CVE Bestiary

Recent AI models are revealing a host of bugs ("Common Vulnerabilities and Exposures") in widely used software.

Personally, I find such reports to be dry reading, so I've converted a number of recent reports into Magic-style cards. Should I make more? Let me know.

How to read a CVE Bestiary Card. CLASS: the weakness class (CWE family); the kind of bug, such as memory corruption or SQL injection. PREY: the software it preys upon. ATTACK: mechanism and severity (as indicated by CVSS, a 0-10 severity score). COUNTER-ATTACK: the fix, if it exists. Red stamp: the bug is being exploited in the wild already (in CISA's KEV catalog). Footer: CVE IDs, CVSS, EPSS percentile, KEV status, advisory link, N/13.
How to read a card
Glossary. CISA: Cybersecurity and Infrastructure Security Agency, the US federal agency that runs the KEV catalog and sets the federal patch deadlines. CVE: Common Vulnerabilities and Exposures, a public identifier for one specific bug. CWE: Common Weakness Enumeration, the class the bug belongs to. CVSS: Common Vulnerability Scoring System, severity 0-10 as scored by the vendor, 9.0 and up is critical. EPSS: Exploit Prediction Scoring System, the estimated chance, updated daily, that this CVE is exploited within 30 days. KEV: CISA's Known Exploited Vulnerabilities catalog, bugs confirmed to be exploited in the wild with a US federal patch deadline. N/13: position in the series.
Glossary

Each card is a specimen page for one advisory: the weakness class, what it preys on, how it attacks, the fix, and the scores. Cards marked (provisional) were built from the vendor advisory before NVD carried the record, and their copy comes from the advisory named on the card.

16 cards, CVSS 10.0 highest, 7 in CISA KEV, 4 provisional

CVE Bestiary, sortable by id, date and name
Card Class CVSS KEV
Card face: Ascendant Guest, INJECTOR, CVE-2026-114625 Ascendant Guest
2026-B-0012		 CVE-2026-114625 INJECTOR 9.4 2026-10-22 KEV
Card face: Brotli Coilworm, MEMORY WYRM, CVE-2026-111497 Brotli Coilworm
2026-B-0013		 CVE-2026-111497 MEMORY WYRM 9.2 2026-10-22
Card face: Decima, the Infinite Sum, ARITHMETIC, CVE-2026-110264 Decima, the Infinite Sum
2026-B-0014		 CVE-2026-110264 ARITHMETIC 10.0 2026-10-22
Card face: Envelope Wyrm, BURROWER, CVE-2026-76519 Envelope Wyrm
2026-B-0007		 CVE-2026-76519 BURROWER 9.8 2026-10-14 KEV
Card face: Longjmp Leviathan, MEMORY REVENANT, CVE-2026-109618 Longjmp Leviathan
2026-B-0011		 CVE-2026-109618 MEMORY REVENANT 9.2 2026-10-21
Card face: Masquer, the Second Face, FALSE GATE, CVE-2026-104935 Masquer, the Second Face
2026-B-0005		 CVE-2026-104935 FALSE GATE 8.6 2026-10-13 KEV
Card face: Query Viper, INJECTOR, CVE-2026-0322 Query Viper
2026-B-0008		 CVE-2026-0322 INJECTOR 8.6 2026-10-14 KEV
Card face: Second Face, FALSE GATE, CVE-2026-115884 Second Face (provisional)
2026-B-0002		 CVE-2026-115884 FALSE GATE 7.4 2026-10-12
Card face: Shatter Sphinx, CIPHER WRAITH, GOAHEAD-SA-2026-0005 Shatter Sphinx (provisional)
2026-B-0003		 GOAHEAD-SA-2026-0005 CIPHER WRAITH 5.9 2026-10-12
Card face: Shellbound Mimic, INJECTOR, CVE-2026-112900 Shellbound Mimic
2026-B-0010		 CVE-2026-112900 INJECTOR 9.2 2026-10-19
Card face: The Badgeless, FALSE GATE, CVE-2026-102764 The Badgeless
2026-B-0009		 CVE-2026-102764 FALSE GATE 9.3 2026-10-15 KEV
Card face: The Door Without a Number, UNNAMED, ZDI-CAN-33774 / ZDI-CAN-33549 The Door Without a Number (provisional)
2026-B-0016		 ZDI-CAN-33774 / ZDI-CAN-33549 UNNAMED 2026-10-23
Card face: The Forged Gatekeeper, FALSE GATE, CVE-2026-115881 The Forged Gatekeeper (provisional)
2026-B-0004		 CVE-2026-115881 FALSE GATE 9.1 2026-10-12
Card face: The Keyless Warden, FALSE GATE, CVE-2026-79844 The Keyless Warden
2026-B-0015		 CVE-2026-79844 FALSE GATE 10.0 2026-10-22
Card face: The Many-Doored Room, BURROWER, CVE-2026-96656 The Many-Doored Room
2026-B-0001		 CVE-2026-96656 BURROWER 8.6 2026-09-23 KEV
Card face: The Unmarked Parcel, TRICKSTER, CVE-2026-96951 The Unmarked Parcel
2026-B-0006		 CVE-2026-96951 TRICKSTER 8.8 2026-10-13 KEV

Scores are the CVSS base scores the card records; dates are the advisory publication dates.