Vulnerability Intelligence · All CVEs
Every Published CVE, Searchable.
Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status.
Synced hourly · figures as of Oct 20, 2026
11,307 vulnerabilities · newest first
- CVE-2026-87836Low 2.7Comments Import & Export 2.1.11 - 2.5.3 - Author+ Comment PII Disclosure via ExportPublished Sep 17, 2026
- CVE-2026-86446Low 3.7LearnPress 4.4.3 - 4.4.6 - Unauthenticated Quiz Answer Disclosure via check-answer REST EndpointPublished Sep 17, 2026
- CVE-2026-92814Low 2.3changedetection.io through 0.60.6 Cross-Site Scripting via watch_titlePublished Sep 16, 2026
- CVE-2026-20071Low 3.8ISE 802.1x Session Hijack VulnerabilityPublished Sep 16, 2026
- CVE-2026-81870Low 2.0OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logsPublished Sep 16, 2026
- CVE-2026-87026Low 3.8Tanium addressed an improper access controls vulnerability in Threat Response.Published Sep 16, 2026
- CVE-2026-81866Low 0.5Apache NiFi: Missing Authorization for Assets and Secrets Referenced by Connector ConfigurationPublished Sep 16, 2026
- CVE-2026-86089Low 2.3Apache NiFi: Missing Process Group Authorization for Connector MigrationPublished Sep 16, 2026
- CVE-2026-86071Low 3.7Prior to version 7.6.1, LocalFolderExtractor in src/main/java/com/github/junrar/LocalFolderExtractor.java can create directories outside the intended extraction root when processing a…Published Sep 16, 2026
- CVE-2026-73442Low 2.1On affected platforms running Arista EOS with VRRP enabled, the peer device VRRP authentication credentials are logged in cleartext on the switch, allowing an authenticated user with sufficient privileges to view agent trace logs (or a system receiving…Published Sep 16, 2026
- CVE-2026-85387Low 2.0Concrete CMS before 9.5.4 allows a deactivated user to retain OAuth-authenticated REST API accessPublished Sep 16, 2026
- CVE-2026-87031Low 2.1Missing authorization in the REST API user creation endpoint in Concrete CMS 9.2.0 through 9.5.3 allows arbitrary account creationPublished Sep 16, 2026
- CVE-2026-69200Low 3.7node-opcua: Prototype Pollution via internal fieldsToJson() implementation (Related to CVE-2024-57086)Published Sep 16, 2026
- CVE-2026-92130Low 3.1Jenkins Pipeline: Multibranch Plugin 841.vec5b_9e1806ec and earlier does not set the appropriate context for credentials lookup in the resolveScm Pipeline step, allowing attackers with Item/Configure permission to access and capture…Published Sep 16, 2026
- CVE-2026-92359Low 2.3The…Published Sep 16, 2026
- CVE-2026-73440Low 2.3On affected platforms running Arista EOS with Simple Network Management Protocol (SNMP) configured, SNMPv3 local or remote user credentials may be exposed as a one-way hashed, localized key value within the device's running and sanitized…Published Sep 16, 2026
- CVE-2026-19640Low 2.3On affected platforms running Arista EOS, an authenticated user with access to the gNMI (gRPC Network Management Interface) may receive incorrect authorization results, potentially allowing access beyond their currently assigned…Published Sep 16, 2026
- CVE-2026-77860Low 3.7In NLnetLabs Unbound 1.20.0 up to and including 1.26.0, a vulnerability on the 'serve-expired' code path can cause a double decrement on the 'wait-limit' counter per client IP essentially bypassing one of the counter measures that was…Published Sep 16, 2026
- CVE-2026-89328Low 3.8The FluentBoards WordPress plugin before 2.0.15 does not properly verify that a user holds board-manager privileges before performing several board-management operations, checking only board membership.Published Sep 16, 2026
- CVE-2026-89327Low 3.8The FluentBoards WordPress plugin before 2.0.15 does not verify that a board member submitting a comment is the user the comment is attributed to, allowing any board member to post comments that appear to be authored by another user,…Published Sep 16, 2026
- CVE-2026-86448Low 3.7The LearnPress WordPress plugin before 4.4.7 does not perform any authentication, capability or nonce check before serving a previously generated order export file, allowing unauthenticated attackers who can determine its identifier to…Published Sep 16, 2026
- CVE-2026-84907Low 3.7The Eventin WordPress plugin before 4.1.24 does not properly authorise order finalisation when its offline (local) payment method is enabled, relying on a nonce that is exposed to unauthenticated visitors and never checking that the…Published Sep 16, 2026
- CVE-2026-84905Low 2.7The Eventin WordPress plugin before 4.1.24 does not verify a user's capability to create accounts when adding a speaker, allowing users with contributor-level access and above to create new WordPress user accounts that carry capabilities…Published Sep 16, 2026
- CVE-2026-82126Low 2.7The Schema & Structured Data for WP & AMP WordPress plugin before 1.66 does not check that a user is allowed to edit the specific post they request schema generation for, allowing users with the contributor role and above to obtain the…Published Sep 16, 2026
- CVE-2026-91747Low 3.1Use after free in Skia in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data via a crafted HTML page.Published Sep 15, 2026
- CVE-2026-91730Low 3.1Incomplete cleanup in GetUserMedia in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to obtain cross-origin data via a crafted HTML page.Published Sep 15, 2026
- CVE-2026-91723Low 3.1Race condition in WebAppInstalls in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to spoof UI elements via a crafted HTML page.Published Sep 15, 2026
- CVE-2026-91708Low 3.1Race condition in Network in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data via a crafted HTML page.Published Sep 15, 2026
- CVE-2026-81927Low 1.8Concrete CMS before 9.5.3 contained a stored cross-site scripting vulnerability in SVG file handling.Published Sep 15, 2026
- CVE-2026-81926Low 2.0Concrete CMS 9.4.0 through 9.5.2 did not escape colliding page paths before rendering them in the location panel's duplicate-path confirmation dialog.Published Sep 15, 2026
- CVE-2026-18426Low 2.0Concrete CMS 9.0.0 through 9.5.2 did not enforce a block-level edit-permission check on the Express Form block's control-management actions, which relied solely on CSRF token validation.Published Sep 15, 2026
- CVE-2026-87284Low 3.2The supported version that is affected is 7.2.16.Published Sep 15, 2026
- CVE-2026-87281Low 3.2The supported version that is affected is 7.2.16.Published Sep 15, 2026
- CVE-2026-83414Low 2.5The supported version that is affected is 15.1.1.0.0.Published Sep 15, 2026
- CVE-2026-83413Low 1.9Difficult to exploit vulnerability allows high…Published Sep 15, 2026
- CVE-2026-83369Low 3.1Difficult to exploit vulnerability allows low privileged…Published Sep 15, 2026
- CVE-2026-81925Low 2.1Concrete CMS before 9.5.3 improperly neutralized a user-supplied custom date format when rendering conversation messages, resulting in reflected cross-site scripting.Published Sep 15, 2026
- CVE-2026-18425Low 2.1Concrete CMS 9 before 9.5.3 authorized the dashboard sitemap reorder action (Concrete\Controller\Backend\Dashboard\SitemapUpdate) using only the global access_sitemap task permission and did not check per-page edit permission before…Published Sep 15, 2026
- CVE-2026-18424Low 2.1Concrete CMS 9.0.0 to 9.5.2 is vulnerable to Server-Side Request Forgery iremote file import via cross-port reuse of a host's validated DNS pin.Published Sep 15, 2026
- CVE-2026-18423Low 2.1Concrete CMS 9.0.0 through 9.5.2 is vulnerable to Insecure direct object reference (IDOR) in the Express saved search preset delete and edit dialogs .Published Sep 15, 2026
- CVE-2026-18422Low 2.1Concrete CMS before 9.5.3 did not enforce a destination-side authorization check and did not validate a CSRF token in the multilingual page assignment backend action (Backend\Page\Multilingual::assign).Published Sep 15, 2026
- CVE-2026-81924Low 2.1Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery (CSRF) in the theme page-template activation feature.Published Sep 15, 2026
- CVE-2026-81923Low 2.1In Concrete CMS before 9.5.3, the SEO Bulk Update Meta Tags editor did not check per-page edit permissions before saving.Published Sep 15, 2026
- CVE-2026-81922Low 2.1Concrete CMS before 9.5.3 did not enforce a per-page authorization check when reordering pages from the sitemap.Published Sep 15, 2026
- CVE-2026-81921Low 2.3Concrete CMS 8.5.3 through 9.5.2 enabled the OAuth 2.0 refresh-token grant using the unmodified upstream League grant, which issued new access tokens from a valid refresh token without re-checking the associated account's active status.Published Sep 15, 2026
- CVE-2026-81920Low 2.3Concrete CMS below 9.5.3 was vulnerable to Cross-Site Request Forgery in the dashboard SEO Excluded Words page.Published Sep 15, 2026
- CVE-2026-81919Low 2.3Concrete CMS below 9.5.3 did not validate an anti-CSRF token on the block-arrangement backend endpoint (the arrange() action of Concrete\Controller\Backend\Page\ArrangeBlocks).Published Sep 15, 2026
- CVE-2026-68534Low 2.3Concrete CMS before 9.5.3 rendered Express entry labels as raw HTML when displaying associated entries, resulting in stored cross-site scripting.Published Sep 15, 2026
- CVE-2026-68533Low 2.3Concrete CMS below 9.5.3 conversation attachment uploaded endpoint imported files into the file manager before evaluating the "Add Message Attachments" permission, which was only checked after the file had been stored.Published Sep 15, 2026
- CVE-2026-68532Low 2.3Concrete CMS 9.0.0 to dashboard group type controller did not validate a CSRF token on its delete action, resulting in cross-site request forgery.Published Sep 15, 2026
| CVE | Title | Severity | Published |
|---|---|---|---|
| CVE-2026-87836 | Comments Import & Export 2.1.11 - 2.5.3 - Author+ Comment PII Disclosure via Export | Low 2.7 | |
| CVE-2026-86446 | LearnPress 4.4.3 - 4.4.6 - Unauthenticated Quiz Answer Disclosure via check-answer REST Endpoint | Low 3.7 | |
| CVE-2026-92814 | changedetection.io through 0.60.6 Cross-Site Scripting via watch_title | Low 2.3 | |
| CVE-2026-20071 | ISE 802.1x Session Hijack Vulnerability | Low 3.8 | |
| CVE-2026-81870 | OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs | Low 2.0 | |
| CVE-2026-87026 | Tanium addressed an improper access controls vulnerability in Threat Response. | Low 3.8 | |
| CVE-2026-81866 | Apache NiFi: Missing Authorization for Assets and Secrets Referenced by Connector Configuration | Low 0.5 | |
| CVE-2026-86089 | Apache NiFi: Missing Process Group Authorization for Connector Migration | Low 2.3 | |
| CVE-2026-86071 | Prior to version 7.6.1, LocalFolderExtractor in src/main/java/com/github/junrar/LocalFolderExtractor.java can create directories outside the intended extraction root when processing a… | Low 3.7 | |
| CVE-2026-73442 | On affected platforms running Arista EOS with VRRP enabled, the peer device VRRP authentication credentials are logged in cleartext on the switch, allowing an authenticated user with sufficient privileges to view agent trace logs (or a system receiving… | Low 2.1 | |
| CVE-2026-85387 | Concrete CMS before 9.5.4 allows a deactivated user to retain OAuth-authenticated REST API access | Low 2.0 | |
| CVE-2026-87031 | Missing authorization in the REST API user creation endpoint in Concrete CMS 9.2.0 through 9.5.3 allows arbitrary account creation | Low 2.1 | |
| CVE-2026-69200 | node-opcua: Prototype Pollution via internal fieldsToJson() implementation (Related to CVE-2024-57086) | Low 3.7 | |
| CVE-2026-92130 | Jenkins Pipeline: Multibranch Plugin 841.vec5b_9e1806ec and earlier does not set the appropriate context for credentials lookup in the resolveScm Pipeline step, allowing attackers with Item/Configure permission to access and capture… | Low 3.1 | |
| CVE-2026-92359 | The… | Low 2.3 | |
| CVE-2026-73440 | On affected platforms running Arista EOS with Simple Network Management Protocol (SNMP) configured, SNMPv3 local or remote user credentials may be exposed as a one-way hashed, localized key value within the device's running and sanitized… | Low 2.3 | |
| CVE-2026-19640 | On affected platforms running Arista EOS, an authenticated user with access to the gNMI (gRPC Network Management Interface) may receive incorrect authorization results, potentially allowing access beyond their currently assigned… | Low 2.3 | |
| CVE-2026-77860 | In NLnetLabs Unbound 1.20.0 up to and including 1.26.0, a vulnerability on the 'serve-expired' code path can cause a double decrement on the 'wait-limit' counter per client IP essentially bypassing one of the counter measures that was… | Low 3.7 | |
| CVE-2026-89328 | The FluentBoards WordPress plugin before 2.0.15 does not properly verify that a user holds board-manager privileges before performing several board-management operations, checking only board membership. | Low 3.8 | |
| CVE-2026-89327 | The FluentBoards WordPress plugin before 2.0.15 does not verify that a board member submitting a comment is the user the comment is attributed to, allowing any board member to post comments that appear to be authored by another user,… | Low 3.8 | |
| CVE-2026-86448 | The LearnPress WordPress plugin before 4.4.7 does not perform any authentication, capability or nonce check before serving a previously generated order export file, allowing unauthenticated attackers who can determine its identifier to… | Low 3.7 | |
| CVE-2026-84907 | The Eventin WordPress plugin before 4.1.24 does not properly authorise order finalisation when its offline (local) payment method is enabled, relying on a nonce that is exposed to unauthenticated visitors and never checking that the… | Low 3.7 | |
| CVE-2026-84905 | The Eventin WordPress plugin before 4.1.24 does not verify a user's capability to create accounts when adding a speaker, allowing users with contributor-level access and above to create new WordPress user accounts that carry capabilities… | Low 2.7 | |
| CVE-2026-82126 | The Schema & Structured Data for WP & AMP WordPress plugin before 1.66 does not check that a user is allowed to edit the specific post they request schema generation for, allowing users with the contributor role and above to obtain the… | Low 2.7 | |
| CVE-2026-91747 | Use after free in Skia in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data via a crafted HTML page. | Low 3.1 | |
| CVE-2026-91730 | Incomplete cleanup in GetUserMedia in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to obtain cross-origin data via a crafted HTML page. | Low 3.1 | |
| CVE-2026-91723 | Race condition in WebAppInstalls in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to spoof UI elements via a crafted HTML page. | Low 3.1 | |
| CVE-2026-91708 | Race condition in Network in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data via a crafted HTML page. | Low 3.1 | |
| CVE-2026-81927 | Concrete CMS before 9.5.3 contained a stored cross-site scripting vulnerability in SVG file handling. | Low 1.8 | |
| CVE-2026-81926 | Concrete CMS 9.4.0 through 9.5.2 did not escape colliding page paths before rendering them in the location panel's duplicate-path confirmation dialog. | Low 2.0 | |
| CVE-2026-18426 | Concrete CMS 9.0.0 through 9.5.2 did not enforce a block-level edit-permission check on the Express Form block's control-management actions, which relied solely on CSRF token validation. | Low 2.0 | |
| CVE-2026-87284 | The supported version that is affected is 7.2.16. | Low 3.2 | |
| CVE-2026-87281 | The supported version that is affected is 7.2.16. | Low 3.2 | |
| CVE-2026-83414 | The supported version that is affected is 15.1.1.0.0. | Low 2.5 | |
| CVE-2026-83413 | Difficult to exploit vulnerability allows high… | Low 1.9 | |
| CVE-2026-83369 | Difficult to exploit vulnerability allows low privileged… | Low 3.1 | |
| CVE-2026-81925 | Concrete CMS before 9.5.3 improperly neutralized a user-supplied custom date format when rendering conversation messages, resulting in reflected cross-site scripting. | Low 2.1 | |
| CVE-2026-18425 | Concrete CMS 9 before 9.5.3 authorized the dashboard sitemap reorder action (Concrete\Controller\Backend\Dashboard\SitemapUpdate) using only the global access_sitemap task permission and did not check per-page edit permission before… | Low 2.1 | |
| CVE-2026-18424 | Concrete CMS 9.0.0 to 9.5.2 is vulnerable to Server-Side Request Forgery iremote file import via cross-port reuse of a host's validated DNS pin. | Low 2.1 | |
| CVE-2026-18423 | Concrete CMS 9.0.0 through 9.5.2 is vulnerable to Insecure direct object reference (IDOR) in the Express saved search preset delete and edit dialogs . | Low 2.1 | |
| CVE-2026-18422 | Concrete CMS before 9.5.3 did not enforce a destination-side authorization check and did not validate a CSRF token in the multilingual page assignment backend action (Backend\Page\Multilingual::assign). | Low 2.1 | |
| CVE-2026-81924 | Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery (CSRF) in the theme page-template activation feature. | Low 2.1 | |
| CVE-2026-81923 | In Concrete CMS before 9.5.3, the SEO Bulk Update Meta Tags editor did not check per-page edit permissions before saving. | Low 2.1 | |
| CVE-2026-81922 | Concrete CMS before 9.5.3 did not enforce a per-page authorization check when reordering pages from the sitemap. | Low 2.1 | |
| CVE-2026-81921 | Concrete CMS 8.5.3 through 9.5.2 enabled the OAuth 2.0 refresh-token grant using the unmodified upstream League grant, which issued new access tokens from a valid refresh token without re-checking the associated account's active status. | Low 2.3 | |
| CVE-2026-81920 | Concrete CMS below 9.5.3 was vulnerable to Cross-Site Request Forgery in the dashboard SEO Excluded Words page. | Low 2.3 | |
| CVE-2026-81919 | Concrete CMS below 9.5.3 did not validate an anti-CSRF token on the block-arrangement backend endpoint (the arrange() action of Concrete\Controller\Backend\Page\ArrangeBlocks). | Low 2.3 | |
| CVE-2026-68534 | Concrete CMS before 9.5.3 rendered Express entry labels as raw HTML when displaying associated entries, resulting in stored cross-site scripting. | Low 2.3 | |
| CVE-2026-68533 | Concrete CMS below 9.5.3 conversation attachment uploaded endpoint imported files into the file manager before evaluating the "Add Message Attachments" permission, which was only checked after the file had been stored. | Low 2.3 | |
| CVE-2026-68532 | Concrete CMS 9.0.0 to dashboard group type controller did not validate a CSRF token on its delete action, resulting in cross-site request forgery. | Low 2.3 |
Showing 501–550 of 11,307. Narrow the filters to see the rest.
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status. Filter by severity and year here; the other filters work on the curated lists.