Vulnerability Intelligence · All CVEs
Every Published CVE, Searchable.
Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status.
Synced hourly · figures as of Oct 20, 2026
40,422 vulnerabilities · newest first
- CVE-2026-62252Critical 9.8Homer: Hardcoded Default Admin Password 'sipcapture' With No Forced Change on First LoginPublished Oct 7, 2026
- CVE-2026-62253Critical 9.8Homer: Complete Authentication Bypass When coordinator.jwt.secret Is Empty (Default)Published Oct 7, 2026
- CVE-2026-62176Critical 9.4PraisonAI: Code Injection via f-string Interpolation in Deploy API Server GenerationPublished Oct 7, 2026
- CVE-2026-92414Critical 9.3Apache Jackrabbit: Pre-auth hijack of cached sessions via derivable WebDAV lock tokensPublished Oct 7, 2026
- CVE-2026-107204Critical 9.3LMCache through 0.5.5 Unauthenticated RCE via /run_script EndpointPublished Oct 7, 2026
- CVE-2026-107202Critical 9.1A command injection vulnerability exists in the h-ui (version v0.0.25 and below) administrative API due to improper validation of the listen configuration field.Published Oct 7, 2026
- CVE-2025-70521Critical 9.8The management portal's diagnostic ping tool of Fanvil x7a firmware version 2.6.0.1182 does not handle user supplied input securely.Published Oct 7, 2026
- CVE-2025-70520Critical 9.8The websocket handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce proper authentication restrictions against sessionless users.Published Oct 7, 2026
- CVE-2025-70518Critical 10.0The management portal's diagnostic ping tool of Fanvil x7a firmware version 2.6.0.1182 does not handle user supplied input securely.Published Oct 7, 2026
- CVE-2025-70516Critical 9.1The websocket handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce proper authentication restrictions against sessionless users.Published Oct 7, 2026
- CVE-2026-107194Critical 9.2Sungrow iSolarCloud before 2026 allows authentication bypass and account takeover via "login_type":"5" in a login request, potentially leading to "local blackouts on the whole continent" in Europe.Published Oct 7, 2026
- CVE-2026-107183Critical 9.2llama.cpp before b11393 Use-After-Free via common_chat_peg_mapper chat_parserPublished Oct 7, 2026
- CVE-2026-102255Critical 10.0A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path.Published Oct 7, 2026
- CVE-2026-96408Critical 9.3A code injection vulnerability exists in the upgrade script of Movable Type, which may allow an unauthenticated attacker to execute an arbitrary Perl script or an SQL query on the affected product.Published Oct 7, 2026
- CVE-2026-105192Critical 9.8LMCache Unauthenticated RCE in multiprocess mode via pickle deserializationPublished Oct 7, 2026
- CVE-2026-103416Critical 9.3Out-of-bounds write via the TLS 1.3 handshake message cache in NetX Duo in Eclipse ThreadX NetX Duo 6.5.1.202602 allows a handshake message larger than the cache writes past it and on into the rest of the session control block, which…Published Oct 7, 2026
- CVE-2025-64393Critical 9.4This vulnerability in Veeam Backup & Replication allows a Backup Viewer to execute arbitrary code as SYSTEM on the backup server.Published Oct 7, 2026
- CVE-2026-97720Critical 9.1Apache Impala: Impala Executor Webserver Auth BypassPublished Oct 7, 2026
- CVE-2026-107104Critical 9.3Unsafe Deserialization Vulnerability in Manacle Technologies ERP SystemPublished Oct 7, 2026
- CVE-2026-107103Critical 9.3SQL Injection Vulnerability in Manacle Technologies ERP SystemPublished Oct 7, 2026
- CVE-2026-107102Critical 9.3Account Takeover Vulnerability in Manacle Technologies ERP SystemPublished Oct 7, 2026
- CVE-2026-102782Critical 9.3Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Simple Membership < 7.4.0Published Oct 7, 2026
- CVE-2026-59346Critical 9.3VMware Workstation and Fusion VMXNET3 integer-overflow vulnerabilityPublished Oct 7, 2026
- CVE-2026-19572Critical 9.3The vulnerability exists in a SOAP handler, where a hardcoded authentication bypass could allow an unauthenticated user to obtain a privileged administrator…Published Oct 7, 2026
- CVE-2026-16516Critical 9.0wolfSSH does not validate that the ECDSA curve identifier in a KEXDH_REPLY host key blob matches the algorithm negotiated during key exchange.Published Oct 7, 2026
- CVE-2026-14911Critical 9.3Improper Neutralization of Input During Web Page Generation (“Cross-site Scripting”) in ASUS router modules allows a remote attacker to read DOM information, modify router settings, and cause a denial-of-service condition when an…Published Oct 7, 2026
- CVE-2026-19386Critical 9.3A stack-based buffer overflow in the ASUS router modules allows an authenticated nearby user to execute arbitrary code via a crafted configuration file upload that exceeds the expected buffer size.Refer to the ' Security Update for ASUS…Published Oct 7, 2026
- CVE-2026-105324Critical 9.2An HTTP header injection vulnerability in start-page-loader.cgi of ADM allows an unauthenticated remote attacker to read arbitrary files on the host system.Published Oct 7, 2026
- CVE-2026-93675Critical 9.8IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to an expected dependency confusion.Published Oct 7, 2026
- CVE-2026-93674Critical 9.8IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.Published Oct 7, 2026
- CVE-2026-104334Critical 9.8IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to improper control of code generation.Published Oct 7, 2026
- CVE-2026-101023Critical 9.1Gitea OAuth2 refresh token grant accepts access tokensPublished Oct 6, 2026
- CVE-2026-106501Critical 9.6Backstage: Sensitive information exposure in ScaffolderPublished Oct 6, 2026
- CVE-2026-106446Critical 9.8Handlebars: JavaScript Injection via AST Type Confusion in compile (Program.blockParams)Published Oct 6, 2026
- CVE-2026-102167Critical 9.0Security Advisory 0197Published Oct 6, 2026
- CVE-2026-102162Critical 9.4Security Advisory 0193Published Oct 6, 2026
- CVE-2026-101157Critical 9.3Security Advisory 0192Published Oct 6, 2026
- CVE-2026-102159Critical 9.3Security Advisory 0190Published Oct 6, 2026
- CVE-2026-106445Critical 9.2Handlebars: JavaScript Injection via Own Property Check BypassPublished Oct 6, 2026
- CVE-2026-101158Critical 9.3Security Advisory 0185Published Oct 6, 2026
- CVE-2026-73278Critical 9.8Gitea WebAuthn bypass during OAuth and OIDC sign-inPublished Oct 6, 2026
- CVE-2026-94205Critical 9.8Gitea fork workflow approval bypass through maintainer-triggered eventsPublished Oct 6, 2026
- CVE-2026-95106Critical 9.1Gitea review and execution mismatch through duplicate tree entriesPublished Oct 6, 2026
- CVE-2026-103059Critical 9.1Gitea built-in SSH server authentication bypass through key case foldingPublished Oct 6, 2026
- CVE-2026-79805Critical 9.8Authenticated Path Traversal Vulnerability Leads to Unauthorized File Access and Modification in ClearPass Policy ManagerPublished Oct 6, 2026
- CVE-2026-79801Critical 9.8Unauthenticated Missing Integrity Verification allows Remote Code Execution in ClearPass Policy Manager Client AgentPublished Oct 6, 2026
- CVE-2026-79798Critical 9.9Authenticated SQL Injection Vulnerabilities in ClearPass Policy Manager Web-Based Management InterfacePublished Oct 6, 2026
- CVE-2026-79796Critical 9.8Authentication Bypass Vulnerabilities in ClearPass Policy ManagerPublished Oct 6, 2026
- CVE-2026-79794Critical 9.1Authenticated SQL Injection Vulnerability in ClearPass Policy Manager Web-based Management InterfacePublished Oct 6, 2026
- CVE-2026-76754Critical 9.8Unauthenticated SQL Injection Vulnerability leads to Remote Code Execution in ClearPass Policy ManagerPublished Oct 6, 2026
| CVE | Title | Severity | Published |
|---|---|---|---|
| CVE-2026-62252 | Homer: Hardcoded Default Admin Password 'sipcapture' With No Forced Change on First Login | Critical 9.8 | |
| CVE-2026-62253 | Homer: Complete Authentication Bypass When coordinator.jwt.secret Is Empty (Default) | Critical 9.8 | |
| CVE-2026-62176 | PraisonAI: Code Injection via f-string Interpolation in Deploy API Server Generation | Critical 9.4 | |
| CVE-2026-92414 | Apache Jackrabbit: Pre-auth hijack of cached sessions via derivable WebDAV lock tokens | Critical 9.3 | |
| CVE-2026-107204 | LMCache through 0.5.5 Unauthenticated RCE via /run_script Endpoint | Critical 9.3 | |
| CVE-2026-107202 | A command injection vulnerability exists in the h-ui (version v0.0.25 and below) administrative API due to improper validation of the listen configuration field. | Critical 9.1 | |
| CVE-2025-70521 | The management portal's diagnostic ping tool of Fanvil x7a firmware version 2.6.0.1182 does not handle user supplied input securely. | Critical 9.8 | |
| CVE-2025-70520 | The websocket handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce proper authentication restrictions against sessionless users. | Critical 9.8 | |
| CVE-2025-70518 | The management portal's diagnostic ping tool of Fanvil x7a firmware version 2.6.0.1182 does not handle user supplied input securely. | Critical 10.0 | |
| CVE-2025-70516 | The websocket handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce proper authentication restrictions against sessionless users. | Critical 9.1 | |
| CVE-2026-107194 | Sungrow iSolarCloud before 2026 allows authentication bypass and account takeover via "login_type":"5" in a login request, potentially leading to "local blackouts on the whole continent" in Europe. | Critical 9.2 | |
| CVE-2026-107183 | llama.cpp before b11393 Use-After-Free via common_chat_peg_mapper chat_parser | Critical 9.2 | |
| CVE-2026-102255 | A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. | Critical 10.0 | |
| CVE-2026-96408 | A code injection vulnerability exists in the upgrade script of Movable Type, which may allow an unauthenticated attacker to execute an arbitrary Perl script or an SQL query on the affected product. | Critical 9.3 | |
| CVE-2026-105192 | LMCache Unauthenticated RCE in multiprocess mode via pickle deserialization | Critical 9.8 | |
| CVE-2026-103416 | Out-of-bounds write via the TLS 1.3 handshake message cache in NetX Duo in Eclipse ThreadX NetX Duo 6.5.1.202602 allows a handshake message larger than the cache writes past it and on into the rest of the session control block, which… | Critical 9.3 | |
| CVE-2025-64393 | This vulnerability in Veeam Backup & Replication allows a Backup Viewer to execute arbitrary code as SYSTEM on the backup server. | Critical 9.4 | |
| CVE-2026-97720 | Apache Impala: Impala Executor Webserver Auth Bypass | Critical 9.1 | |
| CVE-2026-107104 | Unsafe Deserialization Vulnerability in Manacle Technologies ERP System | Critical 9.3 | |
| CVE-2026-107103 | SQL Injection Vulnerability in Manacle Technologies ERP System | Critical 9.3 | |
| CVE-2026-107102 | Account Takeover Vulnerability in Manacle Technologies ERP System | Critical 9.3 | |
| CVE-2026-102782 | Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Simple Membership < 7.4.0 | Critical 9.3 | |
| CVE-2026-59346 | VMware Workstation and Fusion VMXNET3 integer-overflow vulnerability | Critical 9.3 | |
| CVE-2026-19572 | The vulnerability exists in a SOAP handler, where a hardcoded authentication bypass could allow an unauthenticated user to obtain a privileged administrator… | Critical 9.3 | |
| CVE-2026-16516 | wolfSSH does not validate that the ECDSA curve identifier in a KEXDH_REPLY host key blob matches the algorithm negotiated during key exchange. | Critical 9.0 | |
| CVE-2026-14911 | Improper Neutralization of Input During Web Page Generation (“Cross-site Scripting”) in ASUS router modules allows a remote attacker to read DOM information, modify router settings, and cause a denial-of-service condition when an… | Critical 9.3 | |
| CVE-2026-19386 | A stack-based buffer overflow in the ASUS router modules allows an authenticated nearby user to execute arbitrary code via a crafted configuration file upload that exceeds the expected buffer size.Refer to the ' Security Update for ASUS… | Critical 9.3 | |
| CVE-2026-105324 | An HTTP header injection vulnerability in start-page-loader.cgi of ADM allows an unauthenticated remote attacker to read arbitrary files on the host system. | Critical 9.2 | |
| CVE-2026-93675 | IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to an expected dependency confusion. | Critical 9.8 | |
| CVE-2026-93674 | IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command. | Critical 9.8 | |
| CVE-2026-104334 | IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to improper control of code generation. | Critical 9.8 | |
| CVE-2026-101023 | Gitea OAuth2 refresh token grant accepts access tokens | Critical 9.1 | |
| CVE-2026-106501 | Backstage: Sensitive information exposure in Scaffolder | Critical 9.6 | |
| CVE-2026-106446 | Handlebars: JavaScript Injection via AST Type Confusion in compile (Program.blockParams) | Critical 9.8 | |
| CVE-2026-102167 | Security Advisory 0197 | Critical 9.0 | |
| CVE-2026-102162 | Security Advisory 0193 | Critical 9.4 | |
| CVE-2026-101157 | Security Advisory 0192 | Critical 9.3 | |
| CVE-2026-102159 | Security Advisory 0190 | Critical 9.3 | |
| CVE-2026-106445 | Handlebars: JavaScript Injection via Own Property Check Bypass | Critical 9.2 | |
| CVE-2026-101158 | Security Advisory 0185 | Critical 9.3 | |
| CVE-2026-73278 | Gitea WebAuthn bypass during OAuth and OIDC sign-in | Critical 9.8 | |
| CVE-2026-94205 | Gitea fork workflow approval bypass through maintainer-triggered events | Critical 9.8 | |
| CVE-2026-95106 | Gitea review and execution mismatch through duplicate tree entries | Critical 9.1 | |
| CVE-2026-103059 | Gitea built-in SSH server authentication bypass through key case folding | Critical 9.1 | |
| CVE-2026-79805 | Authenticated Path Traversal Vulnerability Leads to Unauthorized File Access and Modification in ClearPass Policy Manager | Critical 9.8 | |
| CVE-2026-79801 | Unauthenticated Missing Integrity Verification allows Remote Code Execution in ClearPass Policy Manager Client Agent | Critical 9.8 | |
| CVE-2026-79798 | Authenticated SQL Injection Vulnerabilities in ClearPass Policy Manager Web-Based Management Interface | Critical 9.9 | |
| CVE-2026-79796 | Authentication Bypass Vulnerabilities in ClearPass Policy Manager | Critical 9.8 | |
| CVE-2026-79794 | Authenticated SQL Injection Vulnerability in ClearPass Policy Manager Web-based Management Interface | Critical 9.1 | |
| CVE-2026-76754 | Unauthenticated SQL Injection Vulnerability leads to Remote Code Execution in ClearPass Policy Manager | Critical 9.8 |
Showing 651–700 of 40,422. Narrow the filters to see the rest.
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status. Filter by severity and year here; the other filters work on the curated lists.