Vulnerability Intelligence · All CVEs
Every Published CVE, Searchable.
Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status.
Synced hourly · figures as of Oct 20, 2026
11,307 vulnerabilities · newest first
- CVE-2026-80175Low 3.3Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability.Published Sep 9, 2026
- CVE-2026-13146Low 3.7The WP Travel WordPress plugin before 12.0.2 does not properly verify that the requester owns the booking targeted by its bank-deposit slip submission, allowing an unauthenticated attacker who knows the target customer's email address to…Published Sep 9, 2026
- CVE-2026-13144Low 3.7The WP Travel WordPress plugin before 12.0.2 does not properly verify that the requester is authorized to modify the targeted booking on one branch of its bank-deposit handler, allowing an unauthenticated attacker who knows the target…Published Sep 9, 2026
- CVE-2026-21109Low 2.1Improper access control in Watch Plugin prior to Android Watch 17 allows local attackers to access sensitive information.Published Sep 9, 2026
- CVE-2026-87657Low 3.1Use after free in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to read memory inside the sandbox via a crafted HTML page.Published Sep 9, 2026
- CVE-2026-87652Low 3.1Incorrect authorization in PushAPI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page.Published Sep 9, 2026
- CVE-2026-87647Low 3.4Uninitialized resource in GPU in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page.Published Sep 9, 2026
- CVE-2026-87614Low 3.1Incorrect authorization in ServiceWorker in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page.Published Sep 9, 2026
- CVE-2026-87611Low 3.1Missing authorization in FileSystem in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data via a crafted HTML page.Published Sep 9, 2026
- CVE-2026-87576Low 3.4Uninitialized resource in GPU in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page.Published Sep 9, 2026
- CVE-2026-87539Low 3.1Observable discrepancy in Network in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain cross-origin data via a crafted HTML page.Published Sep 9, 2026
- CVE-2026-87531Low 3.1Information leak in CORS in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data via a crafted HTML page.Published Sep 9, 2026
- CVE-2026-87525Low 2.7Out of bounds read in Chromoting in Google Chrome on on Windows prior to 153.0.8010.36 allowed a local attacker to read memory outside the sandbox via a local program.Published Sep 9, 2026
- CVE-2026-87521Low 3.1Information leak in WebMCP in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data via a crafted HTML page.Published Sep 9, 2026
- CVE-2026-87517Low 3.1Race condition in Mobile in Google Chrome on on iOS prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page.Published Sep 9, 2026
- CVE-2026-87498Low 3.1Missing authorization in WebUI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page.Published Sep 9, 2026
- CVE-2026-87485Low 3.1Incorrect authorization in CORS in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page.Published Sep 9, 2026
- CVE-2026-87456Low 3.4Uninitialized resource in Media in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page.Published Sep 9, 2026
- CVE-2026-87452Low 3.1Incorrect authorization in GPU in Google Chrome on on Mac prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentially obtain cross-origin data via a crafted HTML page.Published Sep 9, 2026
- CVE-2026-87451Low 3.1Information leak in Downloads in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data via a crafted HTML page.Published Sep 9, 2026
- CVE-2026-87442Low 3.1Confused deputy in Prerender in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentially bypass web origin policy via a crafted HTML page.Published Sep 9, 2026
- CVE-2026-87434Low 3.1Missing authorization in CORS in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page.Published Sep 9, 2026
- CVE-2026-86564Low 3.3Missing length validation before reading command_data in the virtio-net control-queue handler can cause an out-of-bounds read and a host process crash.Published Sep 8, 2026
- CVE-2026-75726Low 3.5Adobe Experience Manager is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass.Published Sep 8, 2026
- CVE-2026-9216Low 1.2An insufficient input validation vulnerability in the listed NETGEAR RAX series models allows a network-adjacent attacker having network access (such as WiFi credentials) to crash the router's management UI.Published Sep 8, 2026
- CVE-2026-9215Low 1.8A cross site request forgery (CSRF) vulnerability in the listed NETGEAR models allows an attacker who can leverage social engineering techniques on a router administrator to tamper with router configuration and disrupt router operations…Published Sep 8, 2026
- CVE-2026-69904Low 3.5Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.Published Sep 8, 2026
- CVE-2026-48707Low 3.1Versions prior to 2.18.2 have a Server-Side Request Forgery (SSRF) vulnerability in the file upload functionality (system/core/uploader.php at lines 509-532).Published Sep 8, 2026
- CVE-2026-84392Low 2.5A NULL Pointer Dereference vulnerability [CWE-476] vulnerability in Fortinet FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiPAM 1.9.0, FortiPAM 1.8 all versions, FortiPAM 1.7 all versions, FortiPAM 1.6 all versions, FortiPAM 1.5…Published Sep 8, 2026
- CVE-2026-84389Low 2.8A url redirection to untrusted site ('open redirect') vulnerability in Fortinet FortiSIEM 7.5.0 through 7.5.1, FortiSIEM 7.4.1 through 7.4.2 may allow attacker to execute unauthorized code or commands…Published Sep 8, 2026
- CVE-2026-82060Low 2.3In MongoDB, insufficient validation of shard key values during document insertion allowed authenticated users to store documents with specially crafted, operator-shaped objects as shard key values in sharded collections.Published Sep 8, 2026
- CVE-2026-95359Low 3.4Chromium CVE-2026-95359: Uninitialized resource in GPUPublished Sep 8, 2026
- CVE-2026-95324Low 3.4Chromium CVE-2026-95324: Uninitialized resource in GPUPublished Sep 8, 2026
- CVE-2026-95317Low 3.1Chromium CVE-2026-95317: Incorrect authorization in MediaCapturePublished Sep 8, 2026
- CVE-2026-95316Low 2.9Chromium CVE-2026-95316: Unchecked return value in PerformancePublished Sep 8, 2026
- CVE-2026-95312Low 3.1Chromium CVE-2026-95312: Information leak in PasswordsPublished Sep 8, 2026
- CVE-2026-95308Low 3.4Chromium CVE-2026-95308: Integer overflow in MetricsPublished Sep 8, 2026
- CVE-2026-95302Low 2.9Chromium CVE-2026-95302: Incorrect authorization in WebAPKsPublished Sep 8, 2026
- CVE-2026-16003Low 2.0Exposed IOCTL with Insufficient Access Control in Armoury Crate driver allows a local user to add an arbitrary process identifier to the driver's whitelist via a crafted IOCTL request by bypassing the driver's verification.Refer to the '…Published Sep 8, 2026
- CVE-2026-76961Low 3.5SAP S/4HANA Finance (Advanced Payment Management) does not perform sufficient Cross-Site Request Forgery protection on certain requests, due to this an attacker with low privileges could craft a malicious link or page.Published Sep 8, 2026
- CVE-2026-76960Low 3.5SAP S/4HANA Finance (Advanced Payment Management) does not perform sufficient Cross-Site Request Forgery protection on certain requests, due to this an attacker with low privileges could craft a malicious link or page.Published Sep 8, 2026
- CVE-2026-58234Low 2.2SAP Process Integration (SOAP Adapter) allows a privileged user to send specially crafted requests containing deeply nested entity definitions, which under certain conditions could temporarily increase processor load and degrade system…Published Sep 8, 2026
- CVE-2026-82710Low 2.3Terminal escape sequence injection in mix usage_rules.search_docs via package documentation metadataPublished Sep 8, 2026
- CVE-2026-82584Low 2.3Terminal escape sequence injection in the mix igniter.install confirmation prompt via package metadataPublished Sep 7, 2026
- CVE-2026-81638Low 2.1Non-canonical ULID spellings are accepted and alias to the same record in ash_double_entryPublished Sep 7, 2026
- CVE-2026-86505Low 3.3In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust check leaked project metadata to JetBrains MarketplacePublished Sep 7, 2026
- CVE-2026-86503Low 3.3In JetBrains IntelliJ IDEA before 2026.2.2 opening an untrusted project could trigger SSRF via Kubernetes spec-source URL fetchingPublished Sep 7, 2026
- CVE-2026-86501Low 2.8In JetBrains IntelliJ IDEA before 2026.2.2 terminal command input could be written to idea.logPublished Sep 7, 2026
- CVE-2026-86491Low 3.5In JetBrains YouTrack before 2026.2.18634 stored XSS was possible via project and organization icon uploadsPublished Sep 7, 2026
- CVE-2026-86487Low 3.1In JetBrains YouTrack before 2026.2.18634 a crafted WebSocket message allowed read-only whiteboard users to modify canvas contentPublished Sep 7, 2026
| CVE | Title | Severity | Published |
|---|---|---|---|
| CVE-2026-80175 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability. | Low 3.3 | |
| CVE-2026-13146 | The WP Travel WordPress plugin before 12.0.2 does not properly verify that the requester owns the booking targeted by its bank-deposit slip submission, allowing an unauthenticated attacker who knows the target customer's email address to… | Low 3.7 | |
| CVE-2026-13144 | The WP Travel WordPress plugin before 12.0.2 does not properly verify that the requester is authorized to modify the targeted booking on one branch of its bank-deposit handler, allowing an unauthenticated attacker who knows the target… | Low 3.7 | |
| CVE-2026-21109 | Improper access control in Watch Plugin prior to Android Watch 17 allows local attackers to access sensitive information. | Low 2.1 | |
| CVE-2026-87657 | Use after free in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to read memory inside the sandbox via a crafted HTML page. | Low 3.1 | |
| CVE-2026-87652 | Incorrect authorization in PushAPI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. | Low 3.1 | |
| CVE-2026-87647 | Uninitialized resource in GPU in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. | Low 3.4 | |
| CVE-2026-87614 | Incorrect authorization in ServiceWorker in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. | Low 3.1 | |
| CVE-2026-87611 | Missing authorization in FileSystem in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data via a crafted HTML page. | Low 3.1 | |
| CVE-2026-87576 | Uninitialized resource in GPU in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. | Low 3.4 | |
| CVE-2026-87539 | Observable discrepancy in Network in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. | Low 3.1 | |
| CVE-2026-87531 | Information leak in CORS in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data via a crafted HTML page. | Low 3.1 | |
| CVE-2026-87525 | Out of bounds read in Chromoting in Google Chrome on on Windows prior to 153.0.8010.36 allowed a local attacker to read memory outside the sandbox via a local program. | Low 2.7 | |
| CVE-2026-87521 | Information leak in WebMCP in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data via a crafted HTML page. | Low 3.1 | |
| CVE-2026-87517 | Race condition in Mobile in Google Chrome on on iOS prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. | Low 3.1 | |
| CVE-2026-87498 | Missing authorization in WebUI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. | Low 3.1 | |
| CVE-2026-87485 | Incorrect authorization in CORS in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. | Low 3.1 | |
| CVE-2026-87456 | Uninitialized resource in Media in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. | Low 3.4 | |
| CVE-2026-87452 | Incorrect authorization in GPU in Google Chrome on on Mac prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentially obtain cross-origin data via a crafted HTML page. | Low 3.1 | |
| CVE-2026-87451 | Information leak in Downloads in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data via a crafted HTML page. | Low 3.1 | |
| CVE-2026-87442 | Confused deputy in Prerender in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentially bypass web origin policy via a crafted HTML page. | Low 3.1 | |
| CVE-2026-87434 | Missing authorization in CORS in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. | Low 3.1 | |
| CVE-2026-86564 | Missing length validation before reading command_data in the virtio-net control-queue handler can cause an out-of-bounds read and a host process crash. | Low 3.3 | |
| CVE-2026-75726 | Adobe Experience Manager is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. | Low 3.5 | |
| CVE-2026-9216 | An insufficient input validation vulnerability in the listed NETGEAR RAX series models allows a network-adjacent attacker having network access (such as WiFi credentials) to crash the router's management UI. | Low 1.2 | |
| CVE-2026-9215 | A cross site request forgery (CSRF) vulnerability in the listed NETGEAR models allows an attacker who can leverage social engineering techniques on a router administrator to tamper with router configuration and disrupt router operations… | Low 1.8 | |
| CVE-2026-69904 | Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network. | Low 3.5 | |
| CVE-2026-48707 | Versions prior to 2.18.2 have a Server-Side Request Forgery (SSRF) vulnerability in the file upload functionality (system/core/uploader.php at lines 509-532). | Low 3.1 | |
| CVE-2026-84392 | A NULL Pointer Dereference vulnerability [CWE-476] vulnerability in Fortinet FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiPAM 1.9.0, FortiPAM 1.8 all versions, FortiPAM 1.7 all versions, FortiPAM 1.6 all versions, FortiPAM 1.5… | Low 2.5 | |
| CVE-2026-84389 | A url redirection to untrusted site ('open redirect') vulnerability in Fortinet FortiSIEM 7.5.0 through 7.5.1, FortiSIEM 7.4.1 through 7.4.2 may allow attacker to execute unauthorized code or commands… | Low 2.8 | |
| CVE-2026-82060 | In MongoDB, insufficient validation of shard key values during document insertion allowed authenticated users to store documents with specially crafted, operator-shaped objects as shard key values in sharded collections. | Low 2.3 | |
| CVE-2026-95359 | Chromium CVE-2026-95359: Uninitialized resource in GPU | Low 3.4 | |
| CVE-2026-95324 | Chromium CVE-2026-95324: Uninitialized resource in GPU | Low 3.4 | |
| CVE-2026-95317 | Chromium CVE-2026-95317: Incorrect authorization in MediaCapture | Low 3.1 | |
| CVE-2026-95316 | Chromium CVE-2026-95316: Unchecked return value in Performance | Low 2.9 | |
| CVE-2026-95312 | Chromium CVE-2026-95312: Information leak in Passwords | Low 3.1 | |
| CVE-2026-95308 | Chromium CVE-2026-95308: Integer overflow in Metrics | Low 3.4 | |
| CVE-2026-95302 | Chromium CVE-2026-95302: Incorrect authorization in WebAPKs | Low 2.9 | |
| CVE-2026-16003 | Exposed IOCTL with Insufficient Access Control in Armoury Crate driver allows a local user to add an arbitrary process identifier to the driver's whitelist via a crafted IOCTL request by bypassing the driver's verification.Refer to the '… | Low 2.0 | |
| CVE-2026-76961 | SAP S/4HANA Finance (Advanced Payment Management) does not perform sufficient Cross-Site Request Forgery protection on certain requests, due to this an attacker with low privileges could craft a malicious link or page. | Low 3.5 | |
| CVE-2026-76960 | SAP S/4HANA Finance (Advanced Payment Management) does not perform sufficient Cross-Site Request Forgery protection on certain requests, due to this an attacker with low privileges could craft a malicious link or page. | Low 3.5 | |
| CVE-2026-58234 | SAP Process Integration (SOAP Adapter) allows a privileged user to send specially crafted requests containing deeply nested entity definitions, which under certain conditions could temporarily increase processor load and degrade system… | Low 2.2 | |
| CVE-2026-82710 | Terminal escape sequence injection in mix usage_rules.search_docs via package documentation metadata | Low 2.3 | |
| CVE-2026-82584 | Terminal escape sequence injection in the mix igniter.install confirmation prompt via package metadata | Low 2.3 | |
| CVE-2026-81638 | Non-canonical ULID spellings are accepted and alias to the same record in ash_double_entry | Low 2.1 | |
| CVE-2026-86505 | In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust check leaked project metadata to JetBrains Marketplace | Low 3.3 | |
| CVE-2026-86503 | In JetBrains IntelliJ IDEA before 2026.2.2 opening an untrusted project could trigger SSRF via Kubernetes spec-source URL fetching | Low 3.3 | |
| CVE-2026-86501 | In JetBrains IntelliJ IDEA before 2026.2.2 terminal command input could be written to idea.log | Low 2.8 | |
| CVE-2026-86491 | In JetBrains YouTrack before 2026.2.18634 stored XSS was possible via project and organization icon uploads | Low 3.5 | |
| CVE-2026-86487 | In JetBrains YouTrack before 2026.2.18634 a crafted WebSocket message allowed read-only whiteboard users to modify canvas content | Low 3.1 |
Showing 651–700 of 11,307. Narrow the filters to see the rest.
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status. Filter by severity and year here; the other filters work on the curated lists.