Vulnerability Intelligence · All CVEs
Every Published CVE, Searchable.
Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status.
Synced hourly · figures as of Oct 20, 2026
40,421 vulnerabilities · newest first
- CVE-2026-66569Critical 9.8WordPress Kicker theme <= 2.2.1 - PHP Object Injection vulnerabilityPublished Oct 10, 2026
- CVE-2026-66568Critical 9.8WordPress Original theme <= 1.9.0 - PHP Object Injection vulnerabilityPublished Oct 10, 2026
- CVE-2026-66567Critical 9.8WordPress Anesta theme <= 1.5.3 - PHP Object Injection vulnerabilityPublished Oct 10, 2026
- CVE-2026-66565Critical 9.8WordPress FC United theme <= 1.1.1 - PHP Object Injection vulnerabilityPublished Oct 10, 2026
- CVE-2026-66564Critical 9.8WordPress ShiftCV theme <= 3.0.14 - PHP Object Injection vulnerabilityPublished Oct 10, 2026
- CVE-2026-66563Critical 9.8WordPress Windsor theme <= 2.10 - PHP Object Injection vulnerabilityPublished Oct 10, 2026
- CVE-2026-66483Critical 9.8WordPress Education Center theme <= 3.6.12 - PHP Object Injection vulnerabilityPublished Oct 10, 2026
- CVE-2026-66482Critical 9.8WordPress Drone Media theme <= 2.2.0 - PHP Object Injection vulnerabilityPublished Oct 10, 2026
- CVE-2026-62129Critical 9.9WordPress Creator LMS plugin <= 1.2.21 - Arbitrary File Upload vulnerabilityPublished Oct 10, 2026
- CVE-2026-62125Critical 9.8WordPress Asia Garden theme <= 1.3.1 - PHP Object Injection vulnerabilityPublished Oct 10, 2026
- CVE-2026-62124Critical 9.8WordPress N7 | Golf Club Sports & Events theme <= 2.21 - PHP Object Injection vulnerabilityPublished Oct 10, 2026
- CVE-2026-62123Critical 9.8WordPress Invetex theme <= 2.18 - PHP Object Injection vulnerabilityPublished Oct 10, 2026
- CVE-2026-62120Critical 9.8WordPress Law Office theme <= 3.20 - PHP Object Injection vulnerabilityPublished Oct 10, 2026
- CVE-2026-62090Critical 9.8WordPress WineShop theme <= 3.20 - PHP Object Injection vulnerabilityPublished Oct 10, 2026
- CVE-2026-62087Critical 9.8WordPress Equadio theme <= 1.1.4 - PHP Object Injection vulnerabilityPublished Oct 10, 2026
- CVE-2026-62086Critical 9.8WordPress Juno theme <= 2.25 - PHP Object Injection vulnerabilityPublished Oct 10, 2026
- CVE-2026-62077Critical 9.8WordPress Avala theme <= 1.1.4 - PHP Object Injection vulnerabilityPublished Oct 10, 2026
- CVE-2026-62076Critical 9.8WordPress Kalles theme <= 1.1.7.1 - PHP Object Injection vulnerabilityPublished Oct 10, 2026
- CVE-2026-62054Critical 9.8WordPress Yacht Rental theme <= 2.6 - PHP Object Injection vulnerabilityPublished Oct 10, 2026
- CVE-2026-62053Critical 9.8WordPress Wine House theme <= 3.20 - PHP Object Injection vulnerabilityPublished Oct 10, 2026
- CVE-2026-62052Critical 9.8WordPress Tipsy theme <= 1.6 - PHP Object Injection vulnerabilityPublished Oct 10, 2026
- CVE-2026-62051Critical 9.8WordPress Stargaze theme <= 1.10 - PHP Object Injection vulnerabilityPublished Oct 10, 2026
- CVE-2026-62050Critical 9.8WordPress Splendour theme <= 1.23 - PHP Object Injection vulnerabilityPublished Oct 10, 2026
- CVE-2026-62032Critical 9.8WordPress DirectoryPress plugin <= 3.6.27 - Local File Inclusion vulnerabilityPublished Oct 10, 2026
- CVE-2026-62031Critical 9.3WordPress uListing plugin <= 2.2.0 - SQL Injection vulnerabilityPublished Oct 10, 2026
- CVE-2026-62025Critical 9.0WordPress Tailored Tools plugin <= 3.0.3 - Arbitrary File Upload vulnerabilityPublished Oct 10, 2026
- CVE-2026-62024Critical 9.9WordPress CodeBard Help Desk plugin <= 1.1.2 - Arbitrary File Upload vulnerabilityPublished Oct 10, 2026
- CVE-2026-62022Critical 9.8WordPress Tonda Membership plugin <= 1.0.1 - Privilege Escalation vulnerabilityPublished Oct 10, 2026
- CVE-2026-42723Critical 9.8WordPress CleanSkin theme <= 1.5.0 - PHP Object Injection vulnerabilityPublished Oct 10, 2026
- CVE-2026-42719Critical 9.8WordPress Dynamic User Directory plugin <= 2.4 - PHP Object Injection vulnerabilityPublished Oct 10, 2026
- CVE-2026-42718Critical 9.8WordPress Booster for WooCommerce plugin <= 8.4.0 - PHP Object Injection vulnerabilityPublished Oct 10, 2026
- CVE-2026-42716Critical 9.8WordPress Payever - WooCommerce Gateway plugin <= 4.8.2 - PHP Object Injection vulnerabilityPublished Oct 10, 2026
- CVE-2026-42696Critical 10.0WordPress SiteVault – Backup, Restore, Migration & Cloning plugin <= 1.5.18 - Remote Code Execution (RCE) vulnerabilityPublished Oct 10, 2026
- CVE-2026-40800Critical 9.3WordPress ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin <= 1.5.3 - SQL Injection vulnerabilityPublished Oct 10, 2026
- CVE-2026-39801Critical 9.8WordPress AIWU plugin <= 1.5.9 - Privilege Escalation vulnerabilityPublished Oct 10, 2026
- CVE-2026-108598Critical 9.3Floci 1.1.0 before 2.2.0 RCE via API Gateway VTL Mapping TemplatesPublished Oct 10, 2026
- CVE-2026-106610Critical 9.8WordPress miniorange otp verification plugin <= 5.5.7 - Privilege Escalation vulnerabilityPublished Oct 10, 2026
- CVE-2026-105892Critical 9.8WordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.7.13 - Arbitrary File Deletion vulnerabilityPublished Oct 10, 2026
- CVE-2026-105889Critical 9.3Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tickera Tickera tickera-event-ticketing-system allows Blind SQL Injection.This issue affects Tickera: from n/a through 3.6.0.6.Published Oct 10, 2026
- CVE-2026-104398Critical 9.8Deserialization of Untrusted Data vulnerability in VillaTheme AFFI – Affiliate Marketing for WooCommerce affi-affiliate-marketing-for-woo allows Object Injection.This issue affects AFFI – Affiliate Marketing for WooCommerce: from n/a…Published Oct 10, 2026
- CVE-2026-108551Critical 9.3openapi-typescript-codegen through 0.31.0 Code Injection via Handlebars TemplatesPublished Oct 10, 2026
- CVE-2026-108549Critical 9.2cc-connect through 1.5.0 Missing Authentication via MAX Webhook Sender SpoofingPublished Oct 10, 2026
- CVE-2026-107373Critical 9.1ExtUtils::Typemaps::STL::String versions before 1.06 for Perl T_STD_STRING typemap may read the SV length before stringifying the argumentPublished Oct 10, 2026
- CVE-2026-103635Critical 9.1Apache DataSketches: datasketches-cpp: Out-of-bounds read in compact Theta sketch deserialization allows denial of service via a crafted sketchPublished Oct 10, 2026
- CVE-2026-103513Critical 9.8Apache DataSketches: datasketches-cpp: Out-of-bounds read and write in the CPC sketch deserialization allows memory corruption via a crafted sketchPublished Oct 10, 2026
- CVE-2026-103501Critical 9.8Apache DataSketches: datasketches-cpp: HLL CouponList Deserialization Buffer Overflow allows memory corruption via a crafted sketchPublished Oct 10, 2026
- CVE-2026-104803Critical 9.8WPCOM Member <= 1.7.27 - Unauthenticated Authentication Bypass via 'uuid' and 'code' Parameters on Social-Login CallbackPublished Oct 10, 2026
- CVE-2026-62045Critical 9.8WordPress Booklovers theme <= 2.13.0 - PHP Object Injection vulnerabilityPublished Oct 10, 2026
- CVE-2026-62046Critical 9.8WordPress Gutentype theme <= 2.1.12 - PHP Object Injection vulnerabilityPublished Oct 10, 2026
- CVE-2026-93945Critical 9.8WordPress Balance theme <= 1.12.0 - PHP Object Injection vulnerabilityPublished Oct 10, 2026
| CVE | Title | Severity | Published |
|---|---|---|---|
| CVE-2026-66569 | WordPress Kicker theme <= 2.2.1 - PHP Object Injection vulnerability | Critical 9.8 | |
| CVE-2026-66568 | WordPress Original theme <= 1.9.0 - PHP Object Injection vulnerability | Critical 9.8 | |
| CVE-2026-66567 | WordPress Anesta theme <= 1.5.3 - PHP Object Injection vulnerability | Critical 9.8 | |
| CVE-2026-66565 | WordPress FC United theme <= 1.1.1 - PHP Object Injection vulnerability | Critical 9.8 | |
| CVE-2026-66564 | WordPress ShiftCV theme <= 3.0.14 - PHP Object Injection vulnerability | Critical 9.8 | |
| CVE-2026-66563 | WordPress Windsor theme <= 2.10 - PHP Object Injection vulnerability | Critical 9.8 | |
| CVE-2026-66483 | WordPress Education Center theme <= 3.6.12 - PHP Object Injection vulnerability | Critical 9.8 | |
| CVE-2026-66482 | WordPress Drone Media theme <= 2.2.0 - PHP Object Injection vulnerability | Critical 9.8 | |
| CVE-2026-62129 | WordPress Creator LMS plugin <= 1.2.21 - Arbitrary File Upload vulnerability | Critical 9.9 | |
| CVE-2026-62125 | WordPress Asia Garden theme <= 1.3.1 - PHP Object Injection vulnerability | Critical 9.8 | |
| CVE-2026-62124 | WordPress N7 | Golf Club Sports & Events theme <= 2.21 - PHP Object Injection vulnerability | Critical 9.8 | |
| CVE-2026-62123 | WordPress Invetex theme <= 2.18 - PHP Object Injection vulnerability | Critical 9.8 | |
| CVE-2026-62120 | WordPress Law Office theme <= 3.20 - PHP Object Injection vulnerability | Critical 9.8 | |
| CVE-2026-62090 | WordPress WineShop theme <= 3.20 - PHP Object Injection vulnerability | Critical 9.8 | |
| CVE-2026-62087 | WordPress Equadio theme <= 1.1.4 - PHP Object Injection vulnerability | Critical 9.8 | |
| CVE-2026-62086 | WordPress Juno theme <= 2.25 - PHP Object Injection vulnerability | Critical 9.8 | |
| CVE-2026-62077 | WordPress Avala theme <= 1.1.4 - PHP Object Injection vulnerability | Critical 9.8 | |
| CVE-2026-62076 | WordPress Kalles theme <= 1.1.7.1 - PHP Object Injection vulnerability | Critical 9.8 | |
| CVE-2026-62054 | WordPress Yacht Rental theme <= 2.6 - PHP Object Injection vulnerability | Critical 9.8 | |
| CVE-2026-62053 | WordPress Wine House theme <= 3.20 - PHP Object Injection vulnerability | Critical 9.8 | |
| CVE-2026-62052 | WordPress Tipsy theme <= 1.6 - PHP Object Injection vulnerability | Critical 9.8 | |
| CVE-2026-62051 | WordPress Stargaze theme <= 1.10 - PHP Object Injection vulnerability | Critical 9.8 | |
| CVE-2026-62050 | WordPress Splendour theme <= 1.23 - PHP Object Injection vulnerability | Critical 9.8 | |
| CVE-2026-62032 | WordPress DirectoryPress plugin <= 3.6.27 - Local File Inclusion vulnerability | Critical 9.8 | |
| CVE-2026-62031 | WordPress uListing plugin <= 2.2.0 - SQL Injection vulnerability | Critical 9.3 | |
| CVE-2026-62025 | WordPress Tailored Tools plugin <= 3.0.3 - Arbitrary File Upload vulnerability | Critical 9.0 | |
| CVE-2026-62024 | WordPress CodeBard Help Desk plugin <= 1.1.2 - Arbitrary File Upload vulnerability | Critical 9.9 | |
| CVE-2026-62022 | WordPress Tonda Membership plugin <= 1.0.1 - Privilege Escalation vulnerability | Critical 9.8 | |
| CVE-2026-42723 | WordPress CleanSkin theme <= 1.5.0 - PHP Object Injection vulnerability | Critical 9.8 | |
| CVE-2026-42719 | WordPress Dynamic User Directory plugin <= 2.4 - PHP Object Injection vulnerability | Critical 9.8 | |
| CVE-2026-42718 | WordPress Booster for WooCommerce plugin <= 8.4.0 - PHP Object Injection vulnerability | Critical 9.8 | |
| CVE-2026-42716 | WordPress Payever - WooCommerce Gateway plugin <= 4.8.2 - PHP Object Injection vulnerability | Critical 9.8 | |
| CVE-2026-42696 | WordPress SiteVault – Backup, Restore, Migration & Cloning plugin <= 1.5.18 - Remote Code Execution (RCE) vulnerability | Critical 10.0 | |
| CVE-2026-40800 | WordPress ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin <= 1.5.3 - SQL Injection vulnerability | Critical 9.3 | |
| CVE-2026-39801 | WordPress AIWU plugin <= 1.5.9 - Privilege Escalation vulnerability | Critical 9.8 | |
| CVE-2026-108598 | Floci 1.1.0 before 2.2.0 RCE via API Gateway VTL Mapping Templates | Critical 9.3 | |
| CVE-2026-106610 | WordPress miniorange otp verification plugin <= 5.5.7 - Privilege Escalation vulnerability | Critical 9.8 | |
| CVE-2026-105892 | WordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.7.13 - Arbitrary File Deletion vulnerability | Critical 9.8 | |
| CVE-2026-105889 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tickera Tickera tickera-event-ticketing-system allows Blind SQL Injection.This issue affects Tickera: from n/a through 3.6.0.6. | Critical 9.3 | |
| CVE-2026-104398 | Deserialization of Untrusted Data vulnerability in VillaTheme AFFI – Affiliate Marketing for WooCommerce affi-affiliate-marketing-for-woo allows Object Injection.This issue affects AFFI – Affiliate Marketing for WooCommerce: from n/a… | Critical 9.8 | |
| CVE-2026-108551 | openapi-typescript-codegen through 0.31.0 Code Injection via Handlebars Templates | Critical 9.3 | |
| CVE-2026-108549 | cc-connect through 1.5.0 Missing Authentication via MAX Webhook Sender Spoofing | Critical 9.2 | |
| CVE-2026-107373 | ExtUtils::Typemaps::STL::String versions before 1.06 for Perl T_STD_STRING typemap may read the SV length before stringifying the argument | Critical 9.1 | |
| CVE-2026-103635 | Apache DataSketches: datasketches-cpp: Out-of-bounds read in compact Theta sketch deserialization allows denial of service via a crafted sketch | Critical 9.1 | |
| CVE-2026-103513 | Apache DataSketches: datasketches-cpp: Out-of-bounds read and write in the CPC sketch deserialization allows memory corruption via a crafted sketch | Critical 9.8 | |
| CVE-2026-103501 | Apache DataSketches: datasketches-cpp: HLL CouponList Deserialization Buffer Overflow allows memory corruption via a crafted sketch | Critical 9.8 | |
| CVE-2026-104803 | WPCOM Member <= 1.7.27 - Unauthenticated Authentication Bypass via 'uuid' and 'code' Parameters on Social-Login Callback | Critical 9.8 | |
| CVE-2026-62045 | WordPress Booklovers theme <= 2.13.0 - PHP Object Injection vulnerability | Critical 9.8 | |
| CVE-2026-62046 | WordPress Gutentype theme <= 2.1.12 - PHP Object Injection vulnerability | Critical 9.8 | |
| CVE-2026-93945 | WordPress Balance theme <= 1.12.0 - PHP Object Injection vulnerability | Critical 9.8 |
Showing 451–500 of 40,421. Narrow the filters to see the rest.
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status. Filter by severity and year here; the other filters work on the curated lists.