Vulnerability Intelligence · All CVEs
Every Published CVE, Searchable.
Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status.
Synced hourly · figures as of Oct 20, 2026
126,396 vulnerabilities · newest first
- CVE-2026-111105High 7.0Telegram rlottie Numeric Truncation Remote Code Execution VulnerabilityPublished Oct 15, 2026
- CVE-2026-103936High 7.5libp2p: Single pre-auth STUN packet terminates @libp2p/webrtc WebRTC-direct Node.js listenersPublished Oct 15, 2026
- CVE-2026-105065High 7.1WordPress XStore theme < 9.7.9 - Cross Site Scripting (XSS) vulnerabilityPublished Oct 15, 2026
- CVE-2026-100409High 7.5OpenNext Cloudflare: Cache interception can bypass middleware protection for encoded pathsPublished Oct 15, 2026
- CVE-2026-77466High 8.3Lychee: Webshop payment bypass via unrestricted "Dummy" gateway selectionPublished Oct 15, 2026
- CVE-2026-77470High 8.3Lychee: Webshop checkout lets the client override the payment amount sent to the gateway via malicious crafted POST requestPublished Oct 15, 2026
- CVE-2026-77467High 7.1Lychee: A single 383-byte PDF causes ~184 seconds of CPU consumption in the real processing pathPublished Oct 15, 2026
- CVE-2026-62679High 8.9Lychee: Path traversal in SecurePathController allows authenticated arbitrary file readPublished Oct 15, 2026
- CVE-2026-61838High 8.2Lychee: Album password bypass in ZIP downloadsPublished Oct 15, 2026
- CVE-2026-61611High 7.5Lychee: Missing rate limiting on album password unlock endpoint allows brute-force attacksPublished Oct 15, 2026
- CVE-2026-85634High 8.8Wildfly-core: wildfly-core: deployer rbac role privilege escalation via path traversal in deployment namePublished Oct 15, 2026
- CVE-2026-100353High 7.5kin-openapi: Incomplete Fix for GHSA-p6wj-qrr4-pgh5: Three Unpatched nil-Items Panic Paths in openapi3filterPublished Oct 15, 2026
- CVE-2026-100354High 7.5kin-openapi: Uncontrolled Recursion on Circular allOf/anyOf/oneOf Schemas Causes Fatal Process CrashPublished Oct 15, 2026
- CVE-2026-100352High 7.5kin-openapi: YAML NaN/Inf Values Bypass Built-in Guards and Panic via OAS 3.1 Validation PathPublished Oct 15, 2026
- CVE-2026-100351High 7.4kin-openapi: ValidationHandler security-requirement bypass via encoded-path operation confusionPublished Oct 15, 2026
- CVE-2026-100349High 8.2kin-openapi openapi3filter: nil-pointer panic in ValidateResponse on a response header declared with contentPublished Oct 15, 2026
- CVE-2026-92982High 8.5Ansible-operator-plugins: ansible operator plugins: arbitrary code execution via jinja2 template injectionPublished Oct 15, 2026
- CVE-2026-97712High 8.7Nexus Repository 3 - Privilege Escalation via Role ManagementPublished Oct 15, 2026
- CVE-2026-97665High 7.1Nexus Repository 3 - Missing Authorization on NuGet Symbol Package UploadPublished Oct 15, 2026
- CVE-2026-111093High 7.5In JetBrains Datalore before 2026.2.1 unauthenticated path traversal via the report blob endpoint allowed reading arbitrary filesPublished Oct 15, 2026
- CVE-2026-111091High 7.8In JetBrains Junie CLI before 26.8.3 code execution was possible via an untrusted project's MCP server configurationPublished Oct 15, 2026
- CVE-2026-97394High 7.5kin-openapi: Nil-pointer dereference panic in openapi3filter for OpenAPI 3.1 array schemas missing itemsPublished Oct 15, 2026
- CVE-2026-45452High 8.3Unitronics - CWE-134 Use of Externally-Controlled format stringPublished Oct 15, 2026
- CVE-2026-71490High 7.1OPNsense: Direct comma-separated user privileges bypass OPNsense MVC read-only write protectionPublished Oct 15, 2026
- CVE-2026-45451High 8.3Unitronics - CWE-287: Improper AuthenticationPublished Oct 15, 2026
- CVE-2026-63442High 8.1OPNsense: Log Forgery via Login Username CRLF in WebGUI Authentication → Pf Table IP BlockingPublished Oct 15, 2026
- CVE-2026-45450High 8.3Unitronics - CWE-119: Improper Restriction of Operations within the Bounds of a Memory BufferPublished Oct 15, 2026
- CVE-2026-58390High 8.0OPNsense: Stored XSS to root RCE via OpenVPN client common_name in status viewsPublished Oct 15, 2026
- CVE-2026-109449High 8.7Symfony: Unbounded Nesting in the Expression Parser Lets Untrusted Expressions Crash the ProcessPublished Oct 15, 2026
- CVE-2026-45449High 8.3Unitronics - CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')Published Oct 15, 2026
- CVE-2026-53582High 7.1OPNsense: XPATH Injection can disclose any secret in config.xmlPublished Oct 15, 2026
- CVE-2026-109413High 8.7Symfony: Unbounded Recursion in the YAML Inline Lexer Lets a Single Document Crash the ProcessPublished Oct 15, 2026
- CVE-2026-108082High 8.7Symfony: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request HeaderPublished Oct 15, 2026
- CVE-2026-53574High 7.6EspoCRM: Blind SQL injection via streamAttachments where-clause complex expressionPublished Oct 15, 2026
- CVE-2026-103509High 8.5Credential Disclosure in P4 Search Configuration APIPublished Oct 15, 2026
- CVE-2026-79840High 7.3HPE NonStop XABroker - Memory corruption vulnerabilityPublished Oct 15, 2026
- CVE-2026-79839High 7.3HPE NonStop ODBC/MX Server - Memory corruption vulnerabilityPublished Oct 15, 2026
- CVE-2026-79838High 7.3HPE NonStop ODBC/MX Services - Memory corruption vulnerabilityPublished Oct 15, 2026
- CVE-2026-108116High 7.5In Progress Kendo UI for jQuery prior to v2026.3.1015, specially crafted filter values in the PivotGrid XMLA transport could alter MDX predicates or inject XML markup into SOAP requests, potentially exposing data accessible through the…Published Oct 15, 2026
- CVE-2026-110746High 7.8A local privilege escalation vulnerability in TotalAV allows an unprivileged local user to forge the gRPC IPC authentication token, through loading IPC.dll and abuse the SYSTEM service's within TotalAV to execute arbitrary code as NT…Published Oct 15, 2026
- CVE-2026-103508High 7.3P4 Search (formerly Helix Search) allows an authenticated user holding administrative privileges on the connected P4 Server to supply a crafted logging configuration that causes files to be written or deleted outside the intended logging…Published Oct 15, 2026
- CVE-2026-9703High 7.1Grafana's data source proxy did not apply role-based access control to write requests forwarded to Loki data sources.Published Oct 15, 2026
- CVE-2026-110936High 8.4The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path.Published Oct 15, 2026
- CVE-2026-93649High 7.5In the Eclipse Adoptium website (adoptium.net), in every deployment built from commit 0b24ea1 (2025-06-18) up to the fix in commit cbb53cf (2026-09-24), the post-download page /[locale]/download takes a download URL from the "link" query…Published Oct 15, 2026
- CVE-2026-109685High 7.1WordPress Link Whisper Free plugin <= 0.9.7 - Cross Site Scripting (XSS) vulnerabilityPublished Oct 15, 2026
- CVE-2026-107416High 7.5WordPress Webba Booking plugin <= 6.5.2 - Insecure Direct Object References (IDOR) vulnerabilityPublished Oct 15, 2026
- CVE-2026-109702High 7.1WordPress Social Share Buttons plugin <= 1.31 - Cross Site Scripting (XSS) vulnerabilityPublished Oct 15, 2026
- CVE-2026-88794High 8.2XML External Entity injection in Sparx Enterprise ArchitectPublished Oct 15, 2026
- CVE-2026-110723High 7.5In api-gateway versions till 1.7.3, The default rate-limit key resolver, ClientIpKeyResolver, derives the per-client bucket key from the leftmost element of the X-Forwarded-For request header.Published Oct 15, 2026
- CVE-2026-110724High 7.5In api-gateway versions till 1.7.3, The default rate-limit key resolver, ClientIpKeyResolver, derives the per-client bucket key from the leftmost element of the X-Forwarded-For request header.Published Oct 15, 2026
| CVE | Title | Severity | Published |
|---|---|---|---|
| CVE-2026-111105 | Telegram rlottie Numeric Truncation Remote Code Execution Vulnerability | High 7.0 | |
| CVE-2026-103936 | libp2p: Single pre-auth STUN packet terminates @libp2p/webrtc WebRTC-direct Node.js listeners | High 7.5 | |
| CVE-2026-105065 | WordPress XStore theme < 9.7.9 - Cross Site Scripting (XSS) vulnerability | High 7.1 | |
| CVE-2026-100409 | OpenNext Cloudflare: Cache interception can bypass middleware protection for encoded paths | High 7.5 | |
| CVE-2026-77466 | Lychee: Webshop payment bypass via unrestricted "Dummy" gateway selection | High 8.3 | |
| CVE-2026-77470 | Lychee: Webshop checkout lets the client override the payment amount sent to the gateway via malicious crafted POST request | High 8.3 | |
| CVE-2026-77467 | Lychee: A single 383-byte PDF causes ~184 seconds of CPU consumption in the real processing path | High 7.1 | |
| CVE-2026-62679 | Lychee: Path traversal in SecurePathController allows authenticated arbitrary file read | High 8.9 | |
| CVE-2026-61838 | Lychee: Album password bypass in ZIP downloads | High 8.2 | |
| CVE-2026-61611 | Lychee: Missing rate limiting on album password unlock endpoint allows brute-force attacks | High 7.5 | |
| CVE-2026-85634 | Wildfly-core: wildfly-core: deployer rbac role privilege escalation via path traversal in deployment name | High 8.8 | |
| CVE-2026-100353 | kin-openapi: Incomplete Fix for GHSA-p6wj-qrr4-pgh5: Three Unpatched nil-Items Panic Paths in openapi3filter | High 7.5 | |
| CVE-2026-100354 | kin-openapi: Uncontrolled Recursion on Circular allOf/anyOf/oneOf Schemas Causes Fatal Process Crash | High 7.5 | |
| CVE-2026-100352 | kin-openapi: YAML NaN/Inf Values Bypass Built-in Guards and Panic via OAS 3.1 Validation Path | High 7.5 | |
| CVE-2026-100351 | kin-openapi: ValidationHandler security-requirement bypass via encoded-path operation confusion | High 7.4 | |
| CVE-2026-100349 | kin-openapi openapi3filter: nil-pointer panic in ValidateResponse on a response header declared with content | High 8.2 | |
| CVE-2026-92982 | Ansible-operator-plugins: ansible operator plugins: arbitrary code execution via jinja2 template injection | High 8.5 | |
| CVE-2026-97712 | Nexus Repository 3 - Privilege Escalation via Role Management | High 8.7 | |
| CVE-2026-97665 | Nexus Repository 3 - Missing Authorization on NuGet Symbol Package Upload | High 7.1 | |
| CVE-2026-111093 | In JetBrains Datalore before 2026.2.1 unauthenticated path traversal via the report blob endpoint allowed reading arbitrary files | High 7.5 | |
| CVE-2026-111091 | In JetBrains Junie CLI before 26.8.3 code execution was possible via an untrusted project's MCP server configuration | High 7.8 | |
| CVE-2026-97394 | kin-openapi: Nil-pointer dereference panic in openapi3filter for OpenAPI 3.1 array schemas missing items | High 7.5 | |
| CVE-2026-45452 | Unitronics - CWE-134 Use of Externally-Controlled format string | High 8.3 | |
| CVE-2026-71490 | OPNsense: Direct comma-separated user privileges bypass OPNsense MVC read-only write protection | High 7.1 | |
| CVE-2026-45451 | Unitronics - CWE-287: Improper Authentication | High 8.3 | |
| CVE-2026-63442 | OPNsense: Log Forgery via Login Username CRLF in WebGUI Authentication → Pf Table IP Blocking | High 8.1 | |
| CVE-2026-45450 | Unitronics - CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer | High 8.3 | |
| CVE-2026-58390 | OPNsense: Stored XSS to root RCE via OpenVPN client common_name in status views | High 8.0 | |
| CVE-2026-109449 | Symfony: Unbounded Nesting in the Expression Parser Lets Untrusted Expressions Crash the Process | High 8.7 | |
| CVE-2026-45449 | Unitronics - CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | High 8.3 | |
| CVE-2026-53582 | OPNsense: XPATH Injection can disclose any secret in config.xml | High 7.1 | |
| CVE-2026-109413 | Symfony: Unbounded Recursion in the YAML Inline Lexer Lets a Single Document Crash the Process | High 8.7 | |
| CVE-2026-108082 | Symfony: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header | High 8.7 | |
| CVE-2026-53574 | EspoCRM: Blind SQL injection via streamAttachments where-clause complex expression | High 7.6 | |
| CVE-2026-103509 | Credential Disclosure in P4 Search Configuration API | High 8.5 | |
| CVE-2026-79840 | HPE NonStop XABroker - Memory corruption vulnerability | High 7.3 | |
| CVE-2026-79839 | HPE NonStop ODBC/MX Server - Memory corruption vulnerability | High 7.3 | |
| CVE-2026-79838 | HPE NonStop ODBC/MX Services - Memory corruption vulnerability | High 7.3 | |
| CVE-2026-108116 | In Progress Kendo UI for jQuery prior to v2026.3.1015, specially crafted filter values in the PivotGrid XMLA transport could alter MDX predicates or inject XML markup into SOAP requests, potentially exposing data accessible through the… | High 7.5 | |
| CVE-2026-110746 | A local privilege escalation vulnerability in TotalAV allows an unprivileged local user to forge the gRPC IPC authentication token, through loading IPC.dll and abuse the SYSTEM service's within TotalAV to execute arbitrary code as NT… | High 7.8 | |
| CVE-2026-103508 | P4 Search (formerly Helix Search) allows an authenticated user holding administrative privileges on the connected P4 Server to supply a crafted logging configuration that causes files to be written or deleted outside the intended logging… | High 7.3 | |
| CVE-2026-9703 | Grafana's data source proxy did not apply role-based access control to write requests forwarded to Loki data sources. | High 7.1 | |
| CVE-2026-110936 | The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. | High 8.4 | |
| CVE-2026-93649 | In the Eclipse Adoptium website (adoptium.net), in every deployment built from commit 0b24ea1 (2025-06-18) up to the fix in commit cbb53cf (2026-09-24), the post-download page /[locale]/download takes a download URL from the "link" query… | High 7.5 | |
| CVE-2026-109685 | WordPress Link Whisper Free plugin <= 0.9.7 - Cross Site Scripting (XSS) vulnerability | High 7.1 | |
| CVE-2026-107416 | WordPress Webba Booking plugin <= 6.5.2 - Insecure Direct Object References (IDOR) vulnerability | High 7.5 | |
| CVE-2026-109702 | WordPress Social Share Buttons plugin <= 1.31 - Cross Site Scripting (XSS) vulnerability | High 7.1 | |
| CVE-2026-88794 | XML External Entity injection in Sparx Enterprise Architect | High 8.2 | |
| CVE-2026-110723 | In api-gateway versions till 1.7.3, The default rate-limit key resolver, ClientIpKeyResolver, derives the per-client bucket key from the leftmost element of the X-Forwarded-For request header. | High 7.5 | |
| CVE-2026-110724 | In api-gateway versions till 1.7.3, The default rate-limit key resolver, ClientIpKeyResolver, derives the per-client bucket key from the leftmost element of the X-Forwarded-For request header. | High 7.5 |
Showing 451–500 of 126,396. Narrow the filters to see the rest.
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status. Filter by severity and year here; the other filters work on the curated lists.