Vulnerability Intelligence · All CVEs
Every Published CVE, Searchable.
Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status.
Synced hourly · figures as of Oct 20, 2026
11,307 vulnerabilities · newest first
- CVE-2026-33966Low 2.8An information Leak occurs in the camera driver due to Insertion of Sensitive Information Into Debugging Code.Published Sep 14, 2026
- CVE-2026-33962Low 2.8A malformed Netlink command can trigger an out-of-bounds read, potentially leading to information leakage.Published Sep 14, 2026
- CVE-2026-33960Low 2.8.Published Sep 14, 2026
- CVE-2026-33956Low 2.8Sending a malformed message to the test_msg sysfs entry causes an out-of-bounds write, leading to denial of service.Published Sep 14, 2026
- CVE-2026-23793Low 3.5An out-of-bounds memory access vulnerability in the camera GDC driver may lead to kernel memory corruption under certain conditions.Published Sep 14, 2026
- CVE-2026-23786Low 2.8A TOCTOU race condition in the Exynos DRM HDR Driver leads to a heap overflow, causing a kernel crash.Published Sep 14, 2026
- CVE-2025-64031Low 2.5libarchive 3.8.x before 3.8.2 has a strcpy heap-based buffer overflow in the gzip writer via the original-filename field to archive_compressor_gzip_open in archive_write_add_filter_gzip.c, aka GHSA-92wx-p669-8gr9.Published Sep 14, 2026
- CVE-2026-35867Low 3.1A Command Injection vulnerability exists in the bs_SetLimitCli_info function within the libshare.so library of the LB-LINK router AC1900_AZ2 V1.0.2 via shell metacharacters, if the device is deployed in a scenario where an actor is able…Published Sep 13, 2026
- CVE-2026-38332Low 2.9TinyEXIF before 1.1.0 has a heap-based buffer over-read in EntryParser::Fetch methods reachable via a crafted SubjectArea length.Published Sep 13, 2026
- CVE-2025-70820Low 3.5Zettlab D6 Ultra before 1.7.0 allows absolute path traversal to reach folders other than the personal folder.Published Sep 13, 2026
- CVE-2025-64059Low 1.8Grav 1.7.50.2 allows admins to enter JavaScript via the Home Page editor.Published Sep 13, 2026
- CVE-2025-45480Low 3.0Floodlight 71fe8a7 allows disruption of host communication via link spoofing.Published Sep 13, 2026
- CVE-2026-90773Low 2.4procs through 0.14.12 fails to sanitize escape sequences in process command lines before displaying them in the Command column.Published Sep 13, 2026
- CVE-2026-90506Low 2.3A vulnerability was determined in vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae86411051b46.Published Sep 13, 2026
- CVE-2026-90505Low 2.3The manipulation results in race condition.Published Sep 13, 2026
- CVE-2026-86407Low 3.7The User Registration & Membership WordPress plugin before 5.2.8 does not verify that the visitor requesting its membership confirmation page owns the account named in the request, nor that any registration or purchase has taken place,…Published Sep 13, 2026
- CVE-2026-79300Low 3.5SEP sesam before 5.2.0.24 mishandles User Authorization with MFA.Published Sep 12, 2026
- CVE-2026-84025Low 2.2The BEAR WordPress plugin before 1.2.2 does not perform ownership checks on several handlers that return product data by a user-supplied identifier, allowing users who are restricted to their own products to read other owners' product…Published Sep 12, 2026
- CVE-2026-82851Low 2.7The Masteriyo LMS WordPress plugin before 3.4.1 does not verify ownership of, or restrict the type of, the records a user requests for download, allowing users with the instructor role to retrieve the full content and metadata of…Published Sep 12, 2026
- CVE-2026-11765Low 3.3Improper neutralization of argument delimiters in a command ('argument injection') vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus Pen allows Argument Injection.Published Sep 11, 2026
- CVE-2026-86779Low 2.7The Visualizer WordPress plugin before 4.0.6 does not properly authorise chart-deletion requests, performing only a site-wide capability check with no per-object ownership verification, allowing users with the Contributor role and above…Published Sep 11, 2026
- CVE-2025-15695Low 3.5The Translate WordPress with GTranslate WordPress plugin before 3.0.10 does not validate one of its settings before the bundled front-end scripts build markup from it, allowing users with a role as high as administrator to store…Published Sep 11, 2026
- CVE-2026-89162Low 3.3In PCRE2 before 10.48, pcre2_serialize_encode might disclose two bytes to an adversary, typically in a situation where the access available to the adversary is already unsafe.Published Sep 11, 2026
- CVE-2026-89151Low 3.5Forgejo before 16.0.4 allows use of restricted API tokens for unintended access to the "allow maintainer edit" feature.Published Sep 11, 2026
- CVE-2026-89145Low 2.4Flextype CMS versions 0.9.9 through 1.0.0-alpha.3 fail to HTML-escape plugin directory names in the dependency error page rendered by getValidPluginsDependencies().Published Sep 11, 2026
- CVE-2026-78131Low 3.7strongSwan 4.2.0 through 6.0.7 has a missing release of memory after its effective lifetime in the x509 plugin's attribute certificate parser.Published Sep 11, 2026
- CVE-2026-78127Low 3.7libcharon in strongSwan 4.1.2 through 6.0.7 has a missing release of memory after its effective lifetime in the IKE message parser.Published Sep 11, 2026
- CVE-2026-78124Low 3.7strongSwan 5.0.2 through 6.0.7 allows PKCS#7 certificate enumeration in the openssl plugin that leads to a lack of release of memory after its effective lifetime.Published Sep 11, 2026
- CVE-2026-15418Low 2.4In the silabser.sys driver for CP210x devices v11.5.0 and earlier, a local unprivileged user with a malicious device can use malformed packets to leak up to 145 bytes of uninitialized kernel pool memory.Published Sep 10, 2026
- CVE-2026-88790Low 2.4A security vulnerability has been detected in proma-ai Proma up to 0.19.37.Published Sep 10, 2026
- CVE-2026-0303Low 2.4A code execution vulnerability in Palo Alto Networks Checkov by Prisma® Cloud can allow arbitrary code execution when Checkov scans a directory that contains an attacker-controlled configuration file.Published Sep 10, 2026
- CVE-2026-0302Low 1.1An OS command injection vulnerability in Palo Alto Networks Checkov by Prisma® Cloud enables a local user to execute arbitrary commands in the processes running Checkov.Published Sep 10, 2026
- CVE-2026-0308Low 1.1A stored cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS® software enables a malicious authenticated administrator to store or execute a JavaScript payload using the web interface.Published Sep 10, 2026
- CVE-2025-24978Low 3.7LF Edge eKuiper: Self-XSS in External Service CreationPublished Sep 9, 2026
- CVE-2026-87876Low 3.0Two case-insensitive comparisons on request-derived usernames outside the main authorization path in CUPS's scheduler (printer ACL validation and private-attribute filtering) could allow bypass of username-based access controls in certain…Published Sep 9, 2026
- CVE-2026-46460Low 3.5Dell PowerScale OneFS, versions 9.5.0.0 through 9.7.1.15, versions 9.8.0.0 through 9.13.1.0, and versions prior to 9.15.0.0, contain an Incorrect Authorization vulnerability.Published Sep 9, 2026
- CVE-2026-79944Low 3.4Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Least Privilege Violation vulnerability.Published Sep 9, 2026
- CVE-2026-79942Low 3.4Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Execution with Unnecessary Privileges vulnerability.Published Sep 9, 2026
- CVE-2026-79693Low 3.4Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Least Privilege Violation vulnerability.Published Sep 9, 2026
- CVE-2026-79736Low 3.7Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Certificate Validation vulnerability.Published Sep 9, 2026
- CVE-2026-79732Low 3.7Dell Secure Connect Gateway (SCG) 5.0 Appliance, versions prior to 5.36.00.xx, contains an Improper Certificate Validation vulnerability.Published Sep 9, 2026
- CVE-2026-79729Low 3.7Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Certificate Validation vulnerability.Published Sep 9, 2026
- CVE-2026-79690Low 3.7Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Certificate Validation vulnerability.Published Sep 9, 2026
- CVE-2026-86744Low 2.1Snipe-IT 8.6.3 and earlier (and develop pre-release commits prior to the fix) contain a race condition in the asset checkout paths.Published Sep 9, 2026
- CVE-2026-86739Low 2.3Snipe-IT 8.6.3 and earlier do not check the return value of Storage::put() when writing the signature PNG and the generated acceptance PDF in Account\AcceptanceController::store().Published Sep 9, 2026
- CVE-2026-86198Low 2.3PocketMine-MP versions before 5.44.2 fail to properly validate multiple ResourcePackClientResponsePacket packets with STATUS_COMPLETED status during resource pack handling.Published Sep 9, 2026
- CVE-2026-80169Low 3.3Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insertion of Sensitive Information into Log File vulnerability.Published Sep 9, 2026
- CVE-2026-79966Low 3.3Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insertion of Sensitive Information into Log File vulnerability.Published Sep 9, 2026
- CVE-2026-80239Low 2.4Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Exposure of Sensitive System Information Due to Uncleared Debug Information vulnerability.Published Sep 9, 2026
- CVE-2026-79727Low 3.3Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Exposure of Sensitive System Information Due to Uncleared Debug Information vulnerability.Published Sep 9, 2026
| CVE | Title | Severity | Published |
|---|---|---|---|
| CVE-2026-33966 | An information Leak occurs in the camera driver due to Insertion of Sensitive Information Into Debugging Code. | Low 2.8 | |
| CVE-2026-33962 | A malformed Netlink command can trigger an out-of-bounds read, potentially leading to information leakage. | Low 2.8 | |
| CVE-2026-33960 | . | Low 2.8 | |
| CVE-2026-33956 | Sending a malformed message to the test_msg sysfs entry causes an out-of-bounds write, leading to denial of service. | Low 2.8 | |
| CVE-2026-23793 | An out-of-bounds memory access vulnerability in the camera GDC driver may lead to kernel memory corruption under certain conditions. | Low 3.5 | |
| CVE-2026-23786 | A TOCTOU race condition in the Exynos DRM HDR Driver leads to a heap overflow, causing a kernel crash. | Low 2.8 | |
| CVE-2025-64031 | libarchive 3.8.x before 3.8.2 has a strcpy heap-based buffer overflow in the gzip writer via the original-filename field to archive_compressor_gzip_open in archive_write_add_filter_gzip.c, aka GHSA-92wx-p669-8gr9. | Low 2.5 | |
| CVE-2026-35867 | A Command Injection vulnerability exists in the bs_SetLimitCli_info function within the libshare.so library of the LB-LINK router AC1900_AZ2 V1.0.2 via shell metacharacters, if the device is deployed in a scenario where an actor is able… | Low 3.1 | |
| CVE-2026-38332 | TinyEXIF before 1.1.0 has a heap-based buffer over-read in EntryParser::Fetch methods reachable via a crafted SubjectArea length. | Low 2.9 | |
| CVE-2025-70820 | Zettlab D6 Ultra before 1.7.0 allows absolute path traversal to reach folders other than the personal folder. | Low 3.5 | |
| CVE-2025-64059 | Grav 1.7.50.2 allows admins to enter JavaScript via the Home Page editor. | Low 1.8 | |
| CVE-2025-45480 | Floodlight 71fe8a7 allows disruption of host communication via link spoofing. | Low 3.0 | |
| CVE-2026-90773 | procs through 0.14.12 fails to sanitize escape sequences in process command lines before displaying them in the Command column. | Low 2.4 | |
| CVE-2026-90506 | A vulnerability was determined in vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae86411051b46. | Low 2.3 | |
| CVE-2026-90505 | The manipulation results in race condition. | Low 2.3 | |
| CVE-2026-86407 | The User Registration & Membership WordPress plugin before 5.2.8 does not verify that the visitor requesting its membership confirmation page owns the account named in the request, nor that any registration or purchase has taken place,… | Low 3.7 | |
| CVE-2026-79300 | SEP sesam before 5.2.0.24 mishandles User Authorization with MFA. | Low 3.5 | |
| CVE-2026-84025 | The BEAR WordPress plugin before 1.2.2 does not perform ownership checks on several handlers that return product data by a user-supplied identifier, allowing users who are restricted to their own products to read other owners' product… | Low 2.2 | |
| CVE-2026-82851 | The Masteriyo LMS WordPress plugin before 3.4.1 does not verify ownership of, or restrict the type of, the records a user requests for download, allowing users with the instructor role to retrieve the full content and metadata of… | Low 2.7 | |
| CVE-2026-11765 | Improper neutralization of argument delimiters in a command ('argument injection') vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus Pen allows Argument Injection. | Low 3.3 | |
| CVE-2026-86779 | The Visualizer WordPress plugin before 4.0.6 does not properly authorise chart-deletion requests, performing only a site-wide capability check with no per-object ownership verification, allowing users with the Contributor role and above… | Low 2.7 | |
| CVE-2025-15695 | The Translate WordPress with GTranslate WordPress plugin before 3.0.10 does not validate one of its settings before the bundled front-end scripts build markup from it, allowing users with a role as high as administrator to store… | Low 3.5 | |
| CVE-2026-89162 | In PCRE2 before 10.48, pcre2_serialize_encode might disclose two bytes to an adversary, typically in a situation where the access available to the adversary is already unsafe. | Low 3.3 | |
| CVE-2026-89151 | Forgejo before 16.0.4 allows use of restricted API tokens for unintended access to the "allow maintainer edit" feature. | Low 3.5 | |
| CVE-2026-89145 | Flextype CMS versions 0.9.9 through 1.0.0-alpha.3 fail to HTML-escape plugin directory names in the dependency error page rendered by getValidPluginsDependencies(). | Low 2.4 | |
| CVE-2026-78131 | strongSwan 4.2.0 through 6.0.7 has a missing release of memory after its effective lifetime in the x509 plugin's attribute certificate parser. | Low 3.7 | |
| CVE-2026-78127 | libcharon in strongSwan 4.1.2 through 6.0.7 has a missing release of memory after its effective lifetime in the IKE message parser. | Low 3.7 | |
| CVE-2026-78124 | strongSwan 5.0.2 through 6.0.7 allows PKCS#7 certificate enumeration in the openssl plugin that leads to a lack of release of memory after its effective lifetime. | Low 3.7 | |
| CVE-2026-15418 | In the silabser.sys driver for CP210x devices v11.5.0 and earlier, a local unprivileged user with a malicious device can use malformed packets to leak up to 145 bytes of uninitialized kernel pool memory. | Low 2.4 | |
| CVE-2026-88790 | A security vulnerability has been detected in proma-ai Proma up to 0.19.37. | Low 2.4 | |
| CVE-2026-0303 | A code execution vulnerability in Palo Alto Networks Checkov by Prisma® Cloud can allow arbitrary code execution when Checkov scans a directory that contains an attacker-controlled configuration file. | Low 2.4 | |
| CVE-2026-0302 | An OS command injection vulnerability in Palo Alto Networks Checkov by Prisma® Cloud enables a local user to execute arbitrary commands in the processes running Checkov. | Low 1.1 | |
| CVE-2026-0308 | A stored cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS® software enables a malicious authenticated administrator to store or execute a JavaScript payload using the web interface. | Low 1.1 | |
| CVE-2025-24978 | LF Edge eKuiper: Self-XSS in External Service Creation | Low 3.7 | |
| CVE-2026-87876 | Two case-insensitive comparisons on request-derived usernames outside the main authorization path in CUPS's scheduler (printer ACL validation and private-attribute filtering) could allow bypass of username-based access controls in certain… | Low 3.0 | |
| CVE-2026-46460 | Dell PowerScale OneFS, versions 9.5.0.0 through 9.7.1.15, versions 9.8.0.0 through 9.13.1.0, and versions prior to 9.15.0.0, contain an Incorrect Authorization vulnerability. | Low 3.5 | |
| CVE-2026-79944 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Least Privilege Violation vulnerability. | Low 3.4 | |
| CVE-2026-79942 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Execution with Unnecessary Privileges vulnerability. | Low 3.4 | |
| CVE-2026-79693 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Least Privilege Violation vulnerability. | Low 3.4 | |
| CVE-2026-79736 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Certificate Validation vulnerability. | Low 3.7 | |
| CVE-2026-79732 | Dell Secure Connect Gateway (SCG) 5.0 Appliance, versions prior to 5.36.00.xx, contains an Improper Certificate Validation vulnerability. | Low 3.7 | |
| CVE-2026-79729 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Certificate Validation vulnerability. | Low 3.7 | |
| CVE-2026-79690 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Certificate Validation vulnerability. | Low 3.7 | |
| CVE-2026-86744 | Snipe-IT 8.6.3 and earlier (and develop pre-release commits prior to the fix) contain a race condition in the asset checkout paths. | Low 2.1 | |
| CVE-2026-86739 | Snipe-IT 8.6.3 and earlier do not check the return value of Storage::put() when writing the signature PNG and the generated acceptance PDF in Account\AcceptanceController::store(). | Low 2.3 | |
| CVE-2026-86198 | PocketMine-MP versions before 5.44.2 fail to properly validate multiple ResourcePackClientResponsePacket packets with STATUS_COMPLETED status during resource pack handling. | Low 2.3 | |
| CVE-2026-80169 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insertion of Sensitive Information into Log File vulnerability. | Low 3.3 | |
| CVE-2026-79966 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insertion of Sensitive Information into Log File vulnerability. | Low 3.3 | |
| CVE-2026-80239 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Exposure of Sensitive System Information Due to Uncleared Debug Information vulnerability. | Low 2.4 | |
| CVE-2026-79727 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Exposure of Sensitive System Information Due to Uncleared Debug Information vulnerability. | Low 3.3 |
Showing 601–650 of 11,307. Narrow the filters to see the rest.
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status. Filter by severity and year here; the other filters work on the curated lists.