Vulnerability Intelligence · All CVEs
Every Published CVE, Searchable.
Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status.
Synced hourly · figures as of Oct 20, 2026
40,422 vulnerabilities · newest first
- CVE-2026-105794Critical 9.1MsQuic: Improper Certificate Validation in Microsoft.Native.Quic.MsQuic.OpenSSLPublished Oct 6, 2026
- CVE-2026-105793Critical 9.1Microsoft UFO: Authenticated Android shell command injection in Mobile MCP press_keyPublished Oct 6, 2026
- CVE-2026-106037Critical 9.3Mooncake through 0.3.13.post1 Missing Authentication in Store REST ServicePublished Oct 6, 2026
- CVE-2026-91140Critical 9.6OS command injection in Progress Software Autonomous REST Connector GenAI AgentsPublished Oct 6, 2026
- CVE-2026-82531Critical 9.2Smarty before 4.5.8 and 5.x before 5.8.5 contains a code injection vulnerability where the top-level nocache_hash is never restored during extends:/multi-component template inheritance, leaving it null.Published Oct 6, 2026
- CVE-2026-106016Critical 9.8Mitigation bypass in the File Handling component.Published Oct 6, 2026
- CVE-2026-105835Critical 9.1PLANKA 2.2.0 through 2.2.1 fails to limit incorrect TOTP codes submitted to POST /api/access-tokens/verify-totp, allowing attackers to brute force two-factor authentication codes.Published Oct 6, 2026
- CVE-2026-98365Critical 9.8RDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB accessPublished Oct 6, 2026
- CVE-2026-98323Critical 9.8RDMA/siw: Bound fragmented header copies by the remaining lengthPublished Oct 6, 2026
- CVE-2026-42417Critical 9.3WordPress ARMember Premium plugin <= 7.8 - SQL Injection vulnerabilityPublished Oct 6, 2026
- CVE-2026-42415Critical 9.3WordPress Porto Theme - Functionality plugin <= 3.9.3 - SQL Injection vulnerabilityPublished Oct 6, 2026
- CVE-2026-41555Critical 9.3WordPress Newsletter Subscription Form – User Subscriptions Form, Capture Email plugin <= 1.5.9 - SQL Injection vulnerabilityPublished Oct 6, 2026
- CVE-2026-39797Critical 9.8WordPress GDPR Framework By Data443 plugin <= 2.5.0 - PHP Object Injection vulnerabilityPublished Oct 6, 2026
- CVE-2026-39795Critical 9.3WordPress SendPress Newsletters plugin <= 1.26.1.20 - SQL Injection vulnerabilityPublished Oct 6, 2026
- CVE-2026-39785Critical 9.3WordPress Gmedia Photo Gallery plugin <= 1.25.1 - SQL Injection vulnerabilityPublished Oct 6, 2026
- CVE-2026-39773Critical 10.0WordPress Doctreat Core plugin <= 1.7.0 - Privilege Escalation vulnerabilityPublished Oct 6, 2026
- CVE-2026-39770Critical 10.0WordPress Doctreat theme <= 1.7.0 - Arbitrary File Upload vulnerabilityPublished Oct 6, 2026
- CVE-2026-39764Critical 9.3WordPress Radius Booking — Booking Calendar for Appointments & Services plugin <= 1.0.19 - SQL Injection vulnerabilityPublished Oct 6, 2026
- CVE-2026-39761Critical 9.8WordPress Meta Box AIO plugin <= 3.7.1 - Privilege Escalation vulnerabilityPublished Oct 6, 2026
- CVE-2026-39759Critical 9.9WordPress Workreap Core plugin <= 3.4.5 - Arbitrary File Upload vulnerabilityPublished Oct 6, 2026
- CVE-2026-39757Critical 9.9WordPress Taskbot plugin <= 6.6 - Arbitrary File Upload vulnerabilityPublished Oct 6, 2026
- CVE-2026-39755Critical 9.9WordPress WP Duplicate plugin <= 1.1.11 - Arbitrary File Upload vulnerabilityPublished Oct 6, 2026
- CVE-2026-39753Critical 9.8WordPress Taskbot plugin <= 6.6 - Privilege Escalation vulnerabilityPublished Oct 6, 2026
- CVE-2026-39746Critical 9.3WordPress Booknetic plugin <= 4.8.5 - SQL Injection vulnerabilityPublished Oct 6, 2026
- CVE-2026-32579Critical 10.0WordPress Kognetiks Chatbot for WordPress plugin <= 2.4.9 - Arbitrary File Upload vulnerabilityPublished Oct 6, 2026
- CVE-2026-32568Critical 9.9WordPress WooCommerce Designer Pro plugin <= 1.9.33 - Remote Code Execution (RCE) vulnerabilityPublished Oct 6, 2026
- CVE-2026-32557Critical 9.3WordPress WooCommerce Appointments plugin <= 5.3.2 - SQL Injection vulnerabilityPublished Oct 6, 2026
- CVE-2026-85153Critical 9.3Information Disclosure Vulnerability in Schmooze dating mobile ApplicationPublished Oct 6, 2026
- CVE-2026-105778Critical 9.4Tenda AC5 Wifi setWifi stack-based overflowPublished Oct 6, 2026
- CVE-2026-94293Critical 9.3Missing authentication for critical function in the aas-edge-client REST APIPublished Oct 6, 2026
- CVE-2026-105484Critical 10.0A security vulnerability has been detected in TOTOLINK X6000R 9.4.0cu.652_B20230116.totolink · x6000r firmwarePublished Oct 6, 2026
- CVE-2026-82989Critical 9.8There is an input injection in vCast exposed network services in ViewSonic ViewBoard that allows a remote, unauthenticated attacker to inject arbitrary input into service endpoints via network-based HTTP requests to unauthenticated…Published Oct 6, 2026
- CVE-2026-77178Critical 9.1Oracle VM VirtualBox before 7.2.8 allows guest OS users to cause an out-of-bounds write in the host OS in pcnetReceiveNoSync in DevPCNet.cpp in the PCNet (Am79C970A) network device model.Published Oct 6, 2026
- CVE-2025-71383Critical 9.8Dbit WIFI4 N300 1.0.0 devices allow the management interface to be crashed via a request (from the local Wi-Fi network) that lacks a /api/login username or password field.Published Oct 6, 2026
- CVE-2026-105763Critical 9.6Twenty: Plaintext IMAP/SMTP/CalDAV password disclosure to any workspace member via /metadata GraphQLPublished Oct 5, 2026
- CVE-2026-91107Critical 9.3openSIS Classic 9.3 - Insecure Direct Object Reference (IDOR)Published Oct 5, 2026
- CVE-2026-105740Critical 9.9Langflow: Authenticated RCE via MCP Stdio transport allows any user to execute arbitrary OS commands on the serverPublished Oct 5, 2026
- CVE-2026-77226Critical 9.2Camunda 7.24.0 < 7.24.15 Incorrect Authorization via SetupResource EndpointPublished Oct 5, 2026
- CVE-2026-105691Critical 9.9Prior to 2.18.0, the SVG exporter places an attacker-controlled text object's fill-color value into a ppmcolormask command string and executes that string through child_process.exec.Published Oct 5, 2026
- CVE-2026-105697Critical 9.9Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configurationPublished Oct 5, 2026
- CVE-2026-104711Critical 9.8Apache Struts: OGNL injection in the legacy RESTful action mapperapache · strutsPublished Oct 5, 2026
- CVE-2026-105641Critical 9.8Plane: Hardcoded SECRET_KEY and LIVE_SERVER_SECRET_KEY shipped in aio/cli community deployment manifests — session forgery and live-server auth bypassPublished Oct 5, 2026
- CVE-2026-105640Critical 9.1Plane: Account Takeover via Unverified OAuth Email Match (Gitea, self-managed GitLab)Published Oct 5, 2026
- CVE-2026-105639Critical 9.8Plane: Pre-auth workspace invitation hijack via email-squat and self-served invitation token leak in PlanePublished Oct 5, 2026
- CVE-2026-105638Critical 9.1Plane: Magic-code verifier endpoint has no rate limit, enabling 6-digit OTP brute forcePublished Oct 5, 2026
- CVE-2026-103352Critical 9.3WordPress WP BASE Booking plugin <= 6.4.0 - SQL Injection vulnerabilityPublished Oct 5, 2026
- CVE-2026-97283Critical 9.8WordPress Advanced Post Manager plugin <= 4.5.5 - PHP Object Injection vulnerabilityPublished Oct 5, 2026
- CVE-2026-105637Critical 9.6Plane: Cross-Project Asset Hijacking via 'ProjectBulkAssetEndpoint' (sibling of CVE-2026-46558)Published Oct 5, 2026
- CVE-2026-105636Critical 9.9Plane: SSRF via HTTP redirect in webhook delivery (allow_redirects not set)Published Oct 5, 2026
- CVE-2026-102428Critical 9.3Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Joomla CCK < 8.3.16 - The order column for records was user provided and not properly validated, leading to a SQL injection vector.Published Oct 5, 2026
| CVE | Title | Severity | Published |
|---|---|---|---|
| CVE-2026-105794 | MsQuic: Improper Certificate Validation in Microsoft.Native.Quic.MsQuic.OpenSSL | Critical 9.1 | |
| CVE-2026-105793 | Microsoft UFO: Authenticated Android shell command injection in Mobile MCP press_key | Critical 9.1 | |
| CVE-2026-106037 | Mooncake through 0.3.13.post1 Missing Authentication in Store REST Service | Critical 9.3 | |
| CVE-2026-91140 | OS command injection in Progress Software Autonomous REST Connector GenAI Agents | Critical 9.6 | |
| CVE-2026-82531 | Smarty before 4.5.8 and 5.x before 5.8.5 contains a code injection vulnerability where the top-level nocache_hash is never restored during extends:/multi-component template inheritance, leaving it null. | Critical 9.2 | |
| CVE-2026-106016 | Mitigation bypass in the File Handling component. | Critical 9.8 | |
| CVE-2026-105835 | PLANKA 2.2.0 through 2.2.1 fails to limit incorrect TOTP codes submitted to POST /api/access-tokens/verify-totp, allowing attackers to brute force two-factor authentication codes. | Critical 9.1 | |
| CVE-2026-98365 | RDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB access | Critical 9.8 | |
| CVE-2026-98323 | RDMA/siw: Bound fragmented header copies by the remaining length | Critical 9.8 | |
| CVE-2026-42417 | WordPress ARMember Premium plugin <= 7.8 - SQL Injection vulnerability | Critical 9.3 | |
| CVE-2026-42415 | WordPress Porto Theme - Functionality plugin <= 3.9.3 - SQL Injection vulnerability | Critical 9.3 | |
| CVE-2026-41555 | WordPress Newsletter Subscription Form – User Subscriptions Form, Capture Email plugin <= 1.5.9 - SQL Injection vulnerability | Critical 9.3 | |
| CVE-2026-39797 | WordPress GDPR Framework By Data443 plugin <= 2.5.0 - PHP Object Injection vulnerability | Critical 9.8 | |
| CVE-2026-39795 | WordPress SendPress Newsletters plugin <= 1.26.1.20 - SQL Injection vulnerability | Critical 9.3 | |
| CVE-2026-39785 | WordPress Gmedia Photo Gallery plugin <= 1.25.1 - SQL Injection vulnerability | Critical 9.3 | |
| CVE-2026-39773 | WordPress Doctreat Core plugin <= 1.7.0 - Privilege Escalation vulnerability | Critical 10.0 | |
| CVE-2026-39770 | WordPress Doctreat theme <= 1.7.0 - Arbitrary File Upload vulnerability | Critical 10.0 | |
| CVE-2026-39764 | WordPress Radius Booking — Booking Calendar for Appointments & Services plugin <= 1.0.19 - SQL Injection vulnerability | Critical 9.3 | |
| CVE-2026-39761 | WordPress Meta Box AIO plugin <= 3.7.1 - Privilege Escalation vulnerability | Critical 9.8 | |
| CVE-2026-39759 | WordPress Workreap Core plugin <= 3.4.5 - Arbitrary File Upload vulnerability | Critical 9.9 | |
| CVE-2026-39757 | WordPress Taskbot plugin <= 6.6 - Arbitrary File Upload vulnerability | Critical 9.9 | |
| CVE-2026-39755 | WordPress WP Duplicate plugin <= 1.1.11 - Arbitrary File Upload vulnerability | Critical 9.9 | |
| CVE-2026-39753 | WordPress Taskbot plugin <= 6.6 - Privilege Escalation vulnerability | Critical 9.8 | |
| CVE-2026-39746 | WordPress Booknetic plugin <= 4.8.5 - SQL Injection vulnerability | Critical 9.3 | |
| CVE-2026-32579 | WordPress Kognetiks Chatbot for WordPress plugin <= 2.4.9 - Arbitrary File Upload vulnerability | Critical 10.0 | |
| CVE-2026-32568 | WordPress WooCommerce Designer Pro plugin <= 1.9.33 - Remote Code Execution (RCE) vulnerability | Critical 9.9 | |
| CVE-2026-32557 | WordPress WooCommerce Appointments plugin <= 5.3.2 - SQL Injection vulnerability | Critical 9.3 | |
| CVE-2026-85153 | Information Disclosure Vulnerability in Schmooze dating mobile Application | Critical 9.3 | |
| CVE-2026-105778 | Tenda AC5 Wifi setWifi stack-based overflow | Critical 9.4 | |
| CVE-2026-94293 | Missing authentication for critical function in the aas-edge-client REST API | Critical 9.3 | |
| CVE-2026-105484 | A security vulnerability has been detected in TOTOLINK X6000R 9.4.0cu.652_B20230116. totolink · x6000r firmware | Critical 10.0 | |
| CVE-2026-82989 | There is an input injection in vCast exposed network services in ViewSonic ViewBoard that allows a remote, unauthenticated attacker to inject arbitrary input into service endpoints via network-based HTTP requests to unauthenticated… | Critical 9.8 | |
| CVE-2026-77178 | Oracle VM VirtualBox before 7.2.8 allows guest OS users to cause an out-of-bounds write in the host OS in pcnetReceiveNoSync in DevPCNet.cpp in the PCNet (Am79C970A) network device model. | Critical 9.1 | |
| CVE-2025-71383 | Dbit WIFI4 N300 1.0.0 devices allow the management interface to be crashed via a request (from the local Wi-Fi network) that lacks a /api/login username or password field. | Critical 9.8 | |
| CVE-2026-105763 | Twenty: Plaintext IMAP/SMTP/CalDAV password disclosure to any workspace member via /metadata GraphQL | Critical 9.6 | |
| CVE-2026-91107 | openSIS Classic 9.3 - Insecure Direct Object Reference (IDOR) | Critical 9.3 | |
| CVE-2026-105740 | Langflow: Authenticated RCE via MCP Stdio transport allows any user to execute arbitrary OS commands on the server | Critical 9.9 | |
| CVE-2026-77226 | Camunda 7.24.0 < 7.24.15 Incorrect Authorization via SetupResource Endpoint | Critical 9.2 | |
| CVE-2026-105691 | Prior to 2.18.0, the SVG exporter places an attacker-controlled text object's fill-color value into a ppmcolormask command string and executes that string through child_process.exec. | Critical 9.9 | |
| CVE-2026-105697 | Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration | Critical 9.9 | |
| CVE-2026-104711 | Apache Struts: OGNL injection in the legacy RESTful action mapper apache · struts | Critical 9.8 | |
| CVE-2026-105641 | Plane: Hardcoded SECRET_KEY and LIVE_SERVER_SECRET_KEY shipped in aio/cli community deployment manifests — session forgery and live-server auth bypass | Critical 9.8 | |
| CVE-2026-105640 | Plane: Account Takeover via Unverified OAuth Email Match (Gitea, self-managed GitLab) | Critical 9.1 | |
| CVE-2026-105639 | Plane: Pre-auth workspace invitation hijack via email-squat and self-served invitation token leak in Plane | Critical 9.8 | |
| CVE-2026-105638 | Plane: Magic-code verifier endpoint has no rate limit, enabling 6-digit OTP brute force | Critical 9.1 | |
| CVE-2026-103352 | WordPress WP BASE Booking plugin <= 6.4.0 - SQL Injection vulnerability | Critical 9.3 | |
| CVE-2026-97283 | WordPress Advanced Post Manager plugin <= 4.5.5 - PHP Object Injection vulnerability | Critical 9.8 | |
| CVE-2026-105637 | Plane: Cross-Project Asset Hijacking via 'ProjectBulkAssetEndpoint' (sibling of CVE-2026-46558) | Critical 9.6 | |
| CVE-2026-105636 | Plane: SSRF via HTTP redirect in webhook delivery (allow_redirects not set) | Critical 9.9 | |
| CVE-2026-102428 | Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Joomla CCK < 8.3.16 - The order column for records was user provided and not properly validated, leading to a SQL injection vector. | Critical 9.3 |
Showing 751–800 of 40,422. Narrow the filters to see the rest.
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status. Filter by severity and year here; the other filters work on the curated lists.