Vulnerability Intelligence · All CVEs
Every Published CVE, Searchable.
Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status.
Synced hourly · figures as of Oct 20, 2026
126,401 vulnerabilities · newest first
- CVE-2026-107416High 7.5WordPress Webba Booking plugin <= 6.5.2 - Insecure Direct Object References (IDOR) vulnerabilityPublished Oct 15, 2026
- CVE-2026-109702High 7.1WordPress Social Share Buttons plugin <= 1.31 - Cross Site Scripting (XSS) vulnerabilityPublished Oct 15, 2026
- CVE-2026-88794High 8.2XML External Entity injection in Sparx Enterprise ArchitectPublished Oct 15, 2026
- CVE-2026-110723High 7.5In api-gateway versions till 1.7.3, The default rate-limit key resolver, ClientIpKeyResolver, derives the per-client bucket key from the leftmost element of the X-Forwarded-For request header.Published Oct 15, 2026
- CVE-2026-110724High 7.5In api-gateway versions till 1.7.3, The default rate-limit key resolver, ClientIpKeyResolver, derives the per-client bucket key from the leftmost element of the X-Forwarded-For request header.Published Oct 15, 2026
- CVE-2026-109692High 7.1WordPress User Registration plugin <= 5.2.8 - Broken Access Control vulnerabilityPublished Oct 15, 2026
- CVE-2026-109693High 8.8WordPress Fluent CRM plugin <= 3.2.5 - Privilege Escalation vulnerabilityPublished Oct 15, 2026
- CVE-2026-79837High 7.3HPE NonStop SQL/MX UDR SERVER - Service disruption vulnerabilityPublished Oct 15, 2026
- CVE-2026-104025High 8.4Path traversal in PeaZip object preview allows execution of arbitrary programs via a crafted archive entry namePublished Oct 15, 2026
- CVE-2026-79834High 7.4HPE NonStop SQL/MX SQLCAT - Unauthorized command execution vulnerabilityPublished Oct 15, 2026
- CVE-2026-79833High 7.5A vulnerability in HPE NonStop ANSI SQLUTIL may allow a remote unauthenticated actor to cause an affected service to terminate unexpectedly, causing a denial of service.Published Oct 15, 2026
- CVE-2026-109695High 7.5Insertion of Sensitive Information Into Sent Data vulnerability in WPManageNinja FluentCart fluent-cart allows Retrieve Embedded Sensitive Data.This issue affects FluentCart: from n/a through 1.7.1.Published Oct 15, 2026
- CVE-2026-108498High 7.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bannersky BSK PDF Manager bsk-pdf-manager allows Stored XSS.This issue affects BSK PDF Manager: from n/a through 3.8.1.Published Oct 15, 2026
- CVE-2026-108491High 7.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Everest Forms Everest Forms everest-forms allows Stored XSS.This issue affects Everest Forms: from n/a through 3.6.1.Published Oct 15, 2026
- CVE-2026-79832High 7.6HPE NonStop SQL/MX Executor - Buffer overflow vulnerabilityPublished Oct 15, 2026
- CVE-2026-79829High 8.2A security vulnerability in HPE NonStop HTTP WEBSERVER can cause memory corruption which may result in a system halt.Published Oct 15, 2026
- CVE-2026-79828High 7.1A heap buffer overflow in HPE NonStop Debug Utilities could corrupt resume-execution address and may potentially redirect execution flow.Published Oct 15, 2026
- CVE-2026-79827High 7.1A heap buffer overflow in HPE NonStop Inspect Subsystem could corrupt resume-execution address and may potentially redirect execution flow.Published Oct 15, 2026
- CVE-2026-79826High 7.1A heap buffer overflow in HPE NonStop OCAX could corrupt address space and may potentially redirect execution flow.Published Oct 15, 2026
- CVE-2026-79825High 7.1A heap buffer overflow in HPE NonStop NDSREST could corrupt resume-execution address and may potentially redirect execution flow.Published Oct 15, 2026
- CVE-2026-79824High 8.0A directory traversal vulnerability in HPE NonStop Python 3.x could allow attackers to overwrite arbitrary files via a ..Published Oct 15, 2026
- CVE-2026-53882High 8.7An improper link resolution before file access ('link following') vulnerability has been reported to affect Virtualization Station.Published Oct 15, 2026
- CVE-2026-39997High 8.9Unauthenticated Remote Input Injection in QNAP HD Station's remotepadPublished Oct 15, 2026
- CVE-2026-18660High 8.8Jetty proxy blacklist performs case-sensitive matching of case-insensitive DNS hostnamesPublished Oct 15, 2026
- CVE-2026-34009High 8.4Container Escape Host user home directory mounted with write access into application containerPublished Oct 15, 2026
- CVE-2026-34008High 8.5Privilege Escalation World-writable crontab path monitored and executed by root-owned processPublished Oct 15, 2026
- CVE-2026-44084High 8.7Access Code Forgery in Video Station leading to unauthorized media accessPublished Oct 15, 2026
- CVE-2026-41545High 8.6WebSocket timelapse path traversal and command injectionPublished Oct 15, 2026
- CVE-2026-34015High 8.7Remote Code Execution in upload.php of Video StationPublished Oct 15, 2026
- CVE-2026-34014High 8.4ds-move-files.sh is writable and executed as rootPublished Oct 15, 2026
- CVE-2026-26245High 7.1SQLi#2 SQL Injection in class_videos.php getSmartVideosByOffsetPublished Oct 15, 2026
- CVE-2026-26244High 7.1SQLi#1 SQL Injection in class_videos.php _getFiltersPublished Oct 15, 2026
- CVE-2026-26243High 7.2Arbitrary Folder Deletion in Qsync Central 5.0.0.5Published Oct 15, 2026
- CVE-2026-77711High 8.2When Jetty's HttpClient make a request to a server through a forward proxy, the server may reply with a 407 (Proxy Authentication Required).Published Oct 15, 2026
- CVE-2026-76184High 8.2In Eclipse Jetty, HttpClient may receive a redirect of the form:Published Oct 15, 2026
- CVE-2026-63315High 8.2WebCTI service for Slican IPx telephone exchanges stores temporary subscriber password in plaintext.Published Oct 15, 2026
- CVE-2026-63314High 8.7WebCTI service for Slican IPx telephone exchanges is vulnerable to SQL Injection in /webcti/admin_json.php enpoint.Published Oct 15, 2026
- CVE-2026-18661High 8.8In Eclipse Jetty, across various versions of jetty-annotations, and jetty-eeN-annotations, the Jakarta Spec authoritative url-pattern rules for mixed @ServletSecurity annotation, and web.xml defined security-constraint on the…Published Oct 15, 2026
- CVE-2026-35088High 8.2Inadequate Encryption Strength in Slican telephone exchangesPublished Oct 15, 2026
- CVE-2026-101290High 7.5CVE-2026-101290Published Oct 15, 2026
- CVE-2026-16437High 7.1An authentication bypass vulnerability in GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizVizPublished Oct 15, 2026
- CVE-2026-102477High 8.7In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], a gRPC endpoint does have a configurable per message maximum size in bytes, however the maximum size applies to the received bytes.Published Oct 15, 2026
- CVE-2026-102464High 8.2In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Eclipse Vert.x MQTT (vertx-mqtt) MqttClient stores every inbound QoS 2 PUBLISH message received from the broker in an internal map…Published Oct 15, 2026
- CVE-2026-102461High 8.7In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the uniqueItems keyword validation uses an O(n²) pairwise comparison loop with no short-circuit or size limit.Published Oct 15, 2026
- CVE-2026-103224High 8.2In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the MySQL message decoder aggregates inbound multi-packet payloads into a composite direct-memory buffer without any cumulative size limit.Published Oct 15, 2026
- CVE-2026-103223High 8.2In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the PostgreSQL message decoder reads the 4-byte message length field from the PostgreSQL wire protocol without any maximum validation.Published Oct 15, 2026
- CVE-2026-102466High 8.2In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x MySQL client (vertx-mysql-client) pre-allocates an array for column definitions based on a server-declared column count with no…Published Oct 15, 2026
- CVE-2026-102463High 8.2In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the binary array decoder in vertx-pg-client (DataTypeCodec.binaryDecodeArray) allocates a Java array sized by a server-declared 32-bit…Published Oct 15, 2026
- CVE-2026-109855High 7.5undici WebSocket client vulnerable to Denial of Service via failed HTTP/2 handshakePublished Oct 15, 2026
- CVE-2026-102462High 8.2In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the TDS message decoder in the Vert.x MSSQL client (vertx-mssql-client) aggregates inbound TDS packets into a composite direct-memory buffer…Published Oct 15, 2026
| CVE | Title | Severity | Published |
|---|---|---|---|
| CVE-2026-107416 | WordPress Webba Booking plugin <= 6.5.2 - Insecure Direct Object References (IDOR) vulnerability | High 7.5 | |
| CVE-2026-109702 | WordPress Social Share Buttons plugin <= 1.31 - Cross Site Scripting (XSS) vulnerability | High 7.1 | |
| CVE-2026-88794 | XML External Entity injection in Sparx Enterprise Architect | High 8.2 | |
| CVE-2026-110723 | In api-gateway versions till 1.7.3, The default rate-limit key resolver, ClientIpKeyResolver, derives the per-client bucket key from the leftmost element of the X-Forwarded-For request header. | High 7.5 | |
| CVE-2026-110724 | In api-gateway versions till 1.7.3, The default rate-limit key resolver, ClientIpKeyResolver, derives the per-client bucket key from the leftmost element of the X-Forwarded-For request header. | High 7.5 | |
| CVE-2026-109692 | WordPress User Registration plugin <= 5.2.8 - Broken Access Control vulnerability | High 7.1 | |
| CVE-2026-109693 | WordPress Fluent CRM plugin <= 3.2.5 - Privilege Escalation vulnerability | High 8.8 | |
| CVE-2026-79837 | HPE NonStop SQL/MX UDR SERVER - Service disruption vulnerability | High 7.3 | |
| CVE-2026-104025 | Path traversal in PeaZip object preview allows execution of arbitrary programs via a crafted archive entry name | High 8.4 | |
| CVE-2026-79834 | HPE NonStop SQL/MX SQLCAT - Unauthorized command execution vulnerability | High 7.4 | |
| CVE-2026-79833 | A vulnerability in HPE NonStop ANSI SQLUTIL may allow a remote unauthenticated actor to cause an affected service to terminate unexpectedly, causing a denial of service. | High 7.5 | |
| CVE-2026-109695 | Insertion of Sensitive Information Into Sent Data vulnerability in WPManageNinja FluentCart fluent-cart allows Retrieve Embedded Sensitive Data.This issue affects FluentCart: from n/a through 1.7.1. | High 7.5 | |
| CVE-2026-108498 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bannersky BSK PDF Manager bsk-pdf-manager allows Stored XSS.This issue affects BSK PDF Manager: from n/a through 3.8.1. | High 7.1 | |
| CVE-2026-108491 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Everest Forms Everest Forms everest-forms allows Stored XSS.This issue affects Everest Forms: from n/a through 3.6.1. | High 7.1 | |
| CVE-2026-79832 | HPE NonStop SQL/MX Executor - Buffer overflow vulnerability | High 7.6 | |
| CVE-2026-79829 | A security vulnerability in HPE NonStop HTTP WEBSERVER can cause memory corruption which may result in a system halt. | High 8.2 | |
| CVE-2026-79828 | A heap buffer overflow in HPE NonStop Debug Utilities could corrupt resume-execution address and may potentially redirect execution flow. | High 7.1 | |
| CVE-2026-79827 | A heap buffer overflow in HPE NonStop Inspect Subsystem could corrupt resume-execution address and may potentially redirect execution flow. | High 7.1 | |
| CVE-2026-79826 | A heap buffer overflow in HPE NonStop OCAX could corrupt address space and may potentially redirect execution flow. | High 7.1 | |
| CVE-2026-79825 | A heap buffer overflow in HPE NonStop NDSREST could corrupt resume-execution address and may potentially redirect execution flow. | High 7.1 | |
| CVE-2026-79824 | A directory traversal vulnerability in HPE NonStop Python 3.x could allow attackers to overwrite arbitrary files via a .. | High 8.0 | |
| CVE-2026-53882 | An improper link resolution before file access ('link following') vulnerability has been reported to affect Virtualization Station. | High 8.7 | |
| CVE-2026-39997 | Unauthenticated Remote Input Injection in QNAP HD Station's remotepad | High 8.9 | |
| CVE-2026-18660 | Jetty proxy blacklist performs case-sensitive matching of case-insensitive DNS hostnames | High 8.8 | |
| CVE-2026-34009 | Container Escape Host user home directory mounted with write access into application container | High 8.4 | |
| CVE-2026-34008 | Privilege Escalation World-writable crontab path monitored and executed by root-owned process | High 8.5 | |
| CVE-2026-44084 | Access Code Forgery in Video Station leading to unauthorized media access | High 8.7 | |
| CVE-2026-41545 | WebSocket timelapse path traversal and command injection | High 8.6 | |
| CVE-2026-34015 | Remote Code Execution in upload.php of Video Station | High 8.7 | |
| CVE-2026-34014 | ds-move-files.sh is writable and executed as root | High 8.4 | |
| CVE-2026-26245 | SQLi#2 SQL Injection in class_videos.php getSmartVideosByOffset | High 7.1 | |
| CVE-2026-26244 | SQLi#1 SQL Injection in class_videos.php _getFilters | High 7.1 | |
| CVE-2026-26243 | Arbitrary Folder Deletion in Qsync Central 5.0.0.5 | High 7.2 | |
| CVE-2026-77711 | When Jetty's HttpClient make a request to a server through a forward proxy, the server may reply with a 407 (Proxy Authentication Required). | High 8.2 | |
| CVE-2026-76184 | In Eclipse Jetty, HttpClient may receive a redirect of the form: | High 8.2 | |
| CVE-2026-63315 | WebCTI service for Slican IPx telephone exchanges stores temporary subscriber password in plaintext. | High 8.2 | |
| CVE-2026-63314 | WebCTI service for Slican IPx telephone exchanges is vulnerable to SQL Injection in /webcti/admin_json.php enpoint. | High 8.7 | |
| CVE-2026-18661 | In Eclipse Jetty, across various versions of jetty-annotations, and jetty-eeN-annotations, the Jakarta Spec authoritative url-pattern rules for mixed @ServletSecurity annotation, and web.xml defined security-constraint on the… | High 8.8 | |
| CVE-2026-35088 | Inadequate Encryption Strength in Slican telephone exchanges | High 8.2 | |
| CVE-2026-101290 | CVE-2026-101290 | High 7.5 | |
| CVE-2026-16437 | An authentication bypass vulnerability in GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz | High 7.1 | |
| CVE-2026-102477 | In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], a gRPC endpoint does have a configurable per message maximum size in bytes, however the maximum size applies to the received bytes. | High 8.7 | |
| CVE-2026-102464 | In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Eclipse Vert.x MQTT (vertx-mqtt) MqttClient stores every inbound QoS 2 PUBLISH message received from the broker in an internal map… | High 8.2 | |
| CVE-2026-102461 | In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the uniqueItems keyword validation uses an O(n²) pairwise comparison loop with no short-circuit or size limit. | High 8.7 | |
| CVE-2026-103224 | In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the MySQL message decoder aggregates inbound multi-packet payloads into a composite direct-memory buffer without any cumulative size limit. | High 8.2 | |
| CVE-2026-103223 | In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the PostgreSQL message decoder reads the 4-byte message length field from the PostgreSQL wire protocol without any maximum validation. | High 8.2 | |
| CVE-2026-102466 | In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x MySQL client (vertx-mysql-client) pre-allocates an array for column definitions based on a server-declared column count with no… | High 8.2 | |
| CVE-2026-102463 | In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the binary array decoder in vertx-pg-client (DataTypeCodec.binaryDecodeArray) allocates a Java array sized by a server-declared 32-bit… | High 8.2 | |
| CVE-2026-109855 | undici WebSocket client vulnerable to Denial of Service via failed HTTP/2 handshake | High 7.5 | |
| CVE-2026-102462 | In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the TDS message decoder in the Vert.x MSSQL client (vertx-mssql-client) aggregates inbound TDS packets into a composite direct-memory buffer… | High 8.2 |
Showing 501–550 of 126,401. Narrow the filters to see the rest.
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status. Filter by severity and year here; the other filters work on the curated lists.