Possible exploit chains
KCV Watch™
Pairs of CVEs whose exploit steps connect, ranked each night.
An exploit chain joins two flaws so that the first supplies what the second needs, such as an authentication bypass that opens the way to a code execution bug. Known Chained Vulnerabilities (KCV)™ holds the chains that cited sources report. KCV Watch™ looks for the pairs no source has named yet. Each night it reads what each CVE's exploit needs and what it gains, pairs the CVEs whose steps connect or whose records tie them together, and places each pair in one of three tiers by how often pairs with the same signals turned out to be reported chains. The full list, the keyed API and the nightly download are on cve-security.com. This page carries tonight's strongest pairs, the Breaking watch and the rates behind the tiers.
Breaking watch
Connected pairs on one product where a CVE carries an exploitation report or field sighting. A pair joins the watch the day it qualifies and stays for a set time: 30 days from a joint disclosure, or 90 days from the second report when both CVEs carry one. The watch adds no rate of its own, so each pair keeps its tier. The newest eight of tonight's 162 are here.
VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV) added CVE-2026-25895 on Aug. 18, 2026, and VulnCheck KEV added CVE-2025-69971 on Nov. 10, 2026, 84 days later. A successful chained exploit could combine the two.
- Tier AOpenemr OpenemrOn the watch 2026-11-10 to 2027-02-07
VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV) added CVE-2026-124446 on Nov. 10, 2026, and VulnCheck KEV added CVE-2026-124450 on Nov. 10, 2026. A successful chained exploit could combine the two.
- Tier AOpenemr OpenemrOn the watch 2026-11-10 to 2027-02-07
VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV) added CVE-2026-124446 on Nov. 10, 2026, and VulnCheck KEV added CVE-2026-124490 on Nov. 10, 2026. A successful chained exploit could combine the two.
- Tier AOpenemr OpenemrOn the watch 2026-11-10 to 2027-02-07
VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV) added CVE-2026-124450 on Nov. 10, 2026, and VulnCheck KEV added CVE-2026-124490 on Nov. 10, 2026. A successful chained exploit could combine the two.
- Tier BDbgate DbgateOn the watch 2026-11-10 to 2027-02-07CVECVE-2026-47670DbGate vulnerable to authenticated remote code execution via loadReader functionName code injection
VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV) added CVE-2026-47670 on Nov. 2, 2026, and VulnCheck KEV added CVE-2026-47668 on Nov. 10, 2026, eight days later. A successful chained exploit could combine the two.
VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV) added CVE-2013-1965 on Nov. 8, 2026, and VulnCheck KEV added CVE-2011-3923 on Nov. 9, 2026, one day later. A successful chained exploit could combine the two.
- Not tiered8theme XstoreOn the watch 2026-11-09 to 2027-02-06CVECVE-2025-11746XStore Multipurpose WooCommerce WordPress theme authenticated (Subscriber+) local file inclusion
VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV) added CVE-2024-33563 on Oct. 26, 2026, and VulnCheck KEV added CVE-2025-11746 on Nov. 9, 2026, 14 days later. A successful chained exploit could combine the two.
- Tier BFreescout Help Desk FreescoutOn the watch 2026-11-09 to 2027-02-06CVECVE-2026-53595FreeScout vulnerable to anonymous account takeover via /user-setup empty invite_hash on MySQL
VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV) added CVE-2026-53595 on Oct. 30, 2026, and VulnCheck KEV added CVE-2026-62856 on Nov. 9, 2026, 10 days later. A successful chained exploit could combine the two.
All 162 pairs on the Breaking watch, with the rule that admits them
Tonight's top 24
Tier A pairs, ordered by how many of the two CVEs carry an exploitation report or field sighting and then by the newest disclosure. A product shows at most two pairs here. Where the capability analysis reads an entry step, the pair reads from it to the next step. Follow a CVE to its page on cve-security.com for its capabilities, sources and vendor fixes.
- Tier AOpenemr OpenemrExploitation report or field sighting on both CVEsConnects through reusable credential
CVE-2026-124450 yields a reusable credential, and CVE-2026-124446 requires that foothold. A successful chained exploit could advance the intrusion.
- Tier AOpenemr OpenemrExploitation report or field sighting on both CVEsConnects through reusable credential
CVE-2026-124490 yields a reusable credential, and CVE-2026-124446 requires that foothold. A successful chained exploit could advance the intrusion.
- Tier APerforce Puppet EnterpriseExploitation report or field sighting on both CVEsConnects through code execution on the host
CVE-2026-115731 yields code execution, and CVE-2026-115732 requires credentials. A successful chained exploit could advance the intrusion.
- Tier AGfi Usa Llc Gfi KerioconnectExploitation report or field sighting on both CVEsConnects through reusable credential
CVE-2026-112353 yields a reusable credential, and CVE-2026-112357 requires that privilege. A successful chained exploit could advance the intrusion.
- Entry stepCVE-2026-97229 KEVGitLab Community Edition and Enterprise Edition integer overflow or wraparoundConnects through code execution on the host
CVE-2026-97229 yields code execution, and CVE-2026-110264 requires file access. A successful chained exploit could advance the intrusion.
- Tier AGeonetwork Core GeonetworkExploitation report or field sighting on both CVEsConnects through related capability the next step could use
CVE-2026-63219 yields file access, and CVE-2026-58400 requires file access. A successful chained exploit could advance the intrusion.
- Connects through code execution on the host
CVE-2026-63520 yields code execution, and CVE-2026-65660 requires file access. A successful chained exploit could advance the intrusion.
- Connects through reusable credentialNext stepCVE-2026-56270Flowise Unauthenticated OAuth secrets disclosure via /API/v1/loginmethod endpoint
CVE-2026-56271 yields a reusable credential, and CVE-2026-56270 requires credentials. A successful chained exploit could advance the intrusion.
- Connects through related capability the next step could use
CVE-2025-71324 yields file access, and CVE-2025-71334 requires file access. A successful chained exploit could advance the intrusion.
- Connects through network position
CVE-2026-34197 yields a forged internal request, and CVE-2026-40466 requires that foothold. A successful chained exploit could advance the intrusion.
- Connects through privilege gain inside the product
CVE-2025-59719 yields an elevated identity, and CVE-2025-58034 requires that privilege. A successful chained exploit could advance the intrusion.
- Tier AHikvision Csmp Isecure CenterExploitation report or field sighting on both CVEsConnects through code execution on the host
CVE-2024-58274 yields code execution, and CVE-2023-53691 requires file access. A successful chained exploit could advance the intrusion.
- Connects through privilege gain by a logged-in user
CVE-2025-61955 yields a privilege gain for a logged-in user, and CVE-2025-57780 requires that foothold. A successful chained exploit could advance the intrusion.
- Connects through code execution on the hostNext stepCVE-2025-20333 KEVCisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) buffer overflow
CVE-2025-20363 yields code execution, and CVE-2025-20333 requires credentials. A successful chained exploit could advance the intrusion.
- Connects through code execution on the host
CVE-2025-53690 yields code execution, and CVE-2025-34510 requires credentials. A successful chained exploit could advance the intrusion.
- Connects through code execution on the host
CVE-2025-53690 yields code execution, and CVE-2025-34511 requires credentials. A successful chained exploit could advance the intrusion.
- Tier AMerit Lilin Dvr FirmwareExploitation report or field sighting on both CVEsConnects through related capability the next step could use
CVE-2025-34130 yields file access, and CVE-2025-34129 requires file access. A successful chained exploit could advance the intrusion.
- Connects through privilege gain inside the product
CVE-2025-34034 yields an elevated identity, and CVE-2025-34033 requires that privilege. A successful chained exploit could advance the intrusion.
- Connects through code execution on the host
CVE-2025-47165 yields code execution, and CVE-2025-47176 requires file access. A successful chained exploit could advance the intrusion.
- Connects through related capability the next step could use
CVE-2025-47176 yields code execution, and CVE-2025-47170 requires that foothold. A successful chained exploit could advance the intrusion.
- Entry stepCVE-2025-48927 KEVTeleMessage TM SGNL initialization of a resource with an insecure defaultConnects through reusable credential
CVE-2025-48927 yields a reusable credential, and CVE-2025-48928 requires that foothold. A successful chained exploit could advance the intrusion.
- Connects through leaked secret the next step needs
CVE-2024-4040 yields an information disclosure, and CVE-2025-31161 requires that secret. A successful chained exploit could advance the intrusion.
- Connects through related capability the next step could use
CVE-2025-2609 yields a data write, and CVE-2025-2610 requires that privilege. A successful chained exploit could advance the intrusion.
- Entry stepCVE-2024-12084Rsync: Heap buffer overflow in rsync due to improper checksum length handlingConnects through code execution on the host
CVE-2024-12084 yields code execution, and CVE-2024-12087 requires file access. A successful chained exploit could advance the intrusion.
The whole list on cve-security.com: tiers A and B, filtered by product, bridge or capability
How often a tier holds a chain
Each tier is a measured rate. The build takes the pairs whose later CVE is at least 90 days old, so a source has had time to report a chain, and counts how many are known chains in KCV. A tier promises a floor, and the last measurement, on Oct. 7, 2026, sits beside it.
- Tier A690 pairs tonightAt least one in 25About one in 20 at the last measurement
- Tier B10,201 pairs tonightAt least one in 100About one in 40 at the last measurement
- Tier C58,673 pairs, in the download and the APIAt least one in 1,000About one in 350 at the last measurement
Each dot is one pair, and the lit dot is the chain the floor promises. A rate describes the group of pairs that share a row's signals and prints on no single row. A tier A pair may still fail in practice, and a pair outside the list may still chain.
What the list counts
- A capability
- For each CVE with a CVSS vector, a fixed rule reads the vector, the weakness class and the description for what an exploit needs to start and what it gains, on a fixed vocabulary. Where the dataset holds exploit code or a patch diff, a model reads those as well, and a second model answers what each flaw does on its own.
- A pair
- Two CVEs form a candidate when one CVE's gain meets what the other needs through a named bridge, such as an authentication bypass that opens the foothold a second flaw needs. The pair passes a fixed gate: the second step advances the attacker, at least one of the two can be reached without local access, and no cited source names the pair in a known chain yet. Other pairs enter on their records, such as exploitation reports on both CVEs within 90 days or a joint disclosure with a shared advisory, patch or fixed version.
- The tiers
- Four record facts set a pair's score: how close the two disclosure dates are, a shared advisory or patch, a shared fixed version, and how many of the two CVEs carry an exploitation report or field sighting. A pair reaches tier A only with a documented handoff between its two CVEs, and a pair across two products reaches tier B at most. This page and the list show tiers A and B; tier C is in the download and the API.
- Exploitation
- A report or field sighting comes from CISA KEV, VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV) and the other trackers cve-security.com reads, plus sensor sightings. A KEV chip marks each CVE that CISA lists.
- What a pair says
- A pair on this page is a possible chain, published for teams to research. Confirmation belongs to Known Chained Vulnerabilities (KCV)™, where a cited source reports the two CVEs used together. Two CVEs named in one thread count as discussion until a source reports them used together.