Vulnerability Intelligence · All CVEs
Every Published CVE, Searchable.
Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status.
Synced hourly · figures as of Oct 20, 2026
126,401 vulnerabilities · newest first
- CVE-2026-110871High 7.1Nodemailer from 3.0.0 before 10.0.10 contains a denial of service vulnerability in MessageParser.parseHeaders that allows users to exhaust CPU through quadratic header unfolding.Published Oct 14, 2026
- CVE-2026-110869High 8.7Nodemailer 3.0.0 before 10.0.13 has a regular expression denial of service in SMTPConnection._actionEHLO, whose four AUTH mechanism detection regexes contain overlapping whitespace sub-patterns that backtrack quadratically.Published Oct 14, 2026
- CVE-2026-110868High 8.4Renovate before 44.79.0 contains a server-side request forgery vulnerability that allows users to make the shared HTTP client request arbitrary internal URLs via extends presets or customDatasources.Published Oct 14, 2026
- CVE-2026-110865High 7.1Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repository users to evade the allowedHeaders restriction by placing hostRules headers inside shared presets.Published Oct 14, 2026
- CVE-2026-110863High 8.6Better Auth @better-auth/sso from 1.7.0-rc.2 before 1.7.3 contains an authentication bypass vulnerability that allows authenticated users to sign in as other users by registering a personal SSO provider.Published Oct 14, 2026
- CVE-2026-110859High 8.7GitPython before 3.2.0 contains an argument injection vulnerability in Head.checkout() that allows remote attackers to read arbitrary files by supplying a branch name parsed as a git option.Published Oct 14, 2026
- CVE-2026-110857High 7.7GitPython before 3.2.0 contains a remote code execution vulnerability that allows attackers to run commands because Git.ls_remote forwards URLs without check_unsafe_protocols validation.Published Oct 14, 2026
- CVE-2026-110856High 8.7GitPython before 3.2.0 contains a regular expression denial of service vulnerability in the _re_actor_epoch pattern used by parse_actor_and_date on author, committer, and tagger lines.Published Oct 14, 2026
- CVE-2026-110855High 7.1GitPython before 3.2.0 contains an information disclosure vulnerability that allows malicious repositories to expand environment variables via separate_git_dir in Repo._clone(), which omits expand_vars=False when calling Git.polish_url().Published Oct 14, 2026
- CVE-2026-110854High 8.2Parse Server before 8.6.97 and 9.0.0 before 9.10.2-alpha.6 does not handle errors raised while sending verification or password reset emails, causing the server process to exit.Published Oct 14, 2026
- CVE-2026-110853High 7.1n8n before 1.123.83 contains an authorization bypass vulnerability that allows authenticated members to spoof workflow identity by supplying a trusted identifier in Execute Sub-workflow inline JSON mode.Published Oct 14, 2026
- CVE-2026-110850High 7.2n8n before 2.41.4 and 2.42.0 before 2.42.1 does not validate credential ids stored in agent node parameters when an editor saves a shared workflow, because the check inspects only a node's credentials field.Published Oct 14, 2026
- CVE-2026-110849High 7.2n8n before 1.123.83, 2.41.4, and 2.42.1 contains a stored cross-site scripting vulnerability in the file-preview modal, which re-publishes binary data as an unsandboxed same-origin blob URL.Published Oct 14, 2026
- CVE-2026-110847High 7.0n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains a stored cross-site scripting vulnerability in the Chat Trigger hosted-chat page, where insufficiently sanitised customCss values are interpolated into the page as…Published Oct 14, 2026
- CVE-2026-110846High 7.0n8n before 2.41.4 and 2.42.x before 2.42.1 contains a signature bypass in the waiting-webhook endpoint, which selects Send-and-Wait validation before normalising an alternate node reference form.Published Oct 14, 2026
- CVE-2026-110845High 7.7n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains a code execution vulnerability in the Git node Log operation, which fails to strip a repository's local git configuration before invoking an external program.Published Oct 14, 2026
- CVE-2026-110844High 7.2n8n before 1.123.83 contains an authorization bypass vulnerability that allows shared-workflow editors to use credentials they cannot access by embedding them in nested or tool inline sub-workflows.Published Oct 14, 2026
- CVE-2026-110843High 8.2n8n before 2.41.4 and 2.42.x before 2.42.1 contains an uncontrolled resource consumption vulnerability in the unauthenticated OAuth authorize endpoint, which resolves clients by URL path but stores the caller's raw identifier as the…Published Oct 14, 2026
- CVE-2026-110842High 7.7n8n before 2.41.4 and 2.42.x before 2.42.1 contains a prototype pollution vulnerability in the MCP workflow-validation tool, whose interpreter evaluates caller-supplied code in the main process, reads inherited properties, and permits…Published Oct 14, 2026
- CVE-2026-110840High 7.0n8n before 2.41.4 and 2.42.x before 2.42.1 contains an SQL injection vulnerability in version 1 of the Microsoft SQL node, which substitutes Query field expression values directly into SQL text without parameterisation.Published Oct 14, 2026
- CVE-2026-110839High 7.1FreeRDP 3.3.0 before 3.32.0, when built with WINPR_UTILS_IMAGE_JPEG=ON, has a heap-based out-of-bounds write in winpr_convert_from_jpeg because grayscale JPEG buffers are sized from one input component rather than three BGR output…Published Oct 14, 2026
- CVE-2026-110838High 8.7FreeRDP shadow server from 3.0.0 before 3.32.0 dispatches input PDUs during the Confirm Active state before authentication, allowing unauthenticated attackers to inject keyboard input.Published Oct 14, 2026
- CVE-2026-110836High 7.1FreeRDP from 3.0.0 before 3.32.0 contains an infinite loop vulnerability in http_response_recv() that allows malicious gateways to exhaust client CPU via crafted Content-Type headers.Published Oct 14, 2026
- CVE-2026-110834High 7.1FreeRDP from 2.0.0 before 3.32.0 contains a null pointer dereference vulnerability that allows malicious RDP servers to crash clients by sending out-of-lifecycle serial IRPs.Published Oct 14, 2026
- CVE-2026-110833High 8.2FreeRDP from 3.0.0-beta1 before 3.32.0 fails to enforce cumulative or absolute size limits when reassembling RDPDR channel fragments in the proxy.Published Oct 14, 2026
- CVE-2026-110832High 7.1FreeRDP from 2.0.0 before 3.32.0 contains a memory exhaustion vulnerability in wts_read_drdynvc_data_first that allows authenticated clients to force servers to commit large memory allocations.Published Oct 14, 2026
- CVE-2026-110830High 8.2FreeRDP before 3.32.0 fails to close prior serial handles in serial_process_irp_create, allowing a malicious RDP server to exhaust file descriptors.Published Oct 14, 2026
- CVE-2026-110829High 7.1FreeRDP versions from 3.0.0 before 3.32.0 contain a null pointer dereference in the rdpsnd channel when a fragment sets CHANNEL_FLAG_LAST without CHANNEL_FLAG_FIRST.Published Oct 14, 2026
- CVE-2026-107795High 7.5Omada Controller's MSP and OpenAPI certificate/private-key management APIs do not properly enforce administrative authorization, allowing an authenticated user to perform privileged certificate management…Published Oct 14, 2026
- CVE-2026-108337High 7.4An administrator could retrieve the password reset code for any user and take over the account.Published Oct 14, 2026
- CVE-2026-102298High 7.5In Omada Controller MSP mode, the user-confirmation endpoint fails to enforce the required permission check.Published Oct 14, 2026
- CVE-2026-96540High 8.8An improper access control vulnerability has been identified in the SonicWall Network Security Manager (NSM) on-prem in export settings, potentially allowing a remote authenticated attacker to obtain sensitive information.Published Oct 14, 2026
- CVE-2026-71854High 8.2Prior to version 2.260622.0, on a default installation, the /api/player/ lessons endpoints can be…Published Oct 14, 2026
- CVE-2026-61844High 7.1Prior to 3.18.0, FileRise flattens logical folder paths into metadata filenames by replacing separators and spaces with hyphens, so…Published Oct 14, 2026
- CVE-2026-61843High 8.2Prior to 3.18.0, FileRise upload-enabled shared-folder and upload-only links do not reject a destination filename that already exists.Published Oct 14, 2026
- CVE-2026-57492High 7.4Prior to 3.16.0, FileRise treats an empty or missing users.txt file as a fresh installation even after setup previously completed.Published Oct 14, 2026
- CVE-2026-57490High 8.1Prior to 3.16.0, when an administrator has enabled WebDAV, FileRise WebDAV Basic authentication validates only the account username…Published Oct 14, 2026
- CVE-2026-57489High 8.1Prior to 3.16.0, FileRise deployments with AUTH_BYPASS enabled trust the configured reverse-proxy identity header without verifying…Published Oct 14, 2026
- CVE-2026-104108High 8.1Prior to 3.23.0, FileRise maps an authenticated OIDC identity to a local account using mutable preferred_username or email claims and…Published Oct 14, 2026
- CVE-2026-103977High 8.1Prior to 3.23.0, FileRise stores failed TOTP verification attempts in $_SESSION.Published Oct 14, 2026
- CVE-2026-100232High 7.2Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SonicWall Network Security Manager (NSM) on-prem which in specific conditions could…Published Oct 14, 2026
- CVE-2026-55682High 8.1Prior to 3.8.6, the auto-prepended web/html/seguranca/sessionStart.php reflects an attacker-supplied PHPSESSID cookie in a Set-Cookie response and uses DB_HOST as the cookie domain.Published Oct 14, 2026
- CVE-2026-55681High 8.8Prior to 3.8.6, an authenticated user with access to the Material & Patrimônio module can submit id_produto to web/html/matPat/restaurar_produto_desocultar.php, where a second…Published Oct 14, 2026
- CVE-2026-55387High 7.2In version 2.3.3 and earlier, InvoiceShelf bulk-delete request validation accepts record identifiers…Published Oct 14, 2026
- CVE-2026-55383High 8.2Prior to version 2.4.0, InvoiceShelf public customer invoice, estimate, and payment routes use an EmailLog…Published Oct 14, 2026
- CVE-2026-55382High 7.6Prior to version 2.4.0, InvoiceShelf NotesController::show, NotesController::update, and…Published Oct 14, 2026
- CVE-2026-55381High 7.1Prior to version 2.4.0, POST /api/v1/estimates/{estimate}/convert-to-invoice in ConvertEstimateController…Published Oct 14, 2026
- CVE-2026-102986High 8.1In 1.3.1 and earlier, EntityAssetEndpoint at the public project asset endpoint /api/public/assets/v2/anchor/{anchor}/ requires authentication for write operations but does not verify…Published Oct 14, 2026
- CVE-2026-55386High 7.1Prior to version 2.4.0, InvoiceShelf passes the authenticated user's orderByField query parameter into…Published Oct 14, 2026
- CVE-2026-73261High 7.5Prior to 7.23, the built-in TCP/IP stack enabled by MG_ENABLE_TCPIP in src/net_builtin.c does not reject a TCP option whose declared opts[1] length exceeds the remaining option bytes.Published Oct 14, 2026
| CVE | Title | Severity | Published |
|---|---|---|---|
| CVE-2026-110871 | Nodemailer from 3.0.0 before 10.0.10 contains a denial of service vulnerability in MessageParser.parseHeaders that allows users to exhaust CPU through quadratic header unfolding. | High 7.1 | |
| CVE-2026-110869 | Nodemailer 3.0.0 before 10.0.13 has a regular expression denial of service in SMTPConnection._actionEHLO, whose four AUTH mechanism detection regexes contain overlapping whitespace sub-patterns that backtrack quadratically. | High 8.7 | |
| CVE-2026-110868 | Renovate before 44.79.0 contains a server-side request forgery vulnerability that allows users to make the shared HTTP client request arbitrary internal URLs via extends presets or customDatasources. | High 8.4 | |
| CVE-2026-110865 | Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repository users to evade the allowedHeaders restriction by placing hostRules headers inside shared presets. | High 7.1 | |
| CVE-2026-110863 | Better Auth @better-auth/sso from 1.7.0-rc.2 before 1.7.3 contains an authentication bypass vulnerability that allows authenticated users to sign in as other users by registering a personal SSO provider. | High 8.6 | |
| CVE-2026-110859 | GitPython before 3.2.0 contains an argument injection vulnerability in Head.checkout() that allows remote attackers to read arbitrary files by supplying a branch name parsed as a git option. | High 8.7 | |
| CVE-2026-110857 | GitPython before 3.2.0 contains a remote code execution vulnerability that allows attackers to run commands because Git.ls_remote forwards URLs without check_unsafe_protocols validation. | High 7.7 | |
| CVE-2026-110856 | GitPython before 3.2.0 contains a regular expression denial of service vulnerability in the _re_actor_epoch pattern used by parse_actor_and_date on author, committer, and tagger lines. | High 8.7 | |
| CVE-2026-110855 | GitPython before 3.2.0 contains an information disclosure vulnerability that allows malicious repositories to expand environment variables via separate_git_dir in Repo._clone(), which omits expand_vars=False when calling Git.polish_url(). | High 7.1 | |
| CVE-2026-110854 | Parse Server before 8.6.97 and 9.0.0 before 9.10.2-alpha.6 does not handle errors raised while sending verification or password reset emails, causing the server process to exit. | High 8.2 | |
| CVE-2026-110853 | n8n before 1.123.83 contains an authorization bypass vulnerability that allows authenticated members to spoof workflow identity by supplying a trusted identifier in Execute Sub-workflow inline JSON mode. | High 7.1 | |
| CVE-2026-110850 | n8n before 2.41.4 and 2.42.0 before 2.42.1 does not validate credential ids stored in agent node parameters when an editor saves a shared workflow, because the check inspects only a node's credentials field. | High 7.2 | |
| CVE-2026-110849 | n8n before 1.123.83, 2.41.4, and 2.42.1 contains a stored cross-site scripting vulnerability in the file-preview modal, which re-publishes binary data as an unsandboxed same-origin blob URL. | High 7.2 | |
| CVE-2026-110847 | n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains a stored cross-site scripting vulnerability in the Chat Trigger hosted-chat page, where insufficiently sanitised customCss values are interpolated into the page as… | High 7.0 | |
| CVE-2026-110846 | n8n before 2.41.4 and 2.42.x before 2.42.1 contains a signature bypass in the waiting-webhook endpoint, which selects Send-and-Wait validation before normalising an alternate node reference form. | High 7.0 | |
| CVE-2026-110845 | n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains a code execution vulnerability in the Git node Log operation, which fails to strip a repository's local git configuration before invoking an external program. | High 7.7 | |
| CVE-2026-110844 | n8n before 1.123.83 contains an authorization bypass vulnerability that allows shared-workflow editors to use credentials they cannot access by embedding them in nested or tool inline sub-workflows. | High 7.2 | |
| CVE-2026-110843 | n8n before 2.41.4 and 2.42.x before 2.42.1 contains an uncontrolled resource consumption vulnerability in the unauthenticated OAuth authorize endpoint, which resolves clients by URL path but stores the caller's raw identifier as the… | High 8.2 | |
| CVE-2026-110842 | n8n before 2.41.4 and 2.42.x before 2.42.1 contains a prototype pollution vulnerability in the MCP workflow-validation tool, whose interpreter evaluates caller-supplied code in the main process, reads inherited properties, and permits… | High 7.7 | |
| CVE-2026-110840 | n8n before 2.41.4 and 2.42.x before 2.42.1 contains an SQL injection vulnerability in version 1 of the Microsoft SQL node, which substitutes Query field expression values directly into SQL text without parameterisation. | High 7.0 | |
| CVE-2026-110839 | FreeRDP 3.3.0 before 3.32.0, when built with WINPR_UTILS_IMAGE_JPEG=ON, has a heap-based out-of-bounds write in winpr_convert_from_jpeg because grayscale JPEG buffers are sized from one input component rather than three BGR output… | High 7.1 | |
| CVE-2026-110838 | FreeRDP shadow server from 3.0.0 before 3.32.0 dispatches input PDUs during the Confirm Active state before authentication, allowing unauthenticated attackers to inject keyboard input. | High 8.7 | |
| CVE-2026-110836 | FreeRDP from 3.0.0 before 3.32.0 contains an infinite loop vulnerability in http_response_recv() that allows malicious gateways to exhaust client CPU via crafted Content-Type headers. | High 7.1 | |
| CVE-2026-110834 | FreeRDP from 2.0.0 before 3.32.0 contains a null pointer dereference vulnerability that allows malicious RDP servers to crash clients by sending out-of-lifecycle serial IRPs. | High 7.1 | |
| CVE-2026-110833 | FreeRDP from 3.0.0-beta1 before 3.32.0 fails to enforce cumulative or absolute size limits when reassembling RDPDR channel fragments in the proxy. | High 8.2 | |
| CVE-2026-110832 | FreeRDP from 2.0.0 before 3.32.0 contains a memory exhaustion vulnerability in wts_read_drdynvc_data_first that allows authenticated clients to force servers to commit large memory allocations. | High 7.1 | |
| CVE-2026-110830 | FreeRDP before 3.32.0 fails to close prior serial handles in serial_process_irp_create, allowing a malicious RDP server to exhaust file descriptors. | High 8.2 | |
| CVE-2026-110829 | FreeRDP versions from 3.0.0 before 3.32.0 contain a null pointer dereference in the rdpsnd channel when a fragment sets CHANNEL_FLAG_LAST without CHANNEL_FLAG_FIRST. | High 7.1 | |
| CVE-2026-107795 | Omada Controller's MSP and OpenAPI certificate/private-key management APIs do not properly enforce administrative authorization, allowing an authenticated user to perform privileged certificate management… | High 7.5 | |
| CVE-2026-108337 | An administrator could retrieve the password reset code for any user and take over the account. | High 7.4 | |
| CVE-2026-102298 | In Omada Controller MSP mode, the user-confirmation endpoint fails to enforce the required permission check. | High 7.5 | |
| CVE-2026-96540 | An improper access control vulnerability has been identified in the SonicWall Network Security Manager (NSM) on-prem in export settings, potentially allowing a remote authenticated attacker to obtain sensitive information. | High 8.8 | |
| CVE-2026-71854 | Prior to version 2.260622.0, on a default installation, the /api/player/ lessons endpoints can be… | High 8.2 | |
| CVE-2026-61844 | Prior to 3.18.0, FileRise flattens logical folder paths into metadata filenames by replacing separators and spaces with hyphens, so… | High 7.1 | |
| CVE-2026-61843 | Prior to 3.18.0, FileRise upload-enabled shared-folder and upload-only links do not reject a destination filename that already exists. | High 8.2 | |
| CVE-2026-57492 | Prior to 3.16.0, FileRise treats an empty or missing users.txt file as a fresh installation even after setup previously completed. | High 7.4 | |
| CVE-2026-57490 | Prior to 3.16.0, when an administrator has enabled WebDAV, FileRise WebDAV Basic authentication validates only the account username… | High 8.1 | |
| CVE-2026-57489 | Prior to 3.16.0, FileRise deployments with AUTH_BYPASS enabled trust the configured reverse-proxy identity header without verifying… | High 8.1 | |
| CVE-2026-104108 | Prior to 3.23.0, FileRise maps an authenticated OIDC identity to a local account using mutable preferred_username or email claims and… | High 8.1 | |
| CVE-2026-103977 | Prior to 3.23.0, FileRise stores failed TOTP verification attempts in $_SESSION. | High 8.1 | |
| CVE-2026-100232 | Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SonicWall Network Security Manager (NSM) on-prem which in specific conditions could… | High 7.2 | |
| CVE-2026-55682 | Prior to 3.8.6, the auto-prepended web/html/seguranca/sessionStart.php reflects an attacker-supplied PHPSESSID cookie in a Set-Cookie response and uses DB_HOST as the cookie domain. | High 8.1 | |
| CVE-2026-55681 | Prior to 3.8.6, an authenticated user with access to the Material & Patrimônio module can submit id_produto to web/html/matPat/restaurar_produto_desocultar.php, where a second… | High 8.8 | |
| CVE-2026-55387 | In version 2.3.3 and earlier, InvoiceShelf bulk-delete request validation accepts record identifiers… | High 7.2 | |
| CVE-2026-55383 | Prior to version 2.4.0, InvoiceShelf public customer invoice, estimate, and payment routes use an EmailLog… | High 8.2 | |
| CVE-2026-55382 | Prior to version 2.4.0, InvoiceShelf NotesController::show, NotesController::update, and… | High 7.6 | |
| CVE-2026-55381 | Prior to version 2.4.0, POST /api/v1/estimates/{estimate}/convert-to-invoice in ConvertEstimateController… | High 7.1 | |
| CVE-2026-102986 | In 1.3.1 and earlier, EntityAssetEndpoint at the public project asset endpoint /api/public/assets/v2/anchor/{anchor}/ requires authentication for write operations but does not verify… | High 8.1 | |
| CVE-2026-55386 | Prior to version 2.4.0, InvoiceShelf passes the authenticated user's orderByField query parameter into… | High 7.1 | |
| CVE-2026-73261 | Prior to 7.23, the built-in TCP/IP stack enabled by MG_ENABLE_TCPIP in src/net_builtin.c does not reject a TCP option whose declared opts[1] length exceeds the remaining option bytes. | High 7.5 |
Showing 601–650 of 126,401. Narrow the filters to see the rest.
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status. Filter by severity and year here; the other filters work on the curated lists.