Vulnerability Intelligence · All CVEs
Every Published CVE, Searchable.
Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status.
Synced hourly · figures as of Oct 19, 2026
138,423 vulnerabilities · newest first
- CVE-2026-110017Medium 6.4Quick PayPal Payments: Payment Button & Form <= 6.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'form' Shortcode AttributePublished Oct 16, 2026
- CVE-2026-100158Medium 6.4SQL Chart Builder <= 3.0.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via SQL Chart Label (X-axis) via Stored User FieldPublished Oct 16, 2026
- CVE-2026-111458Medium 6.8ssldump Heap Buffer Overflow in FAN/1 X.509 Fingerprint FormattingPublished Oct 16, 2026
- CVE-2026-103481Medium 6.1Gwolle Guestbook <= 5.1.1 - Reflected Cross-Site Scripting via 'permalink' ParameterPublished Oct 16, 2026
- CVE-2026-110019Medium 4.3Bulk Page Generator <= 3.1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Page Creation/Modification/Deletion via 'authorize' Parameter / Suite OAuth FlowPublished Oct 16, 2026
- CVE-2026-103911Medium 6.5Forminator Forms <= 1.58.1 - Unauthenticated Arbitrary Shortcode Execution via 's' Search Parameter and Anonymous Comment via render_blockPublished Oct 16, 2026
- CVE-2026-109191Medium 4.3Image Hub <= 1.2.0 - Authenticated (Subscriber+) Sensitive Information Exposure in Admin Page HTMLPublished Oct 16, 2026
- CVE-2026-110721Medium 5.3NotificationX <= 3.3.3 - Missing Authorization to Unauthenticated Arbitrary Content Injection via 'nx_id' Parameter on /popup-submit REST RoutePublished Oct 16, 2026
- CVE-2026-111106Medium 6.5Mail Mint <= 1.31.4 - Authenticated (Custom+) SQL Injection via 'filters' ParameterPublished Oct 16, 2026
- CVE-2026-109512Medium 6.4Mang Board <= 2.4.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'content' ParameterPublished Oct 16, 2026
- CVE-2026-101335Medium 6.5Forminator Forms <= 1.58.1 - Unauthenticated Arbitrary Shortcode Execution via 'User-Agent' Header and 'referer_url' Parameter via Quiz Notification Merge TagsPublished Oct 16, 2026
- CVE-2026-96562Medium 6.5Broken Link Checker <= 2.4.14.1 - Unauthenticated Arbitrary Shortcode Execution via parser_callbackPublished Oct 16, 2026
- CVE-2026-111450Medium 5.9Wheels through 4.1.1 derives its default production error-email address from the Host header of the request that starts the application.Published Oct 16, 2026
- CVE-2026-111449Medium 5.9Wheels 3.0.0 through 4.1.1 can disclose detailed exceptions when allowIPBasedDebugAccess=true (disabled by default).Published Oct 16, 2026
- CVE-2026-89280Medium 4.3Dokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 5.2.1 - Insecure Direct Object Reference to Authenticated (Custom+) Limited Account Takeover via 'password' Parameter to…Published Oct 16, 2026
- CVE-2026-104769Medium 5.9CVE-2026-104769Published Oct 16, 2026
- CVE-2026-103518Medium 4.9FluentCart A New Era of eCommerce <= 1.7.0 - Authenticated (Administrator+) SQL Injection via 'products.variants' Array KeysPublished Oct 16, 2026
- CVE-2026-77829Medium 6.4Cooked <= 1.16.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via [cooked-timer] Shortcode ContentPublished Oct 16, 2026
- CVE-2026-93535Medium 6.4WP Dark Mode – Improve Accessibility with AI Powered Dark Theme <= 5.3.17 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon_light' Shortcode AttributePublished Oct 16, 2026
- CVE-2026-111443Medium 6.5Wheels 4.0.6 through 4.1.2 lets an unauthenticated client switch a request into a separate test application context, including in production, by supplying an X-Wheels-Test-Context header or WHEELS_TEST_CONTEXT cookie with any value, or…Published Oct 16, 2026
- CVE-2026-109812Medium 6.9A missing authorization vulnerability exists in the internal API /api/v1/secrets/ of some of Moxa's industrial computing products.Published Oct 16, 2026
- CVE-2026-100159Medium 4.8The Popup Box plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions 6.4.1 to 6.4.2.Published Oct 16, 2026
- CVE-2026-111442Medium 5.3Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 does not sufficiently validate uploaded SVG images to ensure they lack potentially dangerous SVG tags.Published Oct 16, 2026
- CVE-2026-111388Medium 5.3Frappe before 16.33.0 restrict_ip Allowlist Bypass via API Key, OAuth AuthenticationPublished Oct 16, 2026
- CVE-2026-111386Medium 5.3Nezha 1.7.0 before 2.3.15 Cross-Tenant Server-ID Enumeration via getServerConfigPublished Oct 16, 2026
- CVE-2026-111385Medium 6.3Nezha 2.1.0 before 2.3.15 Host Header Injection via MCP Transfer ToolsPublished Oct 16, 2026
- CVE-2026-111375Medium 6.3FreeRDP 3.0.0 before 3.32.0 Out-of-Bounds Read via RAIL Window TitlePublished Oct 16, 2026
- CVE-2026-111374Medium 6.0FreeRDP from 3.30.0 before 3.32.0 Resource Exhaustion via rdpecam StartStreamsRequestPublished Oct 16, 2026
- CVE-2026-111373Medium 6.9FreeRDP before 3.32.0 NULL Dereference via Zero-Length WebSocket PingPublished Oct 16, 2026
- CVE-2026-111237Medium 4.8Ultralytics FastSAM AutoBackend Model Loading autobackend.py session.get_modelmeta.custom_metadata_map eval injectionPublished Oct 16, 2026
- CVE-2026-92777Medium 5.4A potential vulnerability was reported in some Lenovo Tablets that could allow a user with physical access to an unlocked tablet to bypass device protections and execute arbitrary code.Published Oct 16, 2026
- CVE-2026-89062Medium 6.8A potential out-of-bounds write vulnerability was reported in the Lenovo Energy Management driver that could allow a local authenticated user to cause a blue screen error.Published Oct 16, 2026
- CVE-2026-16755Medium 6.0A potential vulnerability was reported in Lenovo Smart Camera C33, distributed exclusively in the Chinese market, that could allow an unauthorized remote user to disclose sensitive information.Published Oct 16, 2026
- CVE-2026-16754Medium 5.9A potential improper certificate validation vulnerability was reported in Lenovo Smart Camera C33, distributed exclusively in the Chinese market, that could allow an adjacent user to intercept or manipulate network communications.Published Oct 16, 2026
- CVE-2026-111210Medium 6.9A vulnerability was determined in bitcoinj up to 0.17.Published Oct 16, 2026
- CVE-2026-107763Medium 4.3Fastcache by Host.it <= 1.7.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary .htaccess Page-Cache Block Modification via updateSettings() admin_action_update HookPublished Oct 16, 2026
- CVE-2026-96806Medium 5.8The Apache Airflow Keycloak auth manager did not end the session on logout: the logout route revoked the presented token, but KeycloakJWTMiddleware then issued a new, unrevoked token on the same response, so the user stayed logged in.Published Oct 15, 2026
- CVE-2026-94135Medium 4.3The Apache Airflow SFTP provider's deferrable code paths (SFTPTrigger, SFTPHookAsync, SFTPClientPool) disable SSH host-key verification by default unless the connection explicitly sets no_host_key_check to false.Published Oct 15, 2026
- CVE-2026-92228Medium 6.5The Apache Airflow Keycloak provider's multi-team provisioning (_attach_team_permissions) granted every team role global read access to audit logs.Published Oct 15, 2026
- CVE-2026-110917Medium 4.3Memory corruption in SVG in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to read memory via a crafted HTML page.Published Oct 15, 2026
- CVE-2026-110918Medium 4.3Memory corruption in Core in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to read memory via a crafted HTML page.Published Oct 15, 2026
- CVE-2026-111368Medium 6.1ClassroomIO through 1.0.0 IDOR via Course Submission Update, Grade and Delete RoutesPublished Oct 15, 2026
- CVE-2026-111367Medium 6.9BillionMail through 4.9 Forgeable JWTs via Default Signing KeyPublished Oct 15, 2026
- CVE-2026-111358Medium 5.3SendPortal sendportal-core through 4.0.1 Cross-Workspace Tag Attachment via Subscriber FormPublished Oct 15, 2026
- CVE-2026-111355Medium 5.3zhontai Admin.Core through 10.1.0 Authorization Bypass via User and Organization By-ID EndpointsPublished Oct 15, 2026
- CVE-2026-111353Medium 5.3Peppermint through 0.5.5 Missing Authorization via Time-Tracking and Attachment Upload EndpointsPublished Oct 15, 2026
- CVE-2026-111349Medium 6.9Craftplan through 0.7.5 Missing Authorization via CRM Customer JSON:API and GraphQLPublished Oct 15, 2026
- CVE-2026-111348Medium 5.3Likeshop through 3.5.1 IDOR via AfterSale API Refund EndpointsPublished Oct 15, 2026
- CVE-2026-111346Medium 5.3ZenTao PMS through 22.6 Authorization Bypass via action::editCommentPublished Oct 15, 2026
- CVE-2026-111345Medium 5.3Trudesk through 1.2.11 Authorization Bypass via GET /api/v1/messages/conversation/:idPublished Oct 15, 2026
| CVE | Title | Severity | Published |
|---|---|---|---|
| CVE-2026-110017 | Quick PayPal Payments: Payment Button & Form <= 6.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'form' Shortcode Attribute | Medium 6.4 | |
| CVE-2026-100158 | SQL Chart Builder <= 3.0.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via SQL Chart Label (X-axis) via Stored User Field | Medium 6.4 | |
| CVE-2026-111458 | ssldump Heap Buffer Overflow in FAN/1 X.509 Fingerprint Formatting | Medium 6.8 | |
| CVE-2026-103481 | Gwolle Guestbook <= 5.1.1 - Reflected Cross-Site Scripting via 'permalink' Parameter | Medium 6.1 | |
| CVE-2026-110019 | Bulk Page Generator <= 3.1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Page Creation/Modification/Deletion via 'authorize' Parameter / Suite OAuth Flow | Medium 4.3 | |
| CVE-2026-103911 | Forminator Forms <= 1.58.1 - Unauthenticated Arbitrary Shortcode Execution via 's' Search Parameter and Anonymous Comment via render_block | Medium 6.5 | |
| CVE-2026-109191 | Image Hub <= 1.2.0 - Authenticated (Subscriber+) Sensitive Information Exposure in Admin Page HTML | Medium 4.3 | |
| CVE-2026-110721 | NotificationX <= 3.3.3 - Missing Authorization to Unauthenticated Arbitrary Content Injection via 'nx_id' Parameter on /popup-submit REST Route | Medium 5.3 | |
| CVE-2026-111106 | Mail Mint <= 1.31.4 - Authenticated (Custom+) SQL Injection via 'filters' Parameter | Medium 6.5 | |
| CVE-2026-109512 | Mang Board <= 2.4.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'content' Parameter | Medium 6.4 | |
| CVE-2026-101335 | Forminator Forms <= 1.58.1 - Unauthenticated Arbitrary Shortcode Execution via 'User-Agent' Header and 'referer_url' Parameter via Quiz Notification Merge Tags | Medium 6.5 | |
| CVE-2026-96562 | Broken Link Checker <= 2.4.14.1 - Unauthenticated Arbitrary Shortcode Execution via parser_callback | Medium 6.5 | |
| CVE-2026-111450 | Wheels through 4.1.1 derives its default production error-email address from the Host header of the request that starts the application. | Medium 5.9 | |
| CVE-2026-111449 | Wheels 3.0.0 through 4.1.1 can disclose detailed exceptions when allowIPBasedDebugAccess=true (disabled by default). | Medium 5.9 | |
| CVE-2026-89280 | Dokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 5.2.1 - Insecure Direct Object Reference to Authenticated (Custom+) Limited Account Takeover via 'password' Parameter to… | Medium 4.3 | |
| CVE-2026-104769 | CVE-2026-104769 | Medium 5.9 | |
| CVE-2026-103518 | FluentCart A New Era of eCommerce <= 1.7.0 - Authenticated (Administrator+) SQL Injection via 'products.variants' Array Keys | Medium 4.9 | |
| CVE-2026-77829 | Cooked <= 1.16.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via [cooked-timer] Shortcode Content | Medium 6.4 | |
| CVE-2026-93535 | WP Dark Mode – Improve Accessibility with AI Powered Dark Theme <= 5.3.17 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon_light' Shortcode Attribute | Medium 6.4 | |
| CVE-2026-111443 | Wheels 4.0.6 through 4.1.2 lets an unauthenticated client switch a request into a separate test application context, including in production, by supplying an X-Wheels-Test-Context header or WHEELS_TEST_CONTEXT cookie with any value, or… | Medium 6.5 | |
| CVE-2026-109812 | A missing authorization vulnerability exists in the internal API /api/v1/secrets/ of some of Moxa's industrial computing products. | Medium 6.9 | |
| CVE-2026-100159 | The Popup Box plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions 6.4.1 to 6.4.2. | Medium 4.8 | |
| CVE-2026-111442 | Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 does not sufficiently validate uploaded SVG images to ensure they lack potentially dangerous SVG tags. | Medium 5.3 | |
| CVE-2026-111388 | Frappe before 16.33.0 restrict_ip Allowlist Bypass via API Key, OAuth Authentication | Medium 5.3 | |
| CVE-2026-111386 | Nezha 1.7.0 before 2.3.15 Cross-Tenant Server-ID Enumeration via getServerConfig | Medium 5.3 | |
| CVE-2026-111385 | Nezha 2.1.0 before 2.3.15 Host Header Injection via MCP Transfer Tools | Medium 6.3 | |
| CVE-2026-111375 | FreeRDP 3.0.0 before 3.32.0 Out-of-Bounds Read via RAIL Window Title | Medium 6.3 | |
| CVE-2026-111374 | FreeRDP from 3.30.0 before 3.32.0 Resource Exhaustion via rdpecam StartStreamsRequest | Medium 6.0 | |
| CVE-2026-111373 | FreeRDP before 3.32.0 NULL Dereference via Zero-Length WebSocket Ping | Medium 6.9 | |
| CVE-2026-111237 | Ultralytics FastSAM AutoBackend Model Loading autobackend.py session.get_modelmeta.custom_metadata_map eval injection | Medium 4.8 | |
| CVE-2026-92777 | A potential vulnerability was reported in some Lenovo Tablets that could allow a user with physical access to an unlocked tablet to bypass device protections and execute arbitrary code. | Medium 5.4 | |
| CVE-2026-89062 | A potential out-of-bounds write vulnerability was reported in the Lenovo Energy Management driver that could allow a local authenticated user to cause a blue screen error. | Medium 6.8 | |
| CVE-2026-16755 | A potential vulnerability was reported in Lenovo Smart Camera C33, distributed exclusively in the Chinese market, that could allow an unauthorized remote user to disclose sensitive information. | Medium 6.0 | |
| CVE-2026-16754 | A potential improper certificate validation vulnerability was reported in Lenovo Smart Camera C33, distributed exclusively in the Chinese market, that could allow an adjacent user to intercept or manipulate network communications. | Medium 5.9 | |
| CVE-2026-111210 | A vulnerability was determined in bitcoinj up to 0.17. | Medium 6.9 | |
| CVE-2026-107763 | Fastcache by Host.it <= 1.7.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary .htaccess Page-Cache Block Modification via updateSettings() admin_action_update Hook | Medium 4.3 | |
| CVE-2026-96806 | The Apache Airflow Keycloak auth manager did not end the session on logout: the logout route revoked the presented token, but KeycloakJWTMiddleware then issued a new, unrevoked token on the same response, so the user stayed logged in. | Medium 5.8 | |
| CVE-2026-94135 | The Apache Airflow SFTP provider's deferrable code paths (SFTPTrigger, SFTPHookAsync, SFTPClientPool) disable SSH host-key verification by default unless the connection explicitly sets no_host_key_check to false. | Medium 4.3 | |
| CVE-2026-92228 | The Apache Airflow Keycloak provider's multi-team provisioning (_attach_team_permissions) granted every team role global read access to audit logs. | Medium 6.5 | |
| CVE-2026-110917 | Memory corruption in SVG in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to read memory via a crafted HTML page. | Medium 4.3 | |
| CVE-2026-110918 | Memory corruption in Core in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to read memory via a crafted HTML page. | Medium 4.3 | |
| CVE-2026-111368 | ClassroomIO through 1.0.0 IDOR via Course Submission Update, Grade and Delete Routes | Medium 6.1 | |
| CVE-2026-111367 | BillionMail through 4.9 Forgeable JWTs via Default Signing Key | Medium 6.9 | |
| CVE-2026-111358 | SendPortal sendportal-core through 4.0.1 Cross-Workspace Tag Attachment via Subscriber Form | Medium 5.3 | |
| CVE-2026-111355 | zhontai Admin.Core through 10.1.0 Authorization Bypass via User and Organization By-ID Endpoints | Medium 5.3 | |
| CVE-2026-111353 | Peppermint through 0.5.5 Missing Authorization via Time-Tracking and Attachment Upload Endpoints | Medium 5.3 | |
| CVE-2026-111349 | Craftplan through 0.7.5 Missing Authorization via CRM Customer JSON:API and GraphQL | Medium 6.9 | |
| CVE-2026-111348 | Likeshop through 3.5.1 IDOR via AfterSale API Refund Endpoints | Medium 5.3 | |
| CVE-2026-111346 | ZenTao PMS through 22.6 Authorization Bypass via action::editComment | Medium 5.3 | |
| CVE-2026-111345 | Trudesk through 1.2.11 Authorization Bypass via GET /api/v1/messages/conversation/:id | Medium 5.3 |
Showing 501–550 of 138,423. Narrow the filters to see the rest.
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status. Filter by severity and year here; the other filters work on the curated lists.