Vulnerability Intelligence · All CVEs
Every Published CVE, Searchable.
Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status.
Synced hourly · figures as of Oct 20, 2026
11,306 vulnerabilities · newest first
- CVE-2026-93894Low 2.3In Vinyl Cache before 9.0,2, workspace buffer overflow vulnerability was found in the .upper() and .lower() string type methods of VCL.Published Sep 18, 2026
- CVE-2026-11545Low 3.7IBM WebSphere Application Server is affected by a privilege escalationPublished Sep 18, 2026
- CVE-2026-81181Low 3.7SysReptor: Session Fixation in Password-Protected Shared NotesPublished Sep 18, 2026
- CVE-2026-81178Low 3.5SysReptor: Anonymous note-share link discloses project member identities and non-shared note activityPublished Sep 18, 2026
- CVE-2026-91142Low 3.6An integer overflow vulnerability in the do_lastlog() function, specifically in the offset calculation for lastlog entries on ILP32 (Integer, Long, Pointer 32-bit) builds, can be exploited.Published Sep 18, 2026
- CVE-2026-85478Low 2.4A CM2507 IP camera running firmware version HMT.CM2507 v251211.1507 exposes an interactive bootloader through a physical debug interface without requiring authentication.Published Sep 18, 2026
- CVE-2026-61633Low 2.0Prior to 0.24.14, the NanoMQ client function nni_mqtt_msg_decode_unsubscribe() in nng/src/supplemental/mqtt/mqtt_codec.c does not handle a failed read_uint16() while counting topics in a malformed UNSUBSCRIBE…Published Sep 18, 2026
- CVE-2026-44639Low 3.7Prior to 0.24.14, NanoMQ's MQTT v5 property decoder in nng/src/supplemental/mqtt/mqtt_codec.c uses property_append() to walk the entire linked list for each property added by decode_buf_properties().Published Sep 18, 2026
- CVE-2026-84449Low 3.7Prior to 1.19.6, Op_RGB24_32_to_YCbCr::convert_colorspace() stores image-plane strides in an integer width that can overflow for extremely large RGB images created through…Published Sep 18, 2026
- CVE-2026-84400Low 2.3CareCam CM2507 IP cameras contain an insufficiently protected network maintenance mechanism that can activate a remote debugging service.Published Sep 18, 2026
- CVE-2026-16512Low 3.1Out-of-bounds read in the Zephyr gPTP receive path when handling short Ethernet framesPublished Sep 18, 2026
- CVE-2026-93676Low 3.2Xdg-dbus-proxy: xdg-dbus-proxy: filtering for broadcast messages bypasses path/interface/member checksPublished Sep 18, 2026
- CVE-2026-93601Low 2.1rustls webpki 0.101.0 before 0.103.12 Name Constraint BypassPublished Sep 18, 2026
- CVE-2026-93600Low 2.1rustls webpki Name Constraints URI Validation BypassPublished Sep 18, 2026
- CVE-2026-93588Low 2.3ImageMagick before 7.1.2-31 Null Pointer Dereference via PNMPublished Sep 18, 2026
- CVE-2026-93586Low 2.1ImageMagick before 7.1.2-31 Use After Free via ImagesToBlobPublished Sep 18, 2026
- CVE-2026-40538Low 3.7An improper restriction of excessive authentication attempts vulnerability in Auto block in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote attackers to read limited files via…Published Sep 18, 2026
- CVE-2026-13683Low 2.7An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in EventScheduler API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows…Published Sep 18, 2026
- CVE-2026-13666Low 3.5An improper neutralization of CRLF sequences ('CRLF Injection') vulnerability in Sharing API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users to…Published Sep 18, 2026
- CVE-2026-89008Low 2.7Bookit < 2.6.0.5 - Bookit Staff+ Appointment PII DisclosurePublished Sep 18, 2026
- CVE-2026-89007Low 2.7Bookit < 2.6.0.5 - Bookit Staff+ Arbitrary Appointment Deletion via Missing AuthorizationPublished Sep 18, 2026
- CVE-2026-88844Low 2.7MasterStudy LMS 3.6.2 - < 3.7.50 - Instructor+ Student PII Disclosure via IDORPublished Sep 18, 2026
- CVE-2026-84904Low 3.8King Addons for Elementor 51.1.56 - 51.1.80 - Author+ Missing Authorization via Image OptimizerPublished Sep 18, 2026
- CVE-2026-84903Low 2.7King Addons for Elementor < 51.1.81 - Contributor+ Private Post Content Disclosure via kng_maintenance_page ShortcodePublished Sep 18, 2026
- CVE-2026-81340Low 3.8MasterStudy LMS < 3.7.50 - Instructor+ Order Status Manipulation via IDORPublished Sep 18, 2026
- CVE-2026-68493Low 3.1After guessing a 62^15 complex unique identifier, a malicious logged in user was able to retrieve a list of memberships for a circle they are not a member of.Published Sep 18, 2026
- CVE-2026-93384Low 3.7Server-side request forgery in Omnibox in Google Chrome on on Android prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to bypass system access restrictions via crafted network traffic.Published Sep 17, 2026
- CVE-2026-93380Low 3.1Race condition in FileSystem in Google Chrome prior to 153.0.8010.52 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass system access restrictions via a crafted HTML page.Published Sep 17, 2026
- CVE-2026-93378Low 3.1Missing authorization in Storage in Google Chrome prior to 153.0.8010.52 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted PDF file.Published Sep 17, 2026
- CVE-2026-54649Low 2.1Prior to 1.5.0, handleInbound delivers inbound alias mail with message.forward(), which silently drops the added…Published Sep 17, 2026
- CVE-2026-85716Low 3.7The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses.Published Sep 17, 2026
- CVE-2026-54579Low 2.3Prior to 2.7.8, ping() in libmport/ping.c accepted ICMP replies without validating icmp_id or icmp_seq and parsed the reply using a fixed IP-header offset instead of ip_hl.Published Sep 17, 2026
- CVE-2026-54578Low 2.0Prior to 2.7.8, mport_verify_package() in libmport/verify.c could continue after MD5File() or SHA256_File() failed and compare an expected checksum with stale data in the hash buffer rather than a…Published Sep 17, 2026
- CVE-2026-54577Low 2.0Prior to 2.7.8, the audit command in mport/mport.c computed option-adjusted local_argv and local_argc values but passed the original argument entry to audit_package().Published Sep 17, 2026
- CVE-2026-75588Low 2.6Mattermost Desktop App versions <=6.2 6.2.2.0 fail to validate the URL scheme when checking whether a target URL is internal to the connected server, which allows a network-positioned attacker to load a plugin popout window over an…Published Sep 17, 2026
- CVE-2026-61700Low 3.7MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases.Published Sep 17, 2026
- CVE-2026-12284Low 3.8Mattermost Desktop App versions <=6.2 6.2.2.0 fails to validate the IPC sender in the leaveCall handler which allows a malicious or compromised Mattermost server (or a user with script access to a connected server view) to disconnect an…Published Sep 17, 2026
- CVE-2026-92962Low 2.1vm2 before 3.11.4 Defense Invariant Violation via setup-sandbox.jsPublished Sep 17, 2026
- CVE-2026-92945Low 2.3vm2 before 3.11.7 Module Allowlist Bypass via Prefix MatchingPublished Sep 17, 2026
- CVE-2026-81637Low 2.3Replayable OAuth2 CSRF state retained after a failed callback in AshAuthenticationPublished Sep 17, 2026
- CVE-2026-82759Low 1.8Reversible IP address pseudonymisation in AshAuthentication audit log hash modePublished Sep 17, 2026
- CVE-2026-82723Low 1.8Actor record with password digest stored in AshAuthentication audit log entriesPublished Sep 17, 2026
- CVE-2026-78426Low 2.0Logout bypass via alternate JWT spellingPublished Sep 17, 2026
- CVE-2026-75553Low 2.4Smartphone application Tohoku Electric Power "Yorisou e Net" vulnerable to use of hard-coded cryptographic keyPublished Sep 17, 2026
- CVE-2026-50607Low 2.7A WebSocket service was configured to listen on all network interfaces, which may expose the service to unintended…Published Sep 17, 2026
- CVE-2026-50606Low 1.2The vulnerability is caused by the use of a hard-coded AES encryption key within the software.Published Sep 17, 2026
- CVE-2026-50608Low 1.2Authentication Vulnerability in NitroSense and PredatorSense SoftwarePublished Sep 17, 2026
- CVE-2026-91017Low 3.7Robokassa payment gateway for Woocommerce < 1.8.9 - Unauthenticated Payment Bypass via Forged JWT CallbackPublished Sep 17, 2026
- CVE-2026-91008Low 3.7Event Booking Manager for WooCommerce < 5.3.8 - Unauthenticated Attendee PII Disclosure via Booking Confirmation PanelPublished Sep 17, 2026
- CVE-2026-87836Low 2.7Comments Import & Export 2.1.11 - 2.5.3 - Author+ Comment PII Disclosure via ExportPublished Sep 17, 2026
| CVE | Title | Severity | Published |
|---|---|---|---|
| CVE-2026-93894 | In Vinyl Cache before 9.0,2, workspace buffer overflow vulnerability was found in the .upper() and .lower() string type methods of VCL. | Low 2.3 | |
| CVE-2026-11545 | IBM WebSphere Application Server is affected by a privilege escalation | Low 3.7 | |
| CVE-2026-81181 | SysReptor: Session Fixation in Password-Protected Shared Notes | Low 3.7 | |
| CVE-2026-81178 | SysReptor: Anonymous note-share link discloses project member identities and non-shared note activity | Low 3.5 | |
| CVE-2026-91142 | An integer overflow vulnerability in the do_lastlog() function, specifically in the offset calculation for lastlog entries on ILP32 (Integer, Long, Pointer 32-bit) builds, can be exploited. | Low 3.6 | |
| CVE-2026-85478 | A CM2507 IP camera running firmware version HMT.CM2507 v251211.1507 exposes an interactive bootloader through a physical debug interface without requiring authentication. | Low 2.4 | |
| CVE-2026-61633 | Prior to 0.24.14, the NanoMQ client function nni_mqtt_msg_decode_unsubscribe() in nng/src/supplemental/mqtt/mqtt_codec.c does not handle a failed read_uint16() while counting topics in a malformed UNSUBSCRIBE… | Low 2.0 | |
| CVE-2026-44639 | Prior to 0.24.14, NanoMQ's MQTT v5 property decoder in nng/src/supplemental/mqtt/mqtt_codec.c uses property_append() to walk the entire linked list for each property added by decode_buf_properties(). | Low 3.7 | |
| CVE-2026-84449 | Prior to 1.19.6, Op_RGB24_32_to_YCbCr::convert_colorspace() stores image-plane strides in an integer width that can overflow for extremely large RGB images created through… | Low 3.7 | |
| CVE-2026-84400 | CareCam CM2507 IP cameras contain an insufficiently protected network maintenance mechanism that can activate a remote debugging service. | Low 2.3 | |
| CVE-2026-16512 | Out-of-bounds read in the Zephyr gPTP receive path when handling short Ethernet frames | Low 3.1 | |
| CVE-2026-93676 | Xdg-dbus-proxy: xdg-dbus-proxy: filtering for broadcast messages bypasses path/interface/member checks | Low 3.2 | |
| CVE-2026-93601 | rustls webpki 0.101.0 before 0.103.12 Name Constraint Bypass | Low 2.1 | |
| CVE-2026-93600 | rustls webpki Name Constraints URI Validation Bypass | Low 2.1 | |
| CVE-2026-93588 | ImageMagick before 7.1.2-31 Null Pointer Dereference via PNM | Low 2.3 | |
| CVE-2026-93586 | ImageMagick before 7.1.2-31 Use After Free via ImagesToBlob | Low 2.1 | |
| CVE-2026-40538 | An improper restriction of excessive authentication attempts vulnerability in Auto block in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote attackers to read limited files via… | Low 3.7 | |
| CVE-2026-13683 | An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in EventScheduler API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows… | Low 2.7 | |
| CVE-2026-13666 | An improper neutralization of CRLF sequences ('CRLF Injection') vulnerability in Sharing API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users to… | Low 3.5 | |
| CVE-2026-89008 | Bookit < 2.6.0.5 - Bookit Staff+ Appointment PII Disclosure | Low 2.7 | |
| CVE-2026-89007 | Bookit < 2.6.0.5 - Bookit Staff+ Arbitrary Appointment Deletion via Missing Authorization | Low 2.7 | |
| CVE-2026-88844 | MasterStudy LMS 3.6.2 - < 3.7.50 - Instructor+ Student PII Disclosure via IDOR | Low 2.7 | |
| CVE-2026-84904 | King Addons for Elementor 51.1.56 - 51.1.80 - Author+ Missing Authorization via Image Optimizer | Low 3.8 | |
| CVE-2026-84903 | King Addons for Elementor < 51.1.81 - Contributor+ Private Post Content Disclosure via kng_maintenance_page Shortcode | Low 2.7 | |
| CVE-2026-81340 | MasterStudy LMS < 3.7.50 - Instructor+ Order Status Manipulation via IDOR | Low 3.8 | |
| CVE-2026-68493 | After guessing a 62^15 complex unique identifier, a malicious logged in user was able to retrieve a list of memberships for a circle they are not a member of. | Low 3.1 | |
| CVE-2026-93384 | Server-side request forgery in Omnibox in Google Chrome on on Android prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to bypass system access restrictions via crafted network traffic. | Low 3.7 | |
| CVE-2026-93380 | Race condition in FileSystem in Google Chrome prior to 153.0.8010.52 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass system access restrictions via a crafted HTML page. | Low 3.1 | |
| CVE-2026-93378 | Missing authorization in Storage in Google Chrome prior to 153.0.8010.52 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted PDF file. | Low 3.1 | |
| CVE-2026-54649 | Prior to 1.5.0, handleInbound delivers inbound alias mail with message.forward(), which silently drops the added… | Low 2.1 | |
| CVE-2026-85716 | The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. | Low 3.7 | |
| CVE-2026-54579 | Prior to 2.7.8, ping() in libmport/ping.c accepted ICMP replies without validating icmp_id or icmp_seq and parsed the reply using a fixed IP-header offset instead of ip_hl. | Low 2.3 | |
| CVE-2026-54578 | Prior to 2.7.8, mport_verify_package() in libmport/verify.c could continue after MD5File() or SHA256_File() failed and compare an expected checksum with stale data in the hash buffer rather than a… | Low 2.0 | |
| CVE-2026-54577 | Prior to 2.7.8, the audit command in mport/mport.c computed option-adjusted local_argv and local_argc values but passed the original argument entry to audit_package(). | Low 2.0 | |
| CVE-2026-75588 | Mattermost Desktop App versions <=6.2 6.2.2.0 fail to validate the URL scheme when checking whether a target URL is internal to the connected server, which allows a network-positioned attacker to load a plugin popout window over an… | Low 2.6 | |
| CVE-2026-61700 | MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. | Low 3.7 | |
| CVE-2026-12284 | Mattermost Desktop App versions <=6.2 6.2.2.0 fails to validate the IPC sender in the leaveCall handler which allows a malicious or compromised Mattermost server (or a user with script access to a connected server view) to disconnect an… | Low 3.8 | |
| CVE-2026-92962 | vm2 before 3.11.4 Defense Invariant Violation via setup-sandbox.js | Low 2.1 | |
| CVE-2026-92945 | vm2 before 3.11.7 Module Allowlist Bypass via Prefix Matching | Low 2.3 | |
| CVE-2026-81637 | Replayable OAuth2 CSRF state retained after a failed callback in AshAuthentication | Low 2.3 | |
| CVE-2026-82759 | Reversible IP address pseudonymisation in AshAuthentication audit log hash mode | Low 1.8 | |
| CVE-2026-82723 | Actor record with password digest stored in AshAuthentication audit log entries | Low 1.8 | |
| CVE-2026-78426 | Logout bypass via alternate JWT spelling | Low 2.0 | |
| CVE-2026-75553 | Smartphone application Tohoku Electric Power "Yorisou e Net" vulnerable to use of hard-coded cryptographic key | Low 2.4 | |
| CVE-2026-50607 | A WebSocket service was configured to listen on all network interfaces, which may expose the service to unintended… | Low 2.7 | |
| CVE-2026-50606 | The vulnerability is caused by the use of a hard-coded AES encryption key within the software. | Low 1.2 | |
| CVE-2026-50608 | Authentication Vulnerability in NitroSense and PredatorSense Software | Low 1.2 | |
| CVE-2026-91017 | Robokassa payment gateway for Woocommerce < 1.8.9 - Unauthenticated Payment Bypass via Forged JWT Callback | Low 3.7 | |
| CVE-2026-91008 | Event Booking Manager for WooCommerce < 5.3.8 - Unauthenticated Attendee PII Disclosure via Booking Confirmation Panel | Low 3.7 | |
| CVE-2026-87836 | Comments Import & Export 2.1.11 - 2.5.3 - Author+ Comment PII Disclosure via Export | Low 2.7 |
Showing 451–500 of 11,306. Narrow the filters to see the rest.
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status. Filter by severity and year here; the other filters work on the curated lists.