Vulnerability Intelligence · All CVEs
Every Published CVE, Searchable.
Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status.
Synced hourly · figures as of Oct 20, 2026
126,401 vulnerabilities · newest first
- CVE-2026-102465High 8.2In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x Redis client RESP parser pre-allocates arrays to a length declared by the server without enforcing an upper bound.Published Oct 15, 2026
- CVE-2026-102475High 8.7In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the HTTP proxy provides a body transformer interceptor that relies on a max buffered bytes limit to ensure a bounded buffer for each request.Published Oct 15, 2026
- CVE-2026-102467High 8.7In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the WebSocket implementation does not define a maximum number of bytes allocation when decompressing frames or messages.Published Oct 15, 2026
- CVE-2026-101311High 7.0Multiple vulnerabilities in bhyve device modelsPublished Oct 15, 2026
- CVE-2026-101310High 7.0Multiple vulnerabilities in bhyve device modelsPublished Oct 15, 2026
- CVE-2026-101309High 7.0Multiple vulnerabilities in bhyve device modelsPublished Oct 15, 2026
- CVE-2026-101307High 8.2Remotely triggerable buffer overflow in tcp_rackPublished Oct 15, 2026
- CVE-2026-41544High 8.7Path Traversal leading to Arbitrary File Move, Docker Escape, and Host RCE in /calapi/renameUpload endpointPublished Oct 15, 2026
- CVE-2026-39993High 8.7Path Traversal to Root RCE in QNAP Download Station via Addon/Search addon ParameterPublished Oct 15, 2026
- CVE-2026-101303High 7.5IPv6 UDP sendto(2) bypasses jail loopback restrictionPublished Oct 15, 2026
- CVE-2025-68404High 7.5vcs_pentest Race Condition Authentication Bypass Vulnerability in QuRouter management interfacePublished Oct 15, 2026
- CVE-2025-66275High 7.7Remote code execution via command injectionPublished Oct 15, 2026
- CVE-2025-66272High 7.7Arbitrary file deletion and remote code executionPublished Oct 15, 2026
- CVE-2026-79822High 7.1HPE NonStop TNS/X Native Inspect - Execution flow vulnerabilityPublished Oct 15, 2026
- CVE-2026-101305High 8.8Multiple jail filesystem root escapesPublished Oct 15, 2026
- CVE-2026-101304High 7.1Multiple jail filesystem root escapesPublished Oct 15, 2026
- CVE-2026-81534High 8.8Email Customizer for WooCommerce (Pro) <= 3.9.5 - Authenticated (Subscriber+) Remote Code Execution via 'template' ParameterPublished Oct 15, 2026
- CVE-2026-79821High 8.2HPE NonStop SOAP 4.0 - Memory corruptionPublished Oct 15, 2026
- CVE-2026-58100High 7.0Memory safety bugs in kqueue copy-on-fork implementationPublished Oct 15, 2026
- CVE-2026-58099High 7.0Memory safety bugs in kqueue copy-on-fork implementationPublished Oct 15, 2026
- CVE-2026-88043High 7.2The Mang Board WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data_type' parameter in all versions up to, and including, 2.4.0 due to insufficient input sanitization and output escaping.Published Oct 15, 2026
- CVE-2026-18586High 7.2The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via 'order_email' in all versions up to, and including, 7.0.5 due to insufficient input sanitization…Published Oct 15, 2026
- CVE-2026-18548High 7.2The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ref' parameter in all versions up to, and including, 4.5.14 due to insufficient input sanitization and…Published Oct 15, 2026
- CVE-2026-17031High 8.1The Checkout Field Manager (Checkout Manager) for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.9.6 This is due to the plugin not properly verifying that a user is…Published Oct 15, 2026
- CVE-2026-15090High 7.5The Link Library plugin for WordPress is vulnerable to time-based SQL Injection via the 'link_url' parameter in all versions up to, and including, 7.9.2 due to insufficient escaping on the user supplied parameter and lack of sufficient…Published Oct 15, 2026
- CVE-2026-58098High 8.4Heap out-of-bounds access in semop(2)Published Oct 15, 2026
- CVE-2026-96537High 7.5Tutor LMS < 4.1.1 - Unauthenticated Tutor Page Force-Publish and Content OverwritePublished Oct 15, 2026
- CVE-2026-74920High 7.1Document Gallery <= 5.1.1 - Reflected XSS via data-shortcode AttributePublished Oct 15, 2026
- CVE-2026-76665High 7.1A security vulnerability in HPE NonStop EXPAND may cause out-of-bounds memory read resulting in buffer overflow.Published Oct 15, 2026
- CVE-2026-3712High 7.3The PhastPress plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.10 This is due to the scripts service endpoint constructing its URL whitelist dynamically from the…Published Oct 15, 2026
- CVE-2026-93484High 8.6Znuny through 7.3.6 constructs a ticket-search database query by directly concatenating user-supplied input into the SQL statement.Published Oct 15, 2026
- CVE-2026-110912High 7.1In DragonFly BSD through 6.4.2 before 4bb22ff, the ARP input handlers arpintr() and in_arpinput() (sys/netinet/if_ether.c) do not validate the hardware address length (ar_hln) and protocol address length (ar_pln) fields of incoming ARP packets.dragonflybsd · dragonflybsdPublished Oct 15, 2026
- CVE-2026-110908High 8.8Netgate pfSense FRR package (pfSense-pkg-frr) 2.0.2_1 and source revision 2.1.2_1 contain an OS command injection vulnerability in the FRR status filter.Published Oct 15, 2026
- CVE-2026-77931High 8.7MoviePilot through 3.1.5 contains a command injection vulnerability that allows attackers to execute arbitrary OS commands by embedding malicious instructions in untrusted content processed through tools like browse_webpage, search_web,…Published Oct 15, 2026
- CVE-2026-76661High 7.6A vulnerability in HPE NonStop QIOMON allows an out-of-bounds write that can corrupt buffer data.Published Oct 15, 2026
- CVE-2026-76660High 8.7A vulnerability in HPE NonStop CIPSAM allows an out-of-bounds write that can corrupt buffer data.Published Oct 15, 2026
- CVE-2026-76659High 7.5A vulnerability in the finger daemon of HPE NonStop TCP/IP UTILITIES could allow an unauthenticated remote attacker to cause a denial of service.Published Oct 15, 2026
- CVE-2026-76066High 8.7IntentKit through 2.6.3 contains an authorization bypass vulnerability where the executor validates tool calls against the full tool registry rather than the per-request narrowed tool advertisement enforced by ToolBindingMiddleware,…Published Oct 15, 2026
- CVE-2026-73799High 7.5A security vulnerability in HPE NonStop SNMP Trap Multiplexer may cause memory corruptionPublished Oct 15, 2026
- CVE-2026-109430High 8.7Ellucian WebAdvisor 3.2 contains an unauthenticated XML External Entity (XXE) injection vulnerability that allows remote attackers to submit crafted XML POST requests to the /WebAdvisor/WebAdvisor endpoint without disabling external…Published Oct 15, 2026
- CVE-2026-76663High 7.5HPE NonStop TELSERV - Memory corruption vulnerabilityPublished Oct 15, 2026
- CVE-2026-110907High 7.5Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 mishandles tokens.Published Oct 15, 2026
- CVE-2026-0993High 8.7SODOLA SL902-SWTGW124AS firmware before 200.2.12 contains a buffer overflow vulnerability that allows unauthenticated remote attackers to cause a denial of service by sending an oversized boundary value in the Content-Type header of a…Published Oct 15, 2026
- CVE-2026-95179High 7.5An issue in lottie-android 6.7.1 and earlier (and master) allows a remote attacker to cause a denial of service via a crafted Lottie animation JSON containing a cyclic precomposition reference graph that triggers uncontrolled recursion in…Published Oct 15, 2026
- CVE-2026-95155High 7.5FasterXML Jackson 1.x, confirmed in jackson-mapper-asl versions 1.8.3, 1.9.2, 1.9.11, 1.9.12, and 1.9.13, allows attackers to cause a denial of service by supplying deeply nested JSON input to an application that deserializes untrusted…Published Oct 15, 2026
- CVE-2026-88753High 7.5A Regular-Expression Denial of Service (ReDoS) in the Markdown2.Published Oct 15, 2026
- CVE-2026-106708High 8.8XXL-JOB 3.5.0-SNAPSHOT and earlier contains a Cross-Site Request Forgery (CSRF) vulnerability in the user management controller (JobUserController).Published Oct 15, 2026
- CVE-2026-106700High 8.8ELADMIN v2.7 and earlier contains an improper access control vulnerability in the user-management endpoint PUT /api/users/resetPwd of me.zhengjie.modules.system.rest.UserController.Published Oct 15, 2026
- CVE-2026-110873High 7.1Heym from 0.0.55 before 0.0.121 contains a privilege escalation vulnerability that allows shared collaborators to overwrite a workflow's error_workflow_id because the field is missing from OWNER_ONLY_EXECUTION_FIELDS.Published Oct 14, 2026
- CVE-2026-110872High 8.2Nodemailer from 3.0.0 before 10.0.10 contains a quadratic complexity denial of service vulnerability in the SMTP client reply parser in SMTPConnection._onData and isPartialResponse.Published Oct 14, 2026
| CVE | Title | Severity | Published |
|---|---|---|---|
| CVE-2026-102465 | In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x Redis client RESP parser pre-allocates arrays to a length declared by the server without enforcing an upper bound. | High 8.2 | |
| CVE-2026-102475 | In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the HTTP proxy provides a body transformer interceptor that relies on a max buffered bytes limit to ensure a bounded buffer for each request. | High 8.7 | |
| CVE-2026-102467 | In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the WebSocket implementation does not define a maximum number of bytes allocation when decompressing frames or messages. | High 8.7 | |
| CVE-2026-101311 | Multiple vulnerabilities in bhyve device models | High 7.0 | |
| CVE-2026-101310 | Multiple vulnerabilities in bhyve device models | High 7.0 | |
| CVE-2026-101309 | Multiple vulnerabilities in bhyve device models | High 7.0 | |
| CVE-2026-101307 | Remotely triggerable buffer overflow in tcp_rack | High 8.2 | |
| CVE-2026-41544 | Path Traversal leading to Arbitrary File Move, Docker Escape, and Host RCE in /calapi/renameUpload endpoint | High 8.7 | |
| CVE-2026-39993 | Path Traversal to Root RCE in QNAP Download Station via Addon/Search addon Parameter | High 8.7 | |
| CVE-2026-101303 | IPv6 UDP sendto(2) bypasses jail loopback restriction | High 7.5 | |
| CVE-2025-68404 | vcs_pentest Race Condition Authentication Bypass Vulnerability in QuRouter management interface | High 7.5 | |
| CVE-2025-66275 | Remote code execution via command injection | High 7.7 | |
| CVE-2025-66272 | Arbitrary file deletion and remote code execution | High 7.7 | |
| CVE-2026-79822 | HPE NonStop TNS/X Native Inspect - Execution flow vulnerability | High 7.1 | |
| CVE-2026-101305 | Multiple jail filesystem root escapes | High 8.8 | |
| CVE-2026-101304 | Multiple jail filesystem root escapes | High 7.1 | |
| CVE-2026-81534 | Email Customizer for WooCommerce (Pro) <= 3.9.5 - Authenticated (Subscriber+) Remote Code Execution via 'template' Parameter | High 8.8 | |
| CVE-2026-79821 | HPE NonStop SOAP 4.0 - Memory corruption | High 8.2 | |
| CVE-2026-58100 | Memory safety bugs in kqueue copy-on-fork implementation | High 7.0 | |
| CVE-2026-58099 | Memory safety bugs in kqueue copy-on-fork implementation | High 7.0 | |
| CVE-2026-88043 | The Mang Board WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data_type' parameter in all versions up to, and including, 2.4.0 due to insufficient input sanitization and output escaping. | High 7.2 | |
| CVE-2026-18586 | The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via 'order_email' in all versions up to, and including, 7.0.5 due to insufficient input sanitization… | High 7.2 | |
| CVE-2026-18548 | The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ref' parameter in all versions up to, and including, 4.5.14 due to insufficient input sanitization and… | High 7.2 | |
| CVE-2026-17031 | The Checkout Field Manager (Checkout Manager) for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.9.6 This is due to the plugin not properly verifying that a user is… | High 8.1 | |
| CVE-2026-15090 | The Link Library plugin for WordPress is vulnerable to time-based SQL Injection via the 'link_url' parameter in all versions up to, and including, 7.9.2 due to insufficient escaping on the user supplied parameter and lack of sufficient… | High 7.5 | |
| CVE-2026-58098 | Heap out-of-bounds access in semop(2) | High 8.4 | |
| CVE-2026-96537 | Tutor LMS < 4.1.1 - Unauthenticated Tutor Page Force-Publish and Content Overwrite | High 7.5 | |
| CVE-2026-74920 | Document Gallery <= 5.1.1 - Reflected XSS via data-shortcode Attribute | High 7.1 | |
| CVE-2026-76665 | A security vulnerability in HPE NonStop EXPAND may cause out-of-bounds memory read resulting in buffer overflow. | High 7.1 | |
| CVE-2026-3712 | The PhastPress plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.10 This is due to the scripts service endpoint constructing its URL whitelist dynamically from the… | High 7.3 | |
| CVE-2026-93484 | Znuny through 7.3.6 constructs a ticket-search database query by directly concatenating user-supplied input into the SQL statement. | High 8.6 | |
| CVE-2026-110912 | In DragonFly BSD through 6.4.2 before 4bb22ff, the ARP input handlers arpintr() and in_arpinput() (sys/netinet/if_ether.c) do not validate the hardware address length (ar_hln) and protocol address length (ar_pln) fields of incoming ARP packets. dragonflybsd · dragonflybsd | High 7.1 | |
| CVE-2026-110908 | Netgate pfSense FRR package (pfSense-pkg-frr) 2.0.2_1 and source revision 2.1.2_1 contain an OS command injection vulnerability in the FRR status filter. | High 8.8 | |
| CVE-2026-77931 | MoviePilot through 3.1.5 contains a command injection vulnerability that allows attackers to execute arbitrary OS commands by embedding malicious instructions in untrusted content processed through tools like browse_webpage, search_web,… | High 8.7 | |
| CVE-2026-76661 | A vulnerability in HPE NonStop QIOMON allows an out-of-bounds write that can corrupt buffer data. | High 7.6 | |
| CVE-2026-76660 | A vulnerability in HPE NonStop CIPSAM allows an out-of-bounds write that can corrupt buffer data. | High 8.7 | |
| CVE-2026-76659 | A vulnerability in the finger daemon of HPE NonStop TCP/IP UTILITIES could allow an unauthenticated remote attacker to cause a denial of service. | High 7.5 | |
| CVE-2026-76066 | IntentKit through 2.6.3 contains an authorization bypass vulnerability where the executor validates tool calls against the full tool registry rather than the per-request narrowed tool advertisement enforced by ToolBindingMiddleware,… | High 8.7 | |
| CVE-2026-73799 | A security vulnerability in HPE NonStop SNMP Trap Multiplexer may cause memory corruption | High 7.5 | |
| CVE-2026-109430 | Ellucian WebAdvisor 3.2 contains an unauthenticated XML External Entity (XXE) injection vulnerability that allows remote attackers to submit crafted XML POST requests to the /WebAdvisor/WebAdvisor endpoint without disabling external… | High 8.7 | |
| CVE-2026-76663 | HPE NonStop TELSERV - Memory corruption vulnerability | High 7.5 | |
| CVE-2026-110907 | Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 mishandles tokens. | High 7.5 | |
| CVE-2026-0993 | SODOLA SL902-SWTGW124AS firmware before 200.2.12 contains a buffer overflow vulnerability that allows unauthenticated remote attackers to cause a denial of service by sending an oversized boundary value in the Content-Type header of a… | High 8.7 | |
| CVE-2026-95179 | An issue in lottie-android 6.7.1 and earlier (and master) allows a remote attacker to cause a denial of service via a crafted Lottie animation JSON containing a cyclic precomposition reference graph that triggers uncontrolled recursion in… | High 7.5 | |
| CVE-2026-95155 | FasterXML Jackson 1.x, confirmed in jackson-mapper-asl versions 1.8.3, 1.9.2, 1.9.11, 1.9.12, and 1.9.13, allows attackers to cause a denial of service by supplying deeply nested JSON input to an application that deserializes untrusted… | High 7.5 | |
| CVE-2026-88753 | A Regular-Expression Denial of Service (ReDoS) in the Markdown2. | High 7.5 | |
| CVE-2026-106708 | XXL-JOB 3.5.0-SNAPSHOT and earlier contains a Cross-Site Request Forgery (CSRF) vulnerability in the user management controller (JobUserController). | High 8.8 | |
| CVE-2026-106700 | ELADMIN v2.7 and earlier contains an improper access control vulnerability in the user-management endpoint PUT /api/users/resetPwd of me.zhengjie.modules.system.rest.UserController. | High 8.8 | |
| CVE-2026-110873 | Heym from 0.0.55 before 0.0.121 contains a privilege escalation vulnerability that allows shared collaborators to overwrite a workflow's error_workflow_id because the field is missing from OWNER_ONLY_EXECUTION_FIELDS. | High 7.1 | |
| CVE-2026-110872 | Nodemailer from 3.0.0 before 10.0.10 contains a quadratic complexity denial of service vulnerability in the SMTP client reply parser in SMTPConnection._onData and isPartialResponse. | High 8.2 |
Showing 551–600 of 126,401. Narrow the filters to see the rest.
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status. Filter by severity and year here; the other filters work on the curated lists.