Vulnerability Intelligence · All CVEs
Every Published CVE, Searchable.
Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status.
Synced hourly · figures as of Oct 20, 2026
40,422 vulnerabilities · newest first
- CVE-2026-93945Critical 9.8WordPress Balance theme <= 1.12.0 - PHP Object Injection vulnerabilityPublished Oct 10, 2026
- CVE-2026-93944Critical 9.8WordPress Camelia theme <= 1.2.15 - PHP Object Injection vulnerabilityPublished Oct 10, 2026
- CVE-2026-93943Critical 9.8WordPress Convex theme <= 1.16.0 - PHP Object Injection vulnerabilityPublished Oct 10, 2026
- CVE-2026-93942Critical 9.8WordPress Dwell theme <= 1.16.0 - PHP Object Injection vulnerabilityPublished Oct 10, 2026
- CVE-2026-93941Critical 9.8WordPress Edema theme <= 1.2.2.2 - PHP Object Injection vulnerabilityPublished Oct 10, 2026
- CVE-2026-93940Critical 9.8WordPress Greeny theme <= 2.10.0 - PHP Object Injection vulnerabilityPublished Oct 10, 2026
- CVE-2026-93938Critical 9.8WordPress Hogwords theme <= 1.2.7 - PHP Object Injection vulnerabilityPublished Oct 10, 2026
- CVE-2026-93937Critical 9.8WordPress Hygia theme <= 1.21.0 - PHP Object Injection vulnerabilityPublished Oct 10, 2026
- CVE-2026-93936Critical 9.8WordPress IPharm theme <= 1.2.4 - PHP Object Injection vulnerabilityPublished Oct 10, 2026
- CVE-2026-93935Critical 9.8WordPress Let's Play theme <= 1.1.15 - PHP Object Injection vulnerabilityPublished Oct 10, 2026
- CVE-2026-93934Critical 9.8WordPress Partiso theme <= 1.1.13 - PHP Object Injection vulnerabilityPublished Oct 10, 2026
- CVE-2026-93933Critical 9.8WordPress Rosalinda theme <= 1.2.4 - PHP Object Injection vulnerabilityPublished Oct 10, 2026
- CVE-2026-93932Critical 9.8WordPress Smart Casa theme <= 1.0.12 - PHP Object Injection vulnerabilityPublished Oct 10, 2026
- CVE-2026-93931Critical 9.8WordPress Smash theme <= 1.12.0 - PHP Object Injection vulnerabilityPublished Oct 10, 2026
- CVE-2026-93930Critical 9.8WordPress Tantra theme <= 2.9.0 - PHP Object Injection vulnerabilityPublished Oct 10, 2026
- CVE-2026-93929Critical 9.8WordPress Travesia theme <= 1.1.16 - PHP Object Injection vulnerabilityPublished Oct 10, 2026
- CVE-2026-93927Critical 9.8WordPress Veto theme <= 1.6.0 - PHP Object Injection vulnerabilityPublished Oct 10, 2026
- CVE-2026-104801Critical 9.1PPOM ][n][org]' ParameterPublished Oct 10, 2026
- CVE-2026-97670Critical 9.1Avada (Fusion) Builder <= 7.16.1 - Unauthenticated Arbitrary WordPress Action Invocation via '{action_hook}' Dynamic-Data Token in Form FieldPublished Oct 10, 2026
- CVE-2026-103889Critical 9.83D Product configurator for WooCommerce <= 2.16.2 - Unauthenticated Remote Code Execution via 'xpv_image' ParameterPublished Oct 10, 2026
- CVE-2026-94589Critical 9.8Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) <= 3.4.5 - Unauthenticated Arbitrary File Upload via Signature Field File UploadPublished Oct 10, 2026
- CVE-2026-104732Critical 9.8Advanced IP Blocker <= 8.13.13 - Unauthenticated Authentication Bypass via Missing Step-1 Binding to 2FA Login HandlerPublished Oct 10, 2026
- CVE-2026-107645Critical 9.1Blocksy Companion <= 2.1.58 - Unauthenticated Privilege Escalation to 'role' ParameterPublished Oct 10, 2026
- CVE-2026-108474Critical 9.8In JetBrains Exposed before 1.5.1 sQL injection was possible via unescaped string arguments of several SQL functionsPublished Oct 10, 2026
- CVE-2026-108269Critical 9.1Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections.Published Oct 9, 2026
- CVE-2026-108268Critical 9.1Enclave OS Virtual runs container workloads inside confidential virtual machines with end-to-end attestation.Published Oct 9, 2026
- CVE-2026-108267Critical 9.1Prior to privasys-v0.5.1-go1.26.5, challenge-mode RA-TLS certificates bound quote ReportData to the certificate public key and client…Published Oct 9, 2026
- CVE-2026-108266Critical 9.1Privasys rustls fork: RA-TLS challenge mode did not bind attestation evidence to the TLS sessionPublished Oct 9, 2026
- CVE-2026-108265Critical 9.1enclave-os-mini: RA-TLS challenge certificates were not bound to the TLS sessionPublished Oct 9, 2026
- CVE-2026-108264Critical 9.1Wizarr: Authenticated Server-Side Template Injection (SSTI) in wizard step rendering leads to Remote Code Execution (RCE)Published Oct 9, 2026
- CVE-2026-108263Critical 9.9Astron Agent: Unsandboxed code-node leads to cross-tenant RCEPublished Oct 9, 2026
- CVE-2026-108261Critical 9.3TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragmentPublished Oct 9, 2026
- CVE-2026-107845Critical 9.3Contao: Cross-site scripting in the comments bundlePublished Oct 9, 2026
- CVE-2026-107824Critical 9.3x64dbg-MCP Server exposes debugger operations to unauthenticated network clientsPublished Oct 9, 2026
- CVE-2026-108157Critical 9.2Pingvin Share X from 0.19.0 before 1.22.0 contains an improper authentication vulnerability that allows remote unauthenticated attackers to take over accounts by abusing automatic OAuth email linking in OAuthService.signUp().Published Oct 9, 2026
- CVE-2026-107806Critical 9.4Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config OverwritePublished Oct 9, 2026
- CVE-2026-15340Critical 9.3Savannah lwIP SMTP client Classic Buffer OverflowPublished Oct 9, 2026
- CVE-2026-33367Critical 9.3Red Lion Controls N-Tron 700 Series Missing Authentication for Critical FunctionPublished Oct 9, 2026
- CVE-2026-28745Critical 9.3Red Lion Controls N-Tron 700 Series Storing Passwords in a Recoverable FormatPublished Oct 9, 2026
- CVE-2026-108109Critical 9.3PHPNuxBill through 2025.3.20 Account Takeover via Brute-Forceable Password Reset CodePublished Oct 9, 2026
- CVE-2026-108107Critical 9.3PHPNuxBill through 2025.3.20 Unauthenticated SQL Injection via radius.phpPublished Oct 9, 2026
- CVE-2026-39460Critical 9.3Red Lion Controls N-Tron 700 Series Insufficiently Protected CredentialsPublished Oct 9, 2026
- CVE-2026-32645Critical 9.2Red Lion Controls N-Tron 700 Series Use of Hard-Coded CredentialsPublished Oct 9, 2026
- CVE-2026-105278Critical 9.3Grid Protection Alliance openPDC (Docker image) Use of Hard-coded CredentialsPublished Oct 9, 2026
- CVE-2026-100730Critical 9.3Grid Protection Alliance openPDC and openHistorian Deserialization of Untrusted DataPublished Oct 9, 2026
- CVE-2026-97468Critical 9.1Apache CXF's STSTokenValidator and Security Token Service (STS) cached validated security tokens under a non-cryptographic 32-bit hash of the token (Java Arrays.hashCode/hashCode()), and treated a cache hit as proof that the presented…Published Oct 9, 2026
- CVE-2026-71575Critical 9.1The max_age authentication-freshness check in OidcClientCodeRequestFilter was inoperative due to a milliseconds/seconds unit mismatch and an inverted comparison polarity.Published Oct 9, 2026
- CVE-2026-107938Critical 9.1In Apache CXF, the Netty-based HTTP client transport (cxf-rt-transports-http-netty-client) did not verify that the hostname in the server’s TLS certificate matched the host being called.Published Oct 9, 2026
- CVE-2026-93947Critical 9.3WordPress Traveler theme <= 3.2.9 - SQL Injection vulnerabilityPublished Oct 9, 2026
- CVE-2026-94503Critical 10.0WordPress Zombify plugin <= 1.7.7 - Arbitrary File Upload vulnerabilityPublished Oct 9, 2026
| CVE | Title | Severity | Published |
|---|---|---|---|
| CVE-2026-93945 | WordPress Balance theme <= 1.12.0 - PHP Object Injection vulnerability | Critical 9.8 | |
| CVE-2026-93944 | WordPress Camelia theme <= 1.2.15 - PHP Object Injection vulnerability | Critical 9.8 | |
| CVE-2026-93943 | WordPress Convex theme <= 1.16.0 - PHP Object Injection vulnerability | Critical 9.8 | |
| CVE-2026-93942 | WordPress Dwell theme <= 1.16.0 - PHP Object Injection vulnerability | Critical 9.8 | |
| CVE-2026-93941 | WordPress Edema theme <= 1.2.2.2 - PHP Object Injection vulnerability | Critical 9.8 | |
| CVE-2026-93940 | WordPress Greeny theme <= 2.10.0 - PHP Object Injection vulnerability | Critical 9.8 | |
| CVE-2026-93938 | WordPress Hogwords theme <= 1.2.7 - PHP Object Injection vulnerability | Critical 9.8 | |
| CVE-2026-93937 | WordPress Hygia theme <= 1.21.0 - PHP Object Injection vulnerability | Critical 9.8 | |
| CVE-2026-93936 | WordPress IPharm theme <= 1.2.4 - PHP Object Injection vulnerability | Critical 9.8 | |
| CVE-2026-93935 | WordPress Let's Play theme <= 1.1.15 - PHP Object Injection vulnerability | Critical 9.8 | |
| CVE-2026-93934 | WordPress Partiso theme <= 1.1.13 - PHP Object Injection vulnerability | Critical 9.8 | |
| CVE-2026-93933 | WordPress Rosalinda theme <= 1.2.4 - PHP Object Injection vulnerability | Critical 9.8 | |
| CVE-2026-93932 | WordPress Smart Casa theme <= 1.0.12 - PHP Object Injection vulnerability | Critical 9.8 | |
| CVE-2026-93931 | WordPress Smash theme <= 1.12.0 - PHP Object Injection vulnerability | Critical 9.8 | |
| CVE-2026-93930 | WordPress Tantra theme <= 2.9.0 - PHP Object Injection vulnerability | Critical 9.8 | |
| CVE-2026-93929 | WordPress Travesia theme <= 1.1.16 - PHP Object Injection vulnerability | Critical 9.8 | |
| CVE-2026-93927 | WordPress Veto theme <= 1.6.0 - PHP Object Injection vulnerability | Critical 9.8 | |
| CVE-2026-104801 | PPOM ][n][org]' Parameter | Critical 9.1 | |
| CVE-2026-97670 | Avada (Fusion) Builder <= 7.16.1 - Unauthenticated Arbitrary WordPress Action Invocation via '{action_hook}' Dynamic-Data Token in Form Field | Critical 9.1 | |
| CVE-2026-103889 | 3D Product configurator for WooCommerce <= 2.16.2 - Unauthenticated Remote Code Execution via 'xpv_image' Parameter | Critical 9.8 | |
| CVE-2026-94589 | Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) <= 3.4.5 - Unauthenticated Arbitrary File Upload via Signature Field File Upload | Critical 9.8 | |
| CVE-2026-104732 | Advanced IP Blocker <= 8.13.13 - Unauthenticated Authentication Bypass via Missing Step-1 Binding to 2FA Login Handler | Critical 9.8 | |
| CVE-2026-107645 | Blocksy Companion <= 2.1.58 - Unauthenticated Privilege Escalation to 'role' Parameter | Critical 9.1 | |
| CVE-2026-108474 | In JetBrains Exposed before 1.5.1 sQL injection was possible via unescaped string arguments of several SQL functions | Critical 9.8 | |
| CVE-2026-108269 | Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections. | Critical 9.1 | |
| CVE-2026-108268 | Enclave OS Virtual runs container workloads inside confidential virtual machines with end-to-end attestation. | Critical 9.1 | |
| CVE-2026-108267 | Prior to privasys-v0.5.1-go1.26.5, challenge-mode RA-TLS certificates bound quote ReportData to the certificate public key and client… | Critical 9.1 | |
| CVE-2026-108266 | Privasys rustls fork: RA-TLS challenge mode did not bind attestation evidence to the TLS session | Critical 9.1 | |
| CVE-2026-108265 | enclave-os-mini: RA-TLS challenge certificates were not bound to the TLS session | Critical 9.1 | |
| CVE-2026-108264 | Wizarr: Authenticated Server-Side Template Injection (SSTI) in wizard step rendering leads to Remote Code Execution (RCE) | Critical 9.1 | |
| CVE-2026-108263 | Astron Agent: Unsandboxed code-node leads to cross-tenant RCE | Critical 9.9 | |
| CVE-2026-108261 | TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment | Critical 9.3 | |
| CVE-2026-107845 | Contao: Cross-site scripting in the comments bundle | Critical 9.3 | |
| CVE-2026-107824 | x64dbg-MCP Server exposes debugger operations to unauthenticated network clients | Critical 9.3 | |
| CVE-2026-108157 | Pingvin Share X from 0.19.0 before 1.22.0 contains an improper authentication vulnerability that allows remote unauthenticated attackers to take over accounts by abusing automatic OAuth email linking in OAuthService.signUp(). | Critical 9.2 | |
| CVE-2026-107806 | Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite | Critical 9.4 | |
| CVE-2026-15340 | Savannah lwIP SMTP client Classic Buffer Overflow | Critical 9.3 | |
| CVE-2026-33367 | Red Lion Controls N-Tron 700 Series Missing Authentication for Critical Function | Critical 9.3 | |
| CVE-2026-28745 | Red Lion Controls N-Tron 700 Series Storing Passwords in a Recoverable Format | Critical 9.3 | |
| CVE-2026-108109 | PHPNuxBill through 2025.3.20 Account Takeover via Brute-Forceable Password Reset Code | Critical 9.3 | |
| CVE-2026-108107 | PHPNuxBill through 2025.3.20 Unauthenticated SQL Injection via radius.php | Critical 9.3 | |
| CVE-2026-39460 | Red Lion Controls N-Tron 700 Series Insufficiently Protected Credentials | Critical 9.3 | |
| CVE-2026-32645 | Red Lion Controls N-Tron 700 Series Use of Hard-Coded Credentials | Critical 9.2 | |
| CVE-2026-105278 | Grid Protection Alliance openPDC (Docker image) Use of Hard-coded Credentials | Critical 9.3 | |
| CVE-2026-100730 | Grid Protection Alliance openPDC and openHistorian Deserialization of Untrusted Data | Critical 9.3 | |
| CVE-2026-97468 | Apache CXF's STSTokenValidator and Security Token Service (STS) cached validated security tokens under a non-cryptographic 32-bit hash of the token (Java Arrays.hashCode/hashCode()), and treated a cache hit as proof that the presented… | Critical 9.1 | |
| CVE-2026-71575 | The max_age authentication-freshness check in OidcClientCodeRequestFilter was inoperative due to a milliseconds/seconds unit mismatch and an inverted comparison polarity. | Critical 9.1 | |
| CVE-2026-107938 | In Apache CXF, the Netty-based HTTP client transport (cxf-rt-transports-http-netty-client) did not verify that the hostname in the server’s TLS certificate matched the host being called. | Critical 9.1 | |
| CVE-2026-93947 | WordPress Traveler theme <= 3.2.9 - SQL Injection vulnerability | Critical 9.3 | |
| CVE-2026-94503 | WordPress Zombify plugin <= 1.7.7 - Arbitrary File Upload vulnerability | Critical 10.0 |
Showing 501–550 of 40,422. Narrow the filters to see the rest.
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status. Filter by severity and year here; the other filters work on the curated lists.