Vulnerability Intelligence · All CVEs
Every Published CVE, Searchable.
Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status.
Synced hourly · figures as of Oct 19, 2026
138,422 vulnerabilities · newest first
- CVE-2026-96870Medium 6.4SureDash <= 1.12.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' ParameterPublished Oct 16, 2026
- CVE-2026-100108Medium 6.4Social Share Buttons <= 1.30 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'share_url' Network SettingPublished Oct 16, 2026
- CVE-2026-100106Medium 6.4FiboSearch <= 1.34.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'purchased_plan' ParameterPublished Oct 16, 2026
- CVE-2026-18799Medium 4.3Mattermost Server fails to restrict Slack import account binding, allowing team admins to forge posts as existing usersPublished Oct 16, 2026
- CVE-2026-16251Medium 6.5Mattermost local image proxy allows server memory exhaustion via unbounded image response bufferingPublished Oct 16, 2026
- CVE-2026-18256Medium 4.3Private team metadata disclosure via the team search APIPublished Oct 16, 2026
- CVE-2026-18223Medium 5.0Mattermost invitation tokens not bound to invited email address allowing unauthorized team and private channel accessPublished Oct 16, 2026
- CVE-2026-19076Medium 4.4Mattermost fails to reject OAuth application sessions in account type switch, allowing account takeover via bearer tokenPublished Oct 16, 2026
- CVE-2026-18560Medium 4.3Improper order of authorisations in Mattermost GetFile API leads to an authenticated user to determine a post’s quarantined statusPublished Oct 16, 2026
- CVE-2026-19600Medium 4.5Mattermost logs plaintext authentication tokens in debug-level server logs on failed auth attemptsPublished Oct 16, 2026
- CVE-2026-19621Medium 6.5Mattermost leaks interactive-message integration secrets to non-admin users via post-deletion events and thread readsPublished Oct 16, 2026
- CVE-2026-19603Medium 4.3Private channel ID disclosure via user status endpointsPublished Oct 16, 2026
- CVE-2026-18795Medium 6.4Missing server side validation allowed user to quarantine a DM and GM postPublished Oct 16, 2026
- CVE-2026-19867Medium 4.3Uncapped mention keys in user notification properties allow CPU exhaustion during post processingPublished Oct 16, 2026
- CVE-2026-19601Medium 4.9Disclosure of AD/LDAP bind password via Test ConnectionPublished Oct 16, 2026
- CVE-2026-18551Medium 6.5Mattermost guest account privilege escalation via member roles APIPublished Oct 16, 2026
- CVE-2026-19541Medium 6.5Outgoing OAuth connection client secret exposure during connection validationPublished Oct 16, 2026
- CVE-2026-110366Medium 5.3WordPress Site Reviews plugin <= 8.3.4 - Broken Access Control vulnerabilityPublished Oct 16, 2026
- CVE-2026-15222Medium 5.4User Registration & Membership <= 5.2.8 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via display_namePublished Oct 16, 2026
- CVE-2026-110252Medium 5.4WPeMatico RSS Feed Fetcher <= 2.9 - Unauthenticated Stored Cross-Site Scripting via RSS Feed Content ImportPublished Oct 16, 2026
- CVE-2026-19798Medium 4.3WP Map Block <= 3.0.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Map Publish/Unpublish/Delete via set_status() and bulk() REST EndpointsPublished Oct 16, 2026
- CVE-2026-109382Medium 6.5WSP MCP <= 2.9.5 - Authenticated (Subscriber+) Sensitive Information Disclosure via Broken Access Control to 'wsp_get_posts' MCP ToolPublished Oct 16, 2026
- CVE-2026-104755Medium 4.8WP Compress <= 7.25.00 - Unauthenticated Privilege Escalation to 'group'/'setting'/'value' Parameters on comms EndpointPublished Oct 16, 2026
- CVE-2026-109388Medium 6.4HivePress <= 1.7.32 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'message' Attribute of the hivepress_user_login_form ShortcodePublished Oct 16, 2026
- CVE-2026-110290Medium 6.4WebberZone Top 10 <= 4.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'other_attributes' Block AttributePublished Oct 16, 2026
- CVE-2026-111069Medium 6.4GeoDirectory <= 2.8.192 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'twitterusername' Custom FieldPublished Oct 16, 2026
- CVE-2026-107770Medium 6.8Photo Engine (Media Organizer & Lightroom) <= 6.5.6 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion and Upload via /?wplr-sync-api 'delete' / 'sync' actionPublished Oct 16, 2026
- CVE-2026-110664Medium 6.4Premium Packages <= 7.2.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Order NotesPublished Oct 16, 2026
- CVE-2026-111178Medium 4.9WP Booking System <= 2.1.0.1 - Authenticated (Administrator+) SQL Injection via 'orderby' ParameterPublished Oct 16, 2026
- CVE-2026-107646Medium 5.3HUSKY <= 1.4.5 - Unauthenticated Sensitive Information Exposure in 'woof_tm_data' Localized ScriptPublished Oct 16, 2026
- CVE-2026-110179Medium 6.8affiliate-toolkit < 3.8.9 - Editor+ SQL Injection via orderby ParameterPublished Oct 16, 2026
- CVE-2026-110014Medium 5.3Salon Booking System < 10.31.9 - Unauthenticated Booking Creation with Arbitrary Customer ID and StatusPublished Oct 16, 2026
- CVE-2026-110013Medium 4.8Salon Booking System < 10.31.9 - Unauthenticated Salon REST API Access via Predictable Access-TokenPublished Oct 16, 2026
- CVE-2026-110012Medium 4.3Salon Booking System < 10.31.3 - Subscriber+ Booking PII Disclosure via REST bookings/upcomingPublished Oct 16, 2026
- CVE-2026-109982Medium 4.2MB Custom Post Types & Custom Taxonomies < 2.12.2 - Subscriber+ Missing Authorization via CPT UI MigrationPublished Oct 16, 2026
- CVE-2026-105974Medium 4.3Visual Form Builder <= 3.1 - Subscriber+ Sensitive Data Disclosure via Dashboard WidgetPublished Oct 16, 2026
- CVE-2026-105973Medium 4.3Visual Form Builder <= 3.1 - Subscriber+ Arbitrary Form Field Reordering via Missing AuthorizationPublished Oct 16, 2026
- CVE-2026-103696Medium 6.8Mobile Builder <= 1.4.2 - Unauthenticated SQLi via 'delivery_id' ParameterPublished Oct 16, 2026
- CVE-2026-74923Medium 5.3Document Gallery <= 5.1.1 - Unauthenticated Non-Public Attachment Disclosure via dg_generate_gallery and dg_generate_iconsPublished Oct 16, 2026
- CVE-2026-92427Medium 5.3Coinsnap Bitcoin Crowdfunding <= 1.2.0 - Unauthenticated Payment Record Forgery via Webhook Secret DisclosurePublished Oct 16, 2026
- CVE-2026-91830Medium 6.5Subscribe to Comments < 2.3.3 - Unauthenticated Subscription Management Key Disclosure via Forged Comment CookiePublished Oct 16, 2026
- CVE-2026-91833Medium 6.8WX Subscribe <= 1.2.1 - Unauthenticated SQLi via 'attach' ParameterPublished Oct 16, 2026
- CVE-2026-88963Medium 6.1Tutor LMS <= 4.0.8 - Authenticated (Subscriber+) Reflected DOM-Based Cross-Site Scripting via 'redirect_url' ParameterPublished Oct 16, 2026
- CVE-2026-109414Medium 6.5Vitepos <= 3.6.1 - Authenticated (Vendor+) SQL Injection via 'src_by[].val' Parameter via 'bt' OperatorPublished Oct 16, 2026
- CVE-2026-104001Medium 5.4Slim SEO <= 4.11.1 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'Biographical Info' User MetaPublished Oct 16, 2026
- CVE-2026-12272Medium 5.3Lightweight Cookie Notice <= 1.19 - Sensitive Information Exposure via W3TC_DYNAMIC_SECURITY ConstantPublished Oct 16, 2026
- CVE-2026-93767Medium 6.5Tainacan <= 1.3.0 - Authenticated (Subscriber+) Path Traversal to Arbitrary File Read via 'guid' ParameterPublished Oct 16, 2026
- CVE-2026-103480Medium 6.4Tourfic <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'type' Shortcode AttributePublished Oct 16, 2026
- CVE-2026-107748Medium 6.4User Profile Builder <= 4.0.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' ParameterPublished Oct 16, 2026
- CVE-2026-110017Medium 6.4Quick PayPal Payments: Payment Button & Form <= 6.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'form' Shortcode AttributePublished Oct 16, 2026
| CVE | Title | Severity | Published |
|---|---|---|---|
| CVE-2026-96870 | SureDash <= 1.12.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' Parameter | Medium 6.4 | |
| CVE-2026-100108 | Social Share Buttons <= 1.30 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'share_url' Network Setting | Medium 6.4 | |
| CVE-2026-100106 | FiboSearch <= 1.34.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'purchased_plan' Parameter | Medium 6.4 | |
| CVE-2026-18799 | Mattermost Server fails to restrict Slack import account binding, allowing team admins to forge posts as existing users | Medium 4.3 | |
| CVE-2026-16251 | Mattermost local image proxy allows server memory exhaustion via unbounded image response buffering | Medium 6.5 | |
| CVE-2026-18256 | Private team metadata disclosure via the team search API | Medium 4.3 | |
| CVE-2026-18223 | Mattermost invitation tokens not bound to invited email address allowing unauthorized team and private channel access | Medium 5.0 | |
| CVE-2026-19076 | Mattermost fails to reject OAuth application sessions in account type switch, allowing account takeover via bearer token | Medium 4.4 | |
| CVE-2026-18560 | Improper order of authorisations in Mattermost GetFile API leads to an authenticated user to determine a post’s quarantined status | Medium 4.3 | |
| CVE-2026-19600 | Mattermost logs plaintext authentication tokens in debug-level server logs on failed auth attempts | Medium 4.5 | |
| CVE-2026-19621 | Mattermost leaks interactive-message integration secrets to non-admin users via post-deletion events and thread reads | Medium 6.5 | |
| CVE-2026-19603 | Private channel ID disclosure via user status endpoints | Medium 4.3 | |
| CVE-2026-18795 | Missing server side validation allowed user to quarantine a DM and GM post | Medium 6.4 | |
| CVE-2026-19867 | Uncapped mention keys in user notification properties allow CPU exhaustion during post processing | Medium 4.3 | |
| CVE-2026-19601 | Disclosure of AD/LDAP bind password via Test Connection | Medium 4.9 | |
| CVE-2026-18551 | Mattermost guest account privilege escalation via member roles API | Medium 6.5 | |
| CVE-2026-19541 | Outgoing OAuth connection client secret exposure during connection validation | Medium 6.5 | |
| CVE-2026-110366 | WordPress Site Reviews plugin <= 8.3.4 - Broken Access Control vulnerability | Medium 5.3 | |
| CVE-2026-15222 | User Registration & Membership <= 5.2.8 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via display_name | Medium 5.4 | |
| CVE-2026-110252 | WPeMatico RSS Feed Fetcher <= 2.9 - Unauthenticated Stored Cross-Site Scripting via RSS Feed Content Import | Medium 5.4 | |
| CVE-2026-19798 | WP Map Block <= 3.0.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Map Publish/Unpublish/Delete via set_status() and bulk() REST Endpoints | Medium 4.3 | |
| CVE-2026-109382 | WSP MCP <= 2.9.5 - Authenticated (Subscriber+) Sensitive Information Disclosure via Broken Access Control to 'wsp_get_posts' MCP Tool | Medium 6.5 | |
| CVE-2026-104755 | WP Compress <= 7.25.00 - Unauthenticated Privilege Escalation to 'group'/'setting'/'value' Parameters on comms Endpoint | Medium 4.8 | |
| CVE-2026-109388 | HivePress <= 1.7.32 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'message' Attribute of the hivepress_user_login_form Shortcode | Medium 6.4 | |
| CVE-2026-110290 | WebberZone Top 10 <= 4.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'other_attributes' Block Attribute | Medium 6.4 | |
| CVE-2026-111069 | GeoDirectory <= 2.8.192 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'twitterusername' Custom Field | Medium 6.4 | |
| CVE-2026-107770 | Photo Engine (Media Organizer & Lightroom) <= 6.5.6 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion and Upload via /?wplr-sync-api 'delete' / 'sync' action | Medium 6.8 | |
| CVE-2026-110664 | Premium Packages <= 7.2.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Order Notes | Medium 6.4 | |
| CVE-2026-111178 | WP Booking System <= 2.1.0.1 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter | Medium 4.9 | |
| CVE-2026-107646 | HUSKY <= 1.4.5 - Unauthenticated Sensitive Information Exposure in 'woof_tm_data' Localized Script | Medium 5.3 | |
| CVE-2026-110179 | affiliate-toolkit < 3.8.9 - Editor+ SQL Injection via orderby Parameter | Medium 6.8 | |
| CVE-2026-110014 | Salon Booking System < 10.31.9 - Unauthenticated Booking Creation with Arbitrary Customer ID and Status | Medium 5.3 | |
| CVE-2026-110013 | Salon Booking System < 10.31.9 - Unauthenticated Salon REST API Access via Predictable Access-Token | Medium 4.8 | |
| CVE-2026-110012 | Salon Booking System < 10.31.3 - Subscriber+ Booking PII Disclosure via REST bookings/upcoming | Medium 4.3 | |
| CVE-2026-109982 | MB Custom Post Types & Custom Taxonomies < 2.12.2 - Subscriber+ Missing Authorization via CPT UI Migration | Medium 4.2 | |
| CVE-2026-105974 | Visual Form Builder <= 3.1 - Subscriber+ Sensitive Data Disclosure via Dashboard Widget | Medium 4.3 | |
| CVE-2026-105973 | Visual Form Builder <= 3.1 - Subscriber+ Arbitrary Form Field Reordering via Missing Authorization | Medium 4.3 | |
| CVE-2026-103696 | Mobile Builder <= 1.4.2 - Unauthenticated SQLi via 'delivery_id' Parameter | Medium 6.8 | |
| CVE-2026-74923 | Document Gallery <= 5.1.1 - Unauthenticated Non-Public Attachment Disclosure via dg_generate_gallery and dg_generate_icons | Medium 5.3 | |
| CVE-2026-92427 | Coinsnap Bitcoin Crowdfunding <= 1.2.0 - Unauthenticated Payment Record Forgery via Webhook Secret Disclosure | Medium 5.3 | |
| CVE-2026-91830 | Subscribe to Comments < 2.3.3 - Unauthenticated Subscription Management Key Disclosure via Forged Comment Cookie | Medium 6.5 | |
| CVE-2026-91833 | WX Subscribe <= 1.2.1 - Unauthenticated SQLi via 'attach' Parameter | Medium 6.8 | |
| CVE-2026-88963 | Tutor LMS <= 4.0.8 - Authenticated (Subscriber+) Reflected DOM-Based Cross-Site Scripting via 'redirect_url' Parameter | Medium 6.1 | |
| CVE-2026-109414 | Vitepos <= 3.6.1 - Authenticated (Vendor+) SQL Injection via 'src_by[].val' Parameter via 'bt' Operator | Medium 6.5 | |
| CVE-2026-104001 | Slim SEO <= 4.11.1 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'Biographical Info' User Meta | Medium 5.4 | |
| CVE-2026-12272 | Lightweight Cookie Notice <= 1.19 - Sensitive Information Exposure via W3TC_DYNAMIC_SECURITY Constant | Medium 5.3 | |
| CVE-2026-93767 | Tainacan <= 1.3.0 - Authenticated (Subscriber+) Path Traversal to Arbitrary File Read via 'guid' Parameter | Medium 6.5 | |
| CVE-2026-103480 | Tourfic <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'type' Shortcode Attribute | Medium 6.4 | |
| CVE-2026-107748 | User Profile Builder <= 4.0.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' Parameter | Medium 6.4 | |
| CVE-2026-110017 | Quick PayPal Payments: Payment Button & Form <= 6.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'form' Shortcode Attribute | Medium 6.4 |
Showing 451–500 of 138,422. Narrow the filters to see the rest.
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status. Filter by severity and year here; the other filters work on the curated lists.