Vulnerability Intelligence · All CVEs
Every Published CVE, Searchable.
Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status.
Synced hourly · figures as of Oct 20, 2026
40,422 vulnerabilities · newest first
- CVE-2026-96809Critical 9.3WordPress EduAdmin Booking plugin < 6.0.0 - SQL Injection vulnerabilityPublished Oct 9, 2026
- CVE-2026-96331Critical 9.3WordPress Ajax Search Pro plugin <= 4.29.1 - SQL Injection vulnerabilityPublished Oct 9, 2026
- CVE-2026-96330Critical 9.3WordPress tagDiv Opt-In Builder plugin <= 1.7.6 - SQL Injection vulnerabilityPublished Oct 9, 2026
- CVE-2026-96328Critical 9.3WordPress JNews - Pay Writer plugin <= 12.0.1 - SQL Injection vulnerabilityPublished Oct 9, 2026
- CVE-2026-96327Critical 9.3WordPress WPLMS plugin < 1.9.9.8.2 - SQL Injection vulnerabilityPublished Oct 9, 2026
- CVE-2026-86405Critical 9.8Payment Validation Bypass in Sipay Electronic Money's SanalPos PrestaShopPublished Oct 9, 2026
- CVE-2026-107935Critical 9.3Gvisor-tap-vsock: gvisor-tap-vsock: unathenticated arbitrary file deletion on the host via /exposePublished Oct 9, 2026
- CVE-2026-85531Critical 9.8Payment Validation Bypass in Sipay Electronic Money's OpenCart 3.xPublished Oct 9, 2026
- CVE-2026-76779Critical 9.8Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Restriction of Excessive Authentication Attempts vulnerability.Published Oct 9, 2026
- CVE-2026-107910Critical 9.2Authentication bypass in FalkorDB Bolt endpoint via fail-open AUTH probe error handlingPublished Oct 9, 2026
- CVE-2026-107908Critical 9.3Pre-authentication heap out-of-bounds write in FalkorDB Bolt BoltReadHandler via RESET messagePublished Oct 9, 2026
- CVE-2026-7827Critical 9.2Stack-based buffer overflow in FalkorDB _RdbLoadEntity via unbounded property count in crafted RDBPublished Oct 9, 2026
- CVE-2026-5759Critical 9.3Double free and use-after-free in FalkorDB RdbLoadDeletedNodes allows remote code execution via crafted RDBPublished Oct 9, 2026
- CVE-2026-78835Critical 9.8Rocket Software Rocket Remote Desktop 18.0.8583.1 is vulnerable to Insufficiently Protected Credentials.Published Oct 9, 2026
- CVE-2026-78797Critical 9.8An issue in iStoreOS istoreos-24.10.7 and before allows a remote attacker to execute arbitrary code via the task_id in tasks-lib.lua.Published Oct 9, 2026
- CVE-2026-78796Critical 9.8An issue in Netcore B11 Enterprise-level full Gigabit 9-port shop wireless router v1.3.241114.024540 and before allows a remote attacker to execute arbitrary code via the www\cgi-bin\upgrade filePublished Oct 9, 2026
- CVE-2026-78663Critical 9.1Double flow control refund on HTTP/2 server streams in net/httpPublished Oct 8, 2026
- CVE-2026-56857Critical 9.8Root.Mkdir(All) can follow junctions out of the root on Windows in osPublished Oct 8, 2026
- CVE-2026-84249Critical 9.8IBM Guardium Data Protection 12.2, and 12.2.2 could allow a remote attacker to execute arbitrary management operations due to missing authentication for critical function.Published Oct 8, 2026
- CVE-2026-84246Critical 9.8IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a buffer overflow.Published Oct 8, 2026
- CVE-2026-84209Critical 9.8IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command.Published Oct 8, 2026
- CVE-2026-84198Critical 9.8IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a buffer overflow.Published Oct 8, 2026
- CVE-2026-84058Critical 9.8IBM Guardium Data Protection 12.0, 12.1, and 12.2 is vulnerable to a buffer overrun in the TDS (Microsoft SQL Server) PRELOGIN packet decoder.Published Oct 8, 2026
- CVE-2026-84057Critical 9.8IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.Published Oct 8, 2026
- CVE-2026-84035Critical 9.8IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a stack-based buffer overflow.Published Oct 8, 2026
- CVE-2026-82900Critical 9.1IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to delete arbitrary files due to improper limitation of a pathname to a restricted directory.Published Oct 8, 2026
- CVE-2026-82895Critical 9.8IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a buffer overflow.Published Oct 8, 2026
- CVE-2026-81932Critical 9.8IBM Guardium Data Protection 12.0, 12.1, and 12.2 is vulnerable to SQL injection.Published Oct 8, 2026
- CVE-2026-80381Critical 9.8IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute unauthorized SQL statements due to SQL injection.Published Oct 8, 2026
- CVE-2026-75875Critical 9.8IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to path traversal.Published Oct 8, 2026
- CVE-2026-107726Critical 9.3Prior to 5.4.5, 5.5.10, and 5.6.1, improper validation of data supplied by a malicious client able to connect to a cluster allows arbitrary…Published Oct 8, 2026
- CVE-2026-107722Critical 9.8fast-jwt provides fast JSON Web Token (JWT) implementation.Published Oct 8, 2026
- CVE-2026-107406Critical 9.5Memory overflow vulnerability leading to Remote Code Execution or Denial of Service Vulnerability in NetScaler ADC.Published Oct 8, 2026
- CVE-2026-96207Critical 10.0Microsoft Partner Center Elevation of Privilege VulnerabilityPublished Oct 8, 2026
- CVE-2026-94510Critical 9.9Microsoft Bookings Elevation of Privilege VulnerabilityPublished Oct 8, 2026
- CVE-2026-88131Critical 9.8Microsoft Dataverse Remote Code Execution VulnerabilityPublished Oct 8, 2026
- CVE-2026-77900Critical 9.8Azure App Service Remote Code Execution VulnerabilityPublished Oct 8, 2026
- CVE-2026-79842Critical 9.1An authentication bypass vulnerability exists in HPE Intelligent Management Center (iMC) prior to v7.3 E0713Published Oct 8, 2026
- CVE-2026-78406Critical 9.8IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote unauthenticated attacker to execute arbitrary code on the system due to the deserialization of untrusted data.Published Oct 8, 2026
- CVE-2026-78401Critical 9.8IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote unauthenticated attacker to execute arbitrary code on the system due to the deserialization of untrusted data.Published Oct 8, 2026
- CVE-2026-84272Critical 9.8IBM Guardium Data Protection 12.1 and 12.2.2 are vulnerable to missing authentication in the edge-controller component.Published Oct 8, 2026
- CVE-2026-82344Critical 9.8IBM Guardium Data Protection 12.0, 12.1 is vulnerable to a heap-based buffer overflow in the S-TAP TrafficTap TDS login reassembly functionality.Published Oct 8, 2026
- CVE-2026-82335Critical 9.8IBM Guardium Data Protection 12.0, 12.1, 12.2 is vulnerable to a heap-based buffer overflow in the MongoDB protocol parser.Published Oct 8, 2026
- CVE-2026-82334Critical 9.1IBM Guardium Data Protection 12.0, 12.1, 12.2 is vulnerable to a heap-based out-of-bounds read in the TDS7 LOGIN7 protocol parser.Published Oct 8, 2026
- CVE-2026-107781Critical 9.1Dromara Skyeye Unauthenticated SSRF and File Overwrite via editUploadOfficeFileByIdPublished Oct 8, 2026
- CVE-2026-107780Critical 9.3Dromara Skyeye Unauthenticated OS Command Injection via textToSpeech format ParameterPublished Oct 8, 2026
- CVE-2026-107779Critical 9.3Dromara Skyeye xxl-job-admin Missing Authentication on Job Endpoints Allows RCEPublished Oct 8, 2026
- CVE-2026-106126Critical 9.4CVE-2026-106126Published Oct 8, 2026
- CVE-2026-104076Critical 9.3TVU Networks Receiver/Transceiver Missing Authentication via REST APIPublished Oct 8, 2026
- CVE-2026-104075Critical 9.3TVU Networks Receiver/Transceiver Authentication Bypass via /tvu/LoginPublished Oct 8, 2026
| CVE | Title | Severity | Published |
|---|---|---|---|
| CVE-2026-96809 | WordPress EduAdmin Booking plugin < 6.0.0 - SQL Injection vulnerability | Critical 9.3 | |
| CVE-2026-96331 | WordPress Ajax Search Pro plugin <= 4.29.1 - SQL Injection vulnerability | Critical 9.3 | |
| CVE-2026-96330 | WordPress tagDiv Opt-In Builder plugin <= 1.7.6 - SQL Injection vulnerability | Critical 9.3 | |
| CVE-2026-96328 | WordPress JNews - Pay Writer plugin <= 12.0.1 - SQL Injection vulnerability | Critical 9.3 | |
| CVE-2026-96327 | WordPress WPLMS plugin < 1.9.9.8.2 - SQL Injection vulnerability | Critical 9.3 | |
| CVE-2026-86405 | Payment Validation Bypass in Sipay Electronic Money's SanalPos PrestaShop | Critical 9.8 | |
| CVE-2026-107935 | Gvisor-tap-vsock: gvisor-tap-vsock: unathenticated arbitrary file deletion on the host via /expose | Critical 9.3 | |
| CVE-2026-85531 | Payment Validation Bypass in Sipay Electronic Money's OpenCart 3.x | Critical 9.8 | |
| CVE-2026-76779 | Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Restriction of Excessive Authentication Attempts vulnerability. | Critical 9.8 | |
| CVE-2026-107910 | Authentication bypass in FalkorDB Bolt endpoint via fail-open AUTH probe error handling | Critical 9.2 | |
| CVE-2026-107908 | Pre-authentication heap out-of-bounds write in FalkorDB Bolt BoltReadHandler via RESET message | Critical 9.3 | |
| CVE-2026-7827 | Stack-based buffer overflow in FalkorDB _RdbLoadEntity via unbounded property count in crafted RDB | Critical 9.2 | |
| CVE-2026-5759 | Double free and use-after-free in FalkorDB RdbLoadDeletedNodes allows remote code execution via crafted RDB | Critical 9.3 | |
| CVE-2026-78835 | Rocket Software Rocket Remote Desktop 18.0.8583.1 is vulnerable to Insufficiently Protected Credentials. | Critical 9.8 | |
| CVE-2026-78797 | An issue in iStoreOS istoreos-24.10.7 and before allows a remote attacker to execute arbitrary code via the task_id in tasks-lib.lua. | Critical 9.8 | |
| CVE-2026-78796 | An issue in Netcore B11 Enterprise-level full Gigabit 9-port shop wireless router v1.3.241114.024540 and before allows a remote attacker to execute arbitrary code via the www\cgi-bin\upgrade file | Critical 9.8 | |
| CVE-2026-78663 | Double flow control refund on HTTP/2 server streams in net/http | Critical 9.1 | |
| CVE-2026-56857 | Root.Mkdir(All) can follow junctions out of the root on Windows in os | Critical 9.8 | |
| CVE-2026-84249 | IBM Guardium Data Protection 12.2, and 12.2.2 could allow a remote attacker to execute arbitrary management operations due to missing authentication for critical function. | Critical 9.8 | |
| CVE-2026-84246 | IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a buffer overflow. | Critical 9.8 | |
| CVE-2026-84209 | IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command. | Critical 9.8 | |
| CVE-2026-84198 | IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a buffer overflow. | Critical 9.8 | |
| CVE-2026-84058 | IBM Guardium Data Protection 12.0, 12.1, and 12.2 is vulnerable to a buffer overrun in the TDS (Microsoft SQL Server) PRELOGIN packet decoder. | Critical 9.8 | |
| CVE-2026-84057 | IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command. | Critical 9.8 | |
| CVE-2026-84035 | IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a stack-based buffer overflow. | Critical 9.8 | |
| CVE-2026-82900 | IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to delete arbitrary files due to improper limitation of a pathname to a restricted directory. | Critical 9.1 | |
| CVE-2026-82895 | IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a buffer overflow. | Critical 9.8 | |
| CVE-2026-81932 | IBM Guardium Data Protection 12.0, 12.1, and 12.2 is vulnerable to SQL injection. | Critical 9.8 | |
| CVE-2026-80381 | IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute unauthorized SQL statements due to SQL injection. | Critical 9.8 | |
| CVE-2026-75875 | IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to path traversal. | Critical 9.8 | |
| CVE-2026-107726 | Prior to 5.4.5, 5.5.10, and 5.6.1, improper validation of data supplied by a malicious client able to connect to a cluster allows arbitrary… | Critical 9.3 | |
| CVE-2026-107722 | fast-jwt provides fast JSON Web Token (JWT) implementation. | Critical 9.8 | |
| CVE-2026-107406 | Memory overflow vulnerability leading to Remote Code Execution or Denial of Service Vulnerability in NetScaler ADC. | Critical 9.5 | |
| CVE-2026-96207 | Microsoft Partner Center Elevation of Privilege Vulnerability | Critical 10.0 | |
| CVE-2026-94510 | Microsoft Bookings Elevation of Privilege Vulnerability | Critical 9.9 | |
| CVE-2026-88131 | Microsoft Dataverse Remote Code Execution Vulnerability | Critical 9.8 | |
| CVE-2026-77900 | Azure App Service Remote Code Execution Vulnerability | Critical 9.8 | |
| CVE-2026-79842 | An authentication bypass vulnerability exists in HPE Intelligent Management Center (iMC) prior to v7.3 E0713 | Critical 9.1 | |
| CVE-2026-78406 | IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote unauthenticated attacker to execute arbitrary code on the system due to the deserialization of untrusted data. | Critical 9.8 | |
| CVE-2026-78401 | IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote unauthenticated attacker to execute arbitrary code on the system due to the deserialization of untrusted data. | Critical 9.8 | |
| CVE-2026-84272 | IBM Guardium Data Protection 12.1 and 12.2.2 are vulnerable to missing authentication in the edge-controller component. | Critical 9.8 | |
| CVE-2026-82344 | IBM Guardium Data Protection 12.0, 12.1 is vulnerable to a heap-based buffer overflow in the S-TAP TrafficTap TDS login reassembly functionality. | Critical 9.8 | |
| CVE-2026-82335 | IBM Guardium Data Protection 12.0, 12.1, 12.2 is vulnerable to a heap-based buffer overflow in the MongoDB protocol parser. | Critical 9.8 | |
| CVE-2026-82334 | IBM Guardium Data Protection 12.0, 12.1, 12.2 is vulnerable to a heap-based out-of-bounds read in the TDS7 LOGIN7 protocol parser. | Critical 9.1 | |
| CVE-2026-107781 | Dromara Skyeye Unauthenticated SSRF and File Overwrite via editUploadOfficeFileById | Critical 9.1 | |
| CVE-2026-107780 | Dromara Skyeye Unauthenticated OS Command Injection via textToSpeech format Parameter | Critical 9.3 | |
| CVE-2026-107779 | Dromara Skyeye xxl-job-admin Missing Authentication on Job Endpoints Allows RCE | Critical 9.3 | |
| CVE-2026-106126 | CVE-2026-106126 | Critical 9.4 | |
| CVE-2026-104076 | TVU Networks Receiver/Transceiver Missing Authentication via REST API | Critical 9.3 | |
| CVE-2026-104075 | TVU Networks Receiver/Transceiver Authentication Bypass via /tvu/Login | Critical 9.3 |
Showing 551–600 of 40,422. Narrow the filters to see the rest.
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status. Filter by severity and year here; the other filters work on the curated lists.