Vulnerability Intelligence · All CVEs
Every Published CVE, Searchable.
Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status.
Synced hourly · figures as of Oct 20, 2026
11,311 vulnerabilities · newest first
- CVE-2026-84367Low 3.7From 16.0.0 until 17.13.5 and 18.2.4, joi's lib/types/keys.js internals.rename() implementation used by object().rename() permits a schema that renames keys with a…Published Sep 1, 2026
- CVE-2026-84307Low 3.7From 4.0.0 until 4.12.5 and 5.7.5, packages/panels/src/Auth/Pages/Login.php presents the multi-factor authentication challenge before evaluating…Published Sep 1, 2026
- CVE-2026-73748Low 2.2A vulnerability in the affected interface of HPE Networking Fabric Composer allows an attacker with administrative privileges to access sensitive information in a cleartext format.Published Sep 1, 2026
- CVE-2026-73747Low 2.5A local privilege-escalation vulnerability has been discovered in HPE Networking Fabric Composer.Published Sep 1, 2026
- CVE-2026-73746Low 3.1A denial-of-service vulnerability exists in the API of HPE Networking Fabric Composer that could allow an authenticated low privilege operator user to cause a denial of service.Published Sep 1, 2026
- CVE-2026-73745Low 3.1A vulnerability in the API endpoint of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to view some information handled by the affected system.Published Sep 1, 2026
- CVE-2026-73744Low 3.5A denial-of-service vulnerability exists in the web-based management interface of HPE Networking Fabric Composer that could allow an authenticated low privilege operator user to cause a denial of service.Published Sep 1, 2026
- CVE-2026-73743Low 3.7A vulnerability in the web-based management interface of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to gain insight into some data handled by the affected interface.Published Sep 1, 2026
- CVE-2026-81846Low 3.5An authorization bypass in the runZero Platform MCP service has been resolved in version 5.1.260826.0.Published Sep 1, 2026
- CVE-2026-82748Low 2.1Ash.Actions.Aggregate authorizes an aggregate under one action but computes it under anotherPublished Sep 1, 2026
- CVE-2026-82744Low 2.1Ash.Reactor change step fails open, skipping a change when its where guard raisesPublished Sep 1, 2026
- CVE-2026-82743Low 2.1Ash.Actions.Read.AsyncLimiter busy-spins a scheduler while awaiting slow async readsPublished Sep 1, 2026
- CVE-2026-82741Low 2.1Ash.Type.Union with :map_with_tag does not force the tag on dump, enabling tag confusionPublished Sep 1, 2026
- CVE-2026-82740Low 2.1Ash.Type ignores outer array constraints on nested {:array, {:array, type}} inputsPublished Sep 1, 2026
- CVE-2026-82739Low 2.1Ash.Resource.Validation.Confirm leaks a confirmed field's stored value in the atomic mismatch errorPublished Sep 1, 2026
- CVE-2026-82736Low 2.1Ash.Type.CiString validates length and match constraints before case folding, allowing constraint bypassPublished Sep 1, 2026
- CVE-2026-82734Low 2.1Non-finite Infinity/NaN decimal values bypass bounds constraints in Ash.Type.DecimalPublished Sep 1, 2026
- CVE-2026-48932Low 3.7A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible IncomingMessage headers while piping the original body to a reused backend connection.Published Sep 1, 2026
- CVE-2026-18743Low 2.5This vulnerability allows an attacker to provide specially crafted configuration content to a host, which, when loaded, can lead to a small memory corruption issue.Published Sep 1, 2026
- CVE-2026-82731Low 2.3Unescaped path parameters in AshTypescript generated TypeScript client allow request redirectionPublished Sep 1, 2026
- CVE-2026-55290Low 3.3In setTo of ResourceTypes.cpp, there is a possible out-of-bounds heap read due to a missing bounds check.Published Sep 1, 2026
- CVE-2026-49895Low 3.5In get_eht_operation_channel_width of ieee802_11_common.c, there is a possible out of bounds read due to an incorrect bounds check.Published Sep 1, 2026
- CVE-2026-45525Low 3.3In multiple locations, there is a possible improper data sanitization due to a logic error in the code.Published Sep 1, 2026
- CVE-2026-45521Low 3.3In openFile of AppFuseBridge.java, there is a possible information disclosure due to a missing permission check.Published Sep 1, 2026
- CVE-2026-45519Low 3.3In screenArgsForPermissionCheckIfAny of multiple locations there is a possible risk of unauthorized access due to a confused deputy.Published Sep 1, 2026
- CVE-2026-28671Low 3.3In updateInternal of MediaProvider.java, there is a possible expose contents of files due to a race condition.Published Sep 1, 2026
- CVE-2026-28660Low 3.3In getAllSessions of multiple files, there is a possible confused deputy due to a logic error in the code.Published Sep 1, 2026
- CVE-2026-28652Low 3.1In multiple functions of RangingServiceImpl.java, there is a possible MITM due to a missing permission check.Published Sep 1, 2026
- CVE-2026-28622Low 3.3In getQueryBuilderInternal of MediaProvider.java, there is a possible way to retrieve location metadata due to a permissions bypass.Published Sep 1, 2026
- CVE-2026-0054Low 3.3In isCallerAllowed of WalletContextualLocationsService.kt, there is a possible way to get wallet information due to a missing permission check.Published Sep 1, 2026
- CVE-2026-77351Low 3.5Prior to version 5.0.0, Wallos lets any authenticated user store an arbitrary SMTP host — including private and cloud-metadata IP addresses — in their personal email…Published Aug 31, 2026
- CVE-2026-14367Low 3.1The I3C IBI subsystem in drivers/i3c/i3c_ibi_workq.c hands out statically-allocated work nodes through a free-list i3c_ibi_work_nodes_free implemented as a plain sys_slist_t, which provides no synchronization.Published Aug 31, 2026
- CVE-2023-31308Low 3.3A malicious virtual function can invoke the certain command handlers in the SMU, causing a denial of service due to out-of-bounds memory read.Published Aug 31, 2026
- CVE-2026-21827Low 3.1HCL Connections is vulnerable to an information disclosure vulnerability which could allow a user to obtain sensitive information they are not entitled to, caused by improper handling of request data they are not entitled to, caused by…Published Aug 31, 2026
- CVE-2026-82874Low 2.4ToolJet before v3.16.208 fails to validate that authenticated users belong to the organization specified in the organizationId path parameter of tooljet-db endpoints, allowing any Builder user to read, modify, and delete tables across…Published Aug 31, 2026
- CVE-2026-82865Low 2.1pdfme schemas before 5.5.10 contains a cross-site scripting vulnerability in the multiVariableText property panel that assigns unsanitized i18n label values to innerHTML.Published Aug 31, 2026
- CVE-2026-82631Low 2.1The manipulation results in use after free.Published Aug 31, 2026
- CVE-2026-82725Low 2.3AshPhoenix FilterForm allows filtering across non-public relationships, disclosing private related dataPublished Aug 31, 2026
- CVE-2026-82727Low 2.3AshPhoenix Form.Auto leaks submitted params in an unknown _union_type error messagePublished Aug 31, 2026
- CVE-2026-81853Low 2.3AshAdmin composite primary key decoding accepts arbitrary fields, enabling a secret-attribute oraclePublished Aug 31, 2026
- CVE-2026-81852Low 2.1AshAdmin ships a hardcoded CSP nonce, allowing nonce-based CSP bypassPublished Aug 31, 2026
- CVE-2026-82681Low 2.0Query-parameter injection in AshAdmin row-action links via unencoded string primary keysPublished Aug 31, 2026
- CVE-2026-82594Low 2.3Such manipulation leads to improper authorization.Published Aug 31, 2026
- CVE-2026-81643Low 2.3Broken access control in AshGraphql subscription batcher applies authorization suppression to only the first notificationPublished Aug 30, 2026
- CVE-2026-82367Low 2.3Re-entrant synchronous publish in AshGraphql subscription batcher delivers one subscriber's records to another's topicPublished Aug 30, 2026
- CVE-2026-81322Low 2.1Cloaked plaintext leaks through a non-sensitive action argument in AshCloakPublished Aug 30, 2026
- CVE-2026-82656Low 2.1Admidio before 5.0.12 fails to sanitize album names in the photo ZIP download functionality, allowing authenticated users with album-creation rights to include path traversal segments in archive entry names.Published Aug 30, 2026
- CVE-2026-81316Low 2.1Same-named aggregates with differing filters are conflated in AshSqlPublished Aug 30, 2026
- CVE-2026-81318Low 2.1Distinct-query aggregate drops the tenant schema prefix, leaking across tenants in AshSqlPublished Aug 30, 2026
- CVE-2026-78691Low 2.1Unescaped backslash allows LIKE wildcard injection in AshSql string searchPublished Aug 30, 2026
| CVE | Title | Severity | Published |
|---|---|---|---|
| CVE-2026-84367 | From 16.0.0 until 17.13.5 and 18.2.4, joi's lib/types/keys.js internals.rename() implementation used by object().rename() permits a schema that renames keys with a… | Low 3.7 | |
| CVE-2026-84307 | From 4.0.0 until 4.12.5 and 5.7.5, packages/panels/src/Auth/Pages/Login.php presents the multi-factor authentication challenge before evaluating… | Low 3.7 | |
| CVE-2026-73748 | A vulnerability in the affected interface of HPE Networking Fabric Composer allows an attacker with administrative privileges to access sensitive information in a cleartext format. | Low 2.2 | |
| CVE-2026-73747 | A local privilege-escalation vulnerability has been discovered in HPE Networking Fabric Composer. | Low 2.5 | |
| CVE-2026-73746 | A denial-of-service vulnerability exists in the API of HPE Networking Fabric Composer that could allow an authenticated low privilege operator user to cause a denial of service. | Low 3.1 | |
| CVE-2026-73745 | A vulnerability in the API endpoint of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to view some information handled by the affected system. | Low 3.1 | |
| CVE-2026-73744 | A denial-of-service vulnerability exists in the web-based management interface of HPE Networking Fabric Composer that could allow an authenticated low privilege operator user to cause a denial of service. | Low 3.5 | |
| CVE-2026-73743 | A vulnerability in the web-based management interface of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to gain insight into some data handled by the affected interface. | Low 3.7 | |
| CVE-2026-81846 | An authorization bypass in the runZero Platform MCP service has been resolved in version 5.1.260826.0. | Low 3.5 | |
| CVE-2026-82748 | Ash.Actions.Aggregate authorizes an aggregate under one action but computes it under another | Low 2.1 | |
| CVE-2026-82744 | Ash.Reactor change step fails open, skipping a change when its where guard raises | Low 2.1 | |
| CVE-2026-82743 | Ash.Actions.Read.AsyncLimiter busy-spins a scheduler while awaiting slow async reads | Low 2.1 | |
| CVE-2026-82741 | Ash.Type.Union with :map_with_tag does not force the tag on dump, enabling tag confusion | Low 2.1 | |
| CVE-2026-82740 | Ash.Type ignores outer array constraints on nested {:array, {:array, type}} inputs | Low 2.1 | |
| CVE-2026-82739 | Ash.Resource.Validation.Confirm leaks a confirmed field's stored value in the atomic mismatch error | Low 2.1 | |
| CVE-2026-82736 | Ash.Type.CiString validates length and match constraints before case folding, allowing constraint bypass | Low 2.1 | |
| CVE-2026-82734 | Non-finite Infinity/NaN decimal values bypass bounds constraints in Ash.Type.Decimal | Low 2.1 | |
| CVE-2026-48932 | A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible IncomingMessage headers while piping the original body to a reused backend connection. | Low 3.7 | |
| CVE-2026-18743 | This vulnerability allows an attacker to provide specially crafted configuration content to a host, which, when loaded, can lead to a small memory corruption issue. | Low 2.5 | |
| CVE-2026-82731 | Unescaped path parameters in AshTypescript generated TypeScript client allow request redirection | Low 2.3 | |
| CVE-2026-55290 | In setTo of ResourceTypes.cpp, there is a possible out-of-bounds heap read due to a missing bounds check. | Low 3.3 | |
| CVE-2026-49895 | In get_eht_operation_channel_width of ieee802_11_common.c, there is a possible out of bounds read due to an incorrect bounds check. | Low 3.5 | |
| CVE-2026-45525 | In multiple locations, there is a possible improper data sanitization due to a logic error in the code. | Low 3.3 | |
| CVE-2026-45521 | In openFile of AppFuseBridge.java, there is a possible information disclosure due to a missing permission check. | Low 3.3 | |
| CVE-2026-45519 | In screenArgsForPermissionCheckIfAny of multiple locations there is a possible risk of unauthorized access due to a confused deputy. | Low 3.3 | |
| CVE-2026-28671 | In updateInternal of MediaProvider.java, there is a possible expose contents of files due to a race condition. | Low 3.3 | |
| CVE-2026-28660 | In getAllSessions of multiple files, there is a possible confused deputy due to a logic error in the code. | Low 3.3 | |
| CVE-2026-28652 | In multiple functions of RangingServiceImpl.java, there is a possible MITM due to a missing permission check. | Low 3.1 | |
| CVE-2026-28622 | In getQueryBuilderInternal of MediaProvider.java, there is a possible way to retrieve location metadata due to a permissions bypass. | Low 3.3 | |
| CVE-2026-0054 | In isCallerAllowed of WalletContextualLocationsService.kt, there is a possible way to get wallet information due to a missing permission check. | Low 3.3 | |
| CVE-2026-77351 | Prior to version 5.0.0, Wallos lets any authenticated user store an arbitrary SMTP host — including private and cloud-metadata IP addresses — in their personal email… | Low 3.5 | |
| CVE-2026-14367 | The I3C IBI subsystem in drivers/i3c/i3c_ibi_workq.c hands out statically-allocated work nodes through a free-list i3c_ibi_work_nodes_free implemented as a plain sys_slist_t, which provides no synchronization. | Low 3.1 | |
| CVE-2023-31308 | A malicious virtual function can invoke the certain command handlers in the SMU, causing a denial of service due to out-of-bounds memory read. | Low 3.3 | |
| CVE-2026-21827 | HCL Connections is vulnerable to an information disclosure vulnerability which could allow a user to obtain sensitive information they are not entitled to, caused by improper handling of request data they are not entitled to, caused by… | Low 3.1 | |
| CVE-2026-82874 | ToolJet before v3.16.208 fails to validate that authenticated users belong to the organization specified in the organizationId path parameter of tooljet-db endpoints, allowing any Builder user to read, modify, and delete tables across… | Low 2.4 | |
| CVE-2026-82865 | pdfme schemas before 5.5.10 contains a cross-site scripting vulnerability in the multiVariableText property panel that assigns unsanitized i18n label values to innerHTML. | Low 2.1 | |
| CVE-2026-82631 | The manipulation results in use after free. | Low 2.1 | |
| CVE-2026-82725 | AshPhoenix FilterForm allows filtering across non-public relationships, disclosing private related data | Low 2.3 | |
| CVE-2026-82727 | AshPhoenix Form.Auto leaks submitted params in an unknown _union_type error message | Low 2.3 | |
| CVE-2026-81853 | AshAdmin composite primary key decoding accepts arbitrary fields, enabling a secret-attribute oracle | Low 2.3 | |
| CVE-2026-81852 | AshAdmin ships a hardcoded CSP nonce, allowing nonce-based CSP bypass | Low 2.1 | |
| CVE-2026-82681 | Query-parameter injection in AshAdmin row-action links via unencoded string primary keys | Low 2.0 | |
| CVE-2026-82594 | Such manipulation leads to improper authorization. | Low 2.3 | |
| CVE-2026-81643 | Broken access control in AshGraphql subscription batcher applies authorization suppression to only the first notification | Low 2.3 | |
| CVE-2026-82367 | Re-entrant synchronous publish in AshGraphql subscription batcher delivers one subscriber's records to another's topic | Low 2.3 | |
| CVE-2026-81322 | Cloaked plaintext leaks through a non-sensitive action argument in AshCloak | Low 2.1 | |
| CVE-2026-82656 | Admidio before 5.0.12 fails to sanitize album names in the photo ZIP download functionality, allowing authenticated users with album-creation rights to include path traversal segments in archive entry names. | Low 2.1 | |
| CVE-2026-81316 | Same-named aggregates with differing filters are conflated in AshSql | Low 2.1 | |
| CVE-2026-81318 | Distinct-query aggregate drops the tenant schema prefix, leaking across tenants in AshSql | Low 2.1 | |
| CVE-2026-78691 | Unescaped backslash allows LIKE wildcard injection in AshSql string search | Low 2.1 |
Showing 751–800 of 11,311. Narrow the filters to see the rest.
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status. Filter by severity and year here; the other filters work on the curated lists.