Vulnerability Intelligence · All CVEs
Every Published CVE, Searchable.
Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status.
Synced hourly · figures as of Oct 20, 2026
138,428 vulnerabilities · newest first
- CVE-2026-24721Medium 5.3Null Pointer Dereference in File Station 5Published Oct 15, 2026
- CVE-2026-24718Medium 5.3Path Traversal Vulnerability in Qsync Central's qsyncsrv.cgiPublished Oct 15, 2026
- CVE-2026-24715Medium 5.3Lack of Reproducible Vulnerability Evidence in QNAP ReportPublished Oct 15, 2026
- CVE-2026-22896Medium 6.2Stored XSS via Interface Name in Network & Virtual Switch AppPublished Oct 15, 2026
- CVE-2025-68403Medium 4.6Inadequate Steps to Confirm Vulnerability in QuRouterPublished Oct 15, 2026
- CVE-2026-101302Medium 6.5Remote DoS via receive-side kernel TLSPublished Oct 15, 2026
- CVE-2026-110934Medium 4.4Improper validation of array index vulnerability in Samsung Open Source Vyond allows Input Data Manipulation.Published Oct 15, 2026
- CVE-2026-110933Medium 4.4Uncaught exception vulnerability in Samsung Open Source Vyond allows Input Data Manipulation.Published Oct 15, 2026
- CVE-2026-11905Medium 4.3Elementor Website Builder <= 4.2.3 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via 'is_public' and 'keys_conversion_map' ParametersPublished Oct 15, 2026
- CVE-2026-92429Medium 5.3Rede Itaú for WooCommerce 3.7.1 - 5.5.2 - Unauthenticated Order Status Manipulation via maxiPago Debit WebhookPublished Oct 15, 2026
- CVE-2026-92428Medium 5.3Rede Itaú for WooCommerce < 5.5.3 - Unauthenticated Order Status Manipulation via 3DS Failure WebhookPublished Oct 15, 2026
- CVE-2026-103324Medium 5.3Cardinity Payment Gateway for WooCommerce 3.2.6 - 3.4.1 - Unauthenticated Arbitrary Order Payment Forgery via Empty-Default Project SecretPublished Oct 15, 2026
- CVE-2026-76668Medium 6.3HPE NonStop Kernel - Access to unmapped or privileged dataPublished Oct 15, 2026
- CVE-2026-86803Medium 6.5The The Ocean Extra plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.6.0 This is due to the software allowing users to execute an action that does not properly validate a value…Published Oct 15, 2026
- CVE-2026-78087Medium 6.4The VK Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Group Block 'linkToPost' Feature in all versions up to, and including, 1.126.1 due to insufficient input sanitization and output escaping.Published Oct 15, 2026
- CVE-2026-78001Medium 6.4The Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Table Designer 'data-label' Attribute in all versions up to, and including, 1.27.13 due to…Published Oct 15, 2026
- CVE-2026-18557Medium 6.1The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'title' parameter in all versions up to, and including, 1.8.42 due to insufficient input sanitization…Published Oct 15, 2026
- CVE-2026-17001Medium 6.4The Import and export users and customers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom Column User Meta Profile Fields in all versions up to, and including, 2.4.5 due to insufficient input sanitization and…Published Oct 15, 2026
- CVE-2026-15180Medium 6.1The Tracking Code Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'TCM_ErrorMessages' POST Parameter in all versions up to, and including, 2.6.0 due to insufficient input sanitization and output escaping.Published Oct 15, 2026
- CVE-2026-110926Medium 5.3When compression is negotiated, channels on the same connection share one LZ77 dictionary.Published Oct 15, 2026
- CVE-2026-110925Medium 5.4A username entered on the ssh command line can still contain '$' or a non-trailing backslash.Published Oct 15, 2026
- CVE-2026-110923Medium 6.5During an sftp copy, a malicious server can supply an empty name, a slash-only path, or a ".." basename that sftp uses as the local destination, writing outside the directory the user selected.Published Oct 15, 2026
- CVE-2026-106031Medium 6.5Spin Wheel < 2.2.1 - Unauthenticated Coupon Code Disclosure via Forged Spin ResultPublished Oct 15, 2026
- CVE-2026-104643Medium 4.2Easy HTTPS Redirection (SSL) < 2.0.2 - Subscriber+ Scan Result Disclosure and Site-Wide URL RewritePublished Oct 15, 2026
- CVE-2026-103304Medium 5.3eaSYNC < 1.3.31 - Unauthenticated Cancellation Request Creation and Email Template UpdatePublished Oct 15, 2026
- CVE-2026-76667Medium 5.7A security vulnerability in HPE NonStop EXPAND may result in out-of-bounds memory read.Published Oct 15, 2026
- CVE-2026-76666Medium 4.7A security vulnerability in HPE NonStop EXPAND may result in out-of-bounds memory read.Published Oct 15, 2026
- CVE-2026-14572Medium 6.4The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Page Builder Text Content in all versions up to, and including, 6.2.0 due to insufficient input…Published Oct 15, 2026
- CVE-2026-76664Medium 6.4A security vulnerability in HPE NonStop EXPAND may result in out-of-bounds memory read/write operationsPublished Oct 15, 2026
- CVE-2026-110909Medium 5.0Wheels CLI through 4.1.0 does not verify that the local development server answering its HTTP requests belongs to the current project.Published Oct 15, 2026
- CVE-2026-76656Medium 5.3A vulnerability in HPE NonStop TCP/IP UTILITIES could allow an unauthenticated remote attacker to cause a denial of service when traceroute is executed under certain conditions.Published Oct 15, 2026
- CVE-2026-110904Medium 5.3ApostropheCMS before 4.33.0 allows authentication bypass for REST API page reading, as demonstrated by a /api/v1/@apostrophecms/page?all=1 call.Published Oct 15, 2026
- CVE-2026-76662Medium 5.9HPE NonStop TELSERV - Memory corruption vulnerabilityPublished Oct 15, 2026
- CVE-2026-110809Medium 5.3A security vulnerability has been detected in sgl-project SGLang up to 0.5.19.Published Oct 15, 2026
- CVE-2026-95180Medium 5.5An issue in Justson agentweb-core v5.1.6-androidx and earlier allows a local attacker to obtain sensitive information and launch non-exported host application components via incorrect access control in the handling of intent:// URLS in…Published Oct 15, 2026
- CVE-2026-78851Medium 6.5Directory Traversal vulnerability in Grav CMS 2.0.3 through 2.0.6 allows a remote attacker to obtain sensitive information via the GravExtension.php and the mediaDirFunc method.Published Oct 15, 2026
- CVE-2026-78850Medium 5.0An issue in Matomo v.5.11.2 allows a remote attacker to obtain sensitive information via the SiteContentDetector / SitesManager componentPublished Oct 15, 2026
- CVE-2026-106707Medium 5.4XXL-JOB <=3.5.0-SNAPSHOT contains a stored Cross-Site Scripting (XSS) vulnerability in the job log list page (/joblog).Published Oct 15, 2026
- CVE-2026-106706Medium 5.4XXL-JOB through 3.5.0-SNAPSHOT is vulnerable to stored cross-site scripting (XSS) in the GLUE code editor.Published Oct 15, 2026
- CVE-2026-106701Medium 6.1ELADMIN v2.7 and before is vulnerable to Cross Site Scripting (XSS) via the component WebSocketServer, SpringSecurityConfig, deploy.vue.Published Oct 15, 2026
- CVE-2026-110870Medium 6.9Nodemailer from 3.0.0 before 10.0.13 contains an improper input validation vulnerability in its address parser that fails to strip RFC 5322 comments inside angle-bracket addresses.Published Oct 14, 2026
- CVE-2026-110866Medium 5.3Renovate before 44.61.3 contains a protection mechanism bypass vulnerability that allows minimumReleaseAge checks to be skipped when a user requests a PR rebase via the rebase/retry checkbox.Published Oct 14, 2026
- CVE-2026-110861Medium 6.3Better Auth @better-auth/drizzle-adapter and better-auth from 1.6.17 before 1.7.7, and @better-auth/kysely-adapter from 1.6.17 before 1.7.0, contain a race condition in database-backed rate limiting on PostgreSQL where the limit check is…Published Oct 14, 2026
- CVE-2026-110860Medium 6.9GitPython from 3.1.62 before 3.2.0 contains a symlink-following flaw in Submodule.move(), which checks the destination only lexically and does not reject symbolic links in intermediate path components.Published Oct 14, 2026
- CVE-2026-110852Medium 6.3n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains an authentication bypass because dynamic-path webhook resolution matched requests on the path alone, ignoring the server-generated identifier that is the URL's only…Published Oct 14, 2026
- CVE-2026-110851Medium 6.1n8n before 2.41.4 and 2.42.x before 2.42.1 contains an authorization bypass in the Agents create endpoint, which accepts a caller-supplied Agent ID, checks permissions only against the requested project, and updates an existing Agent…Published Oct 14, 2026
- CVE-2026-110848Medium 6.0n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains a prototype pollution vulnerability in the AI workflow builder, which merges workflow connections using node names as object members without checking for reserved…Published Oct 14, 2026
- CVE-2026-110841Medium 6.1n8n before 2.41.4 and 2.42.0 contains an authorization bypass in the agent chat resume endpoint, which accepts a run identifier from the request body without verifying that the suspended checkpoint belongs to the caller.Published Oct 14, 2026
- CVE-2026-110837Medium 6.1FreeRDP 2.0.0 before 3.32.0, when built with WITH_LAME=ON and WITH_DSP_FFMPEG=OFF, has a heap-based buffer overflow in freerdp_dsp_decode_mp3 because the right-channel PCM pointer is offset by a byte count treated as short elements.Published Oct 14, 2026
- CVE-2026-110835Medium 6.3FreeRDP 3.0.0 before 3.32.0 allows HTTP header injection in its proxy because a lone LF in the target portion of a routing token (Cookie: msts=) is not rejected and is written by http_proxy_connect into the CONNECT request line and Host…Published Oct 14, 2026
| CVE | Title | Severity | Published |
|---|---|---|---|
| CVE-2026-24721 | Null Pointer Dereference in File Station 5 | Medium 5.3 | |
| CVE-2026-24718 | Path Traversal Vulnerability in Qsync Central's qsyncsrv.cgi | Medium 5.3 | |
| CVE-2026-24715 | Lack of Reproducible Vulnerability Evidence in QNAP Report | Medium 5.3 | |
| CVE-2026-22896 | Stored XSS via Interface Name in Network & Virtual Switch App | Medium 6.2 | |
| CVE-2025-68403 | Inadequate Steps to Confirm Vulnerability in QuRouter | Medium 4.6 | |
| CVE-2026-101302 | Remote DoS via receive-side kernel TLS | Medium 6.5 | |
| CVE-2026-110934 | Improper validation of array index vulnerability in Samsung Open Source Vyond allows Input Data Manipulation. | Medium 4.4 | |
| CVE-2026-110933 | Uncaught exception vulnerability in Samsung Open Source Vyond allows Input Data Manipulation. | Medium 4.4 | |
| CVE-2026-11905 | Elementor Website Builder <= 4.2.3 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via 'is_public' and 'keys_conversion_map' Parameters | Medium 4.3 | |
| CVE-2026-92429 | Rede Itaú for WooCommerce 3.7.1 - 5.5.2 - Unauthenticated Order Status Manipulation via maxiPago Debit Webhook | Medium 5.3 | |
| CVE-2026-92428 | Rede Itaú for WooCommerce < 5.5.3 - Unauthenticated Order Status Manipulation via 3DS Failure Webhook | Medium 5.3 | |
| CVE-2026-103324 | Cardinity Payment Gateway for WooCommerce 3.2.6 - 3.4.1 - Unauthenticated Arbitrary Order Payment Forgery via Empty-Default Project Secret | Medium 5.3 | |
| CVE-2026-76668 | HPE NonStop Kernel - Access to unmapped or privileged data | Medium 6.3 | |
| CVE-2026-86803 | The The Ocean Extra plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.6.0 This is due to the software allowing users to execute an action that does not properly validate a value… | Medium 6.5 | |
| CVE-2026-78087 | The VK Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Group Block 'linkToPost' Feature in all versions up to, and including, 1.126.1 due to insufficient input sanitization and output escaping. | Medium 6.4 | |
| CVE-2026-78001 | The Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Table Designer 'data-label' Attribute in all versions up to, and including, 1.27.13 due to… | Medium 6.4 | |
| CVE-2026-18557 | The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'title' parameter in all versions up to, and including, 1.8.42 due to insufficient input sanitization… | Medium 6.1 | |
| CVE-2026-17001 | The Import and export users and customers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom Column User Meta Profile Fields in all versions up to, and including, 2.4.5 due to insufficient input sanitization and… | Medium 6.4 | |
| CVE-2026-15180 | The Tracking Code Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'TCM_ErrorMessages' POST Parameter in all versions up to, and including, 2.6.0 due to insufficient input sanitization and output escaping. | Medium 6.1 | |
| CVE-2026-110926 | When compression is negotiated, channels on the same connection share one LZ77 dictionary. | Medium 5.3 | |
| CVE-2026-110925 | A username entered on the ssh command line can still contain '$' or a non-trailing backslash. | Medium 5.4 | |
| CVE-2026-110923 | During an sftp copy, a malicious server can supply an empty name, a slash-only path, or a ".." basename that sftp uses as the local destination, writing outside the directory the user selected. | Medium 6.5 | |
| CVE-2026-106031 | Spin Wheel < 2.2.1 - Unauthenticated Coupon Code Disclosure via Forged Spin Result | Medium 6.5 | |
| CVE-2026-104643 | Easy HTTPS Redirection (SSL) < 2.0.2 - Subscriber+ Scan Result Disclosure and Site-Wide URL Rewrite | Medium 4.2 | |
| CVE-2026-103304 | eaSYNC < 1.3.31 - Unauthenticated Cancellation Request Creation and Email Template Update | Medium 5.3 | |
| CVE-2026-76667 | A security vulnerability in HPE NonStop EXPAND may result in out-of-bounds memory read. | Medium 5.7 | |
| CVE-2026-76666 | A security vulnerability in HPE NonStop EXPAND may result in out-of-bounds memory read. | Medium 4.7 | |
| CVE-2026-14572 | The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Page Builder Text Content in all versions up to, and including, 6.2.0 due to insufficient input… | Medium 6.4 | |
| CVE-2026-76664 | A security vulnerability in HPE NonStop EXPAND may result in out-of-bounds memory read/write operations | Medium 6.4 | |
| CVE-2026-110909 | Wheels CLI through 4.1.0 does not verify that the local development server answering its HTTP requests belongs to the current project. | Medium 5.0 | |
| CVE-2026-76656 | A vulnerability in HPE NonStop TCP/IP UTILITIES could allow an unauthenticated remote attacker to cause a denial of service when traceroute is executed under certain conditions. | Medium 5.3 | |
| CVE-2026-110904 | ApostropheCMS before 4.33.0 allows authentication bypass for REST API page reading, as demonstrated by a /api/v1/@apostrophecms/page?all=1 call. | Medium 5.3 | |
| CVE-2026-76662 | HPE NonStop TELSERV - Memory corruption vulnerability | Medium 5.9 | |
| CVE-2026-110809 | A security vulnerability has been detected in sgl-project SGLang up to 0.5.19. | Medium 5.3 | |
| CVE-2026-95180 | An issue in Justson agentweb-core v5.1.6-androidx and earlier allows a local attacker to obtain sensitive information and launch non-exported host application components via incorrect access control in the handling of intent:// URLS in… | Medium 5.5 | |
| CVE-2026-78851 | Directory Traversal vulnerability in Grav CMS 2.0.3 through 2.0.6 allows a remote attacker to obtain sensitive information via the GravExtension.php and the mediaDirFunc method. | Medium 6.5 | |
| CVE-2026-78850 | An issue in Matomo v.5.11.2 allows a remote attacker to obtain sensitive information via the SiteContentDetector / SitesManager component | Medium 5.0 | |
| CVE-2026-106707 | XXL-JOB <=3.5.0-SNAPSHOT contains a stored Cross-Site Scripting (XSS) vulnerability in the job log list page (/joblog). | Medium 5.4 | |
| CVE-2026-106706 | XXL-JOB through 3.5.0-SNAPSHOT is vulnerable to stored cross-site scripting (XSS) in the GLUE code editor. | Medium 5.4 | |
| CVE-2026-106701 | ELADMIN v2.7 and before is vulnerable to Cross Site Scripting (XSS) via the component WebSocketServer, SpringSecurityConfig, deploy.vue. | Medium 6.1 | |
| CVE-2026-110870 | Nodemailer from 3.0.0 before 10.0.13 contains an improper input validation vulnerability in its address parser that fails to strip RFC 5322 comments inside angle-bracket addresses. | Medium 6.9 | |
| CVE-2026-110866 | Renovate before 44.61.3 contains a protection mechanism bypass vulnerability that allows minimumReleaseAge checks to be skipped when a user requests a PR rebase via the rebase/retry checkbox. | Medium 5.3 | |
| CVE-2026-110861 | Better Auth @better-auth/drizzle-adapter and better-auth from 1.6.17 before 1.7.7, and @better-auth/kysely-adapter from 1.6.17 before 1.7.0, contain a race condition in database-backed rate limiting on PostgreSQL where the limit check is… | Medium 6.3 | |
| CVE-2026-110860 | GitPython from 3.1.62 before 3.2.0 contains a symlink-following flaw in Submodule.move(), which checks the destination only lexically and does not reject symbolic links in intermediate path components. | Medium 6.9 | |
| CVE-2026-110852 | n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains an authentication bypass because dynamic-path webhook resolution matched requests on the path alone, ignoring the server-generated identifier that is the URL's only… | Medium 6.3 | |
| CVE-2026-110851 | n8n before 2.41.4 and 2.42.x before 2.42.1 contains an authorization bypass in the Agents create endpoint, which accepts a caller-supplied Agent ID, checks permissions only against the requested project, and updates an existing Agent… | Medium 6.1 | |
| CVE-2026-110848 | n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains a prototype pollution vulnerability in the AI workflow builder, which merges workflow connections using node names as object members without checking for reserved… | Medium 6.0 | |
| CVE-2026-110841 | n8n before 2.41.4 and 2.42.0 contains an authorization bypass in the agent chat resume endpoint, which accepts a run identifier from the request body without verifying that the suspended checkpoint belongs to the caller. | Medium 6.1 | |
| CVE-2026-110837 | FreeRDP 2.0.0 before 3.32.0, when built with WITH_LAME=ON and WITH_DSP_FFMPEG=OFF, has a heap-based buffer overflow in freerdp_dsp_decode_mp3 because the right-channel PCM pointer is offset by a byte count treated as short elements. | Medium 6.1 | |
| CVE-2026-110835 | FreeRDP 3.0.0 before 3.32.0 allows HTTP header injection in its proxy because a lone LF in the target portion of a routing token (Cookie: msts=) is not rejected and is written by http_proxy_connect into the CONNECT request line and Host… | Medium 6.3 |
Showing 751–800 of 138,428. Narrow the filters to see the rest.
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status. Filter by severity and year here; the other filters work on the curated lists.