploitation, not whether your own systems are exposed.