Vulnerability Intelligence · All CVEs
Every Published CVE, Searchable.
Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status.
Synced hourly · figures as of Oct 20, 2026
40,422 vulnerabilities · newest first
- CVE-2026-79820Critical 9.0A remote user validation failure vulnerability exists in HPE Integrated Lights-Out (iLO) 7 firmware.Published Oct 5, 2026
- CVE-2026-105285Critical 10.0Totolink A3002MU QoS Rule formIpQoS stack-based overflowPublished Oct 5, 2026
- CVE-2026-105284Critical 10.0Totolink A3002MU Authentication Check boa sub_40FCFC improper authorizationPublished Oct 5, 2026
- CVE-2026-103510Critical 9.5Authentication bypass via blank auth token in P4SearchPublished Oct 5, 2026
- CVE-2026-100102Critical 9.5RCE via exposed JDWP debug agent in P4SearchPublished Oct 5, 2026
- CVE-2026-100103Critical 10.0Authentication bypass via default auth token in P4SearchPublished Oct 5, 2026
- CVE-2017-20285Critical 9.1YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary classes.Published Oct 5, 2026
- CVE-2026-105294Critical 9.1Legcord 1.1.0 through 1.3.0 contains a configuration injection vulnerability that allows script in the Discord page to write any config key via the window.legcord settings.setConfig bridge.Published Oct 5, 2026
- CVE-2026-105293Critical 9.2Legcord 1.1.0 through 1.3.0 contains a path traversal vulnerability in theme IPC handlers that allows script in the Discord page to escape the themes directory via unvalidated theme ids.Published Oct 5, 2026
- CVE-2026-105223Critical 9.1maclof kubernetes-client 0.17.0 before 0.32.0 disables TLS certificate verification in parseKubeconfig() and parseKubeconfigFile() when a kubeconfig lacks certificate-authority-data, ignoring insecure-skip-tls-verify.Published Oct 5, 2026
- CVE-2026-88424Critical 9.8FineAdmin v1.0 was discovered to contain a SQL injection vulnerability via the field/order parameter at ButtonService.GetListByFilter().Published Oct 5, 2026
- CVE-2026-88395Critical 9.8GouGuOA v6.0.5 and before is vulnerable to SQL Injection in /home/message/rubbish via the keywords parameter.Published Oct 5, 2026
- CVE-2026-88393Critical 9.8WookTeam v1.6.6 and before is vulnerable to RCE in the project task export interface /api/project/task/export.Published Oct 5, 2026
- CVE-2026-88391Critical 9.8Northstar (dromara/northstar, quantitative trading platform) <= 9.1.1 enables the H2 Console but its auth interceptor only covers /northstar/, so /h2-console is exposed with no authentication and the embedded H2 DB uses default sa /…Published Oct 5, 2026
- CVE-2026-37719Critical 9.8An issue in dormakaba evolo Service (all versions) allows a remote attacker to execute arbitrary code as SYSTEM via a .NET component.Published Oct 5, 2026
- CVE-2026-105222Critical 9.1The alexpechkarev/google-maps Laravel package through 12.16 disables TLS certificate verification by default because the bundled config sets ssl_verify_peer to FALSE, which is passed to CURLOPT_SSL_VERIFYPEER.Published Oct 4, 2026
- CVE-2026-105221Critical 9.1The gist RubyGem before 6.1.0 contains an improper certificate validation vulnerability that allows on-path attackers to intercept HTTPS traffic because http_connection in lib/gist.rb sets VERIFY_NONE.Published Oct 4, 2026
- CVE-2026-105218Critical 9.1gopay before 1.5.119 Disabled TLS Certificate Verification in xhttp ClientPublished Oct 4, 2026
- CVE-2026-105216Critical 9.1go-micro before 6.0.0 Disabled TLS Certificate Verification via tls.Config HelperPublished Oct 4, 2026
- CVE-2026-105089Critical 9.3WWBN AVideo through 29.2.0 contains a stored cross-site scripting vulnerability that allows users with upload permission to inject script by setting a malicious video trailer1 URL.Published Oct 4, 2026
- CVE-2026-105086Critical 9.3WWBN AVideo 12.4 through 29.2.0 contains a stored cross-site scripting vulnerability that allows authenticated uploaders to inject HTML by submitting doubly-encoded entities in video titles.Published Oct 4, 2026
- CVE-2026-105215Critical 9.3ZITADEL before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 UI because the 'external account not found' registration endpoint trusts client-supplied external identity fields without a completed IdP…Published Oct 4, 2026
- CVE-2026-105211Critical 9.2ZITADEL before 4.17.1 contains an authentication bypass vulnerability in Login V2 that allows unauthenticated attackers to take over accounts by obtaining OTP codes via the returnCode delivery type.Published Oct 4, 2026
- CVE-2026-105209Critical 9.3ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains an improper authorization vulnerability: when issuing passkey or passwordless enrollment codes, it checks only the organization in the x-zitadel-orgid header, not the target user's…Published Oct 4, 2026
- CVE-2026-105207Critical 9.3ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.17.3 creates links between user accounts and external identity providers without verifying a primary factor or the caller's permission, including on identify-only Login V2 sessions and via…Published Oct 4, 2026
- CVE-2026-103355Critical 9.3WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.20 - SQL Injection vulnerabilityPublished Oct 4, 2026
- CVE-2026-105135Critical 10.0InternLM MindSearch Planner Agent graph.py ExecutionAction.run code injectionPublished Oct 4, 2026
- CVE-2026-105134Critical 10.0Ahsay AhsayCBS Replication Receiver UpdateReceivers.do os command injectionAhsay · AhsayCBSPublished Oct 4, 2026
- CVE-2026-105105Critical 9.8CWE-306: Missing Authentication for Critical Function in the ait.core.server telemetry and command broker (ait-server) in NASA-AMMOS AIT-Core through 3.1.1 allows an unauthenticated remote attacker with network access to the ZeroMQ message bus to inject spacecraft command data,…Published Oct 3, 2026
- CVE-2026-71885Critical 9.2MLS X.509 credential not bound to the LeafNode signature keyPublished Oct 3, 2026
- CVE-2026-92084Critical 9.1Beaver Builder Page Builder <= 2.11.0.5 - Unauthenticated Arbitrary Shortcode Execution via Sidebar Module Widget OutputPublished Oct 3, 2026
- CVE-2026-87115Critical 9.1VikAppointments Services Booking Calendar <= 1.2.21 - Unauthenticated Arbitrary File Deletion via 'old_vapcfN' ParameterPublished Oct 3, 2026
- CVE-2026-105080Critical 9.4In ConvertX before 0.19.0, converters/calibre.ts does not block recipe files, and instead passes them to the ebook-convert program from Calibre.Published Oct 3, 2026
- CVE-2026-73802Critical 9.9gitea-runner: workflow container.options passes host namespaces and capability flags to job container when privileged mode is disabledPublished Oct 2, 2026
- CVE-2026-84411Critical 9.3The web management service in affected RouterOS versions contains an integer underflow in its HTTP request body handling that is reachable before authentication.Published Oct 2, 2026
- CVE-2026-95102Critical 9.3Monta monta.app Missing Authentication for Critical FunctionPublished Oct 2, 2026
- CVE-2026-75937Critical 9.4OS Command Injection in Digi Accelerated Linux (DAL OS)Published Oct 2, 2026
- CVE-2026-82042Critical 9.3UTMStack < 11.2.16 Authentication Bypass via InternalApiKeyFilterPublished Oct 2, 2026
- CVE-2026-104019Critical 9.3OS command injection in the Studio Space startup validation script in Amazon SageMaker Distribution when running on Amazon SageMaker Unified StudioPublished Oct 2, 2026
- CVE-2026-103956Critical 10.0Missing authentication for critical function in the authentication dependency in Loom for AWS before 1.6.1 allowed remote actors to obtain super-admin authority over the agent control plane, including registering tool servers, reading…Published Oct 2, 2026
- CVE-2023-54405Critical 9.3H3C CVM Unauthenticated File Upload via fileUpload/upload TokenPublished Oct 2, 2026
- CVE-2026-104849Critical 9.5Tinypool: Prototype Pollution Gadget to RCE in run() optionsPublished Oct 2, 2026
- CVE-2026-104846Critical 9.8Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities.Published Oct 2, 2026
- CVE-2026-103648Critical 9.1Path traversal in image-downloader 4.3.0 allows an attacker who can control the download URL to cause downloaded response data to be written outside the configured destination directory.Published Oct 2, 2026
- CVE-2026-103630Critical 9.6Use after free in FedCM in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page.Published Oct 2, 2026
- CVE-2026-103628Critical 9.6Out of bounds write in WebGL in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page.Published Oct 2, 2026
- CVE-2026-103626Critical 9.6Incorrect authorization in FileSystem in Google Chrome on on Windows prior to 154.0.8037.97 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page.Published Oct 2, 2026
- CVE-2026-104848Critical 9.5Tinypool: Prototype Pollution gadget in worker options leads to Remote Code ExecutionPublished Oct 2, 2026
- CVE-2026-90970Critical 9.9GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.1.6 before 19.2.4, 19.3 before 19.3.2, and 19.4 before 19.4.1 that, under certain conditions, could have allowed an…Published Oct 2, 2026
- CVE-2026-83632Critical 9.2Apache Thrift: C++ THttpTransport grows its line buffer without boundPublished Oct 2, 2026
| CVE | Title | Severity | Published |
|---|---|---|---|
| CVE-2026-79820 | A remote user validation failure vulnerability exists in HPE Integrated Lights-Out (iLO) 7 firmware. | Critical 9.0 | |
| CVE-2026-105285 | Totolink A3002MU QoS Rule formIpQoS stack-based overflow | Critical 10.0 | |
| CVE-2026-105284 | Totolink A3002MU Authentication Check boa sub_40FCFC improper authorization | Critical 10.0 | |
| CVE-2026-103510 | Authentication bypass via blank auth token in P4Search | Critical 9.5 | |
| CVE-2026-100102 | RCE via exposed JDWP debug agent in P4Search | Critical 9.5 | |
| CVE-2026-100103 | Authentication bypass via default auth token in P4Search | Critical 10.0 | |
| CVE-2017-20285 | YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary classes. | Critical 9.1 | |
| CVE-2026-105294 | Legcord 1.1.0 through 1.3.0 contains a configuration injection vulnerability that allows script in the Discord page to write any config key via the window.legcord settings.setConfig bridge. | Critical 9.1 | |
| CVE-2026-105293 | Legcord 1.1.0 through 1.3.0 contains a path traversal vulnerability in theme IPC handlers that allows script in the Discord page to escape the themes directory via unvalidated theme ids. | Critical 9.2 | |
| CVE-2026-105223 | maclof kubernetes-client 0.17.0 before 0.32.0 disables TLS certificate verification in parseKubeconfig() and parseKubeconfigFile() when a kubeconfig lacks certificate-authority-data, ignoring insecure-skip-tls-verify. | Critical 9.1 | |
| CVE-2026-88424 | FineAdmin v1.0 was discovered to contain a SQL injection vulnerability via the field/order parameter at ButtonService.GetListByFilter(). | Critical 9.8 | |
| CVE-2026-88395 | GouGuOA v6.0.5 and before is vulnerable to SQL Injection in /home/message/rubbish via the keywords parameter. | Critical 9.8 | |
| CVE-2026-88393 | WookTeam v1.6.6 and before is vulnerable to RCE in the project task export interface /api/project/task/export. | Critical 9.8 | |
| CVE-2026-88391 | Northstar (dromara/northstar, quantitative trading platform) <= 9.1.1 enables the H2 Console but its auth interceptor only covers /northstar/, so /h2-console is exposed with no authentication and the embedded H2 DB uses default sa /… | Critical 9.8 | |
| CVE-2026-37719 | An issue in dormakaba evolo Service (all versions) allows a remote attacker to execute arbitrary code as SYSTEM via a .NET component. | Critical 9.8 | |
| CVE-2026-105222 | The alexpechkarev/google-maps Laravel package through 12.16 disables TLS certificate verification by default because the bundled config sets ssl_verify_peer to FALSE, which is passed to CURLOPT_SSL_VERIFYPEER. | Critical 9.1 | |
| CVE-2026-105221 | The gist RubyGem before 6.1.0 contains an improper certificate validation vulnerability that allows on-path attackers to intercept HTTPS traffic because http_connection in lib/gist.rb sets VERIFY_NONE. | Critical 9.1 | |
| CVE-2026-105218 | gopay before 1.5.119 Disabled TLS Certificate Verification in xhttp Client | Critical 9.1 | |
| CVE-2026-105216 | go-micro before 6.0.0 Disabled TLS Certificate Verification via tls.Config Helper | Critical 9.1 | |
| CVE-2026-105089 | WWBN AVideo through 29.2.0 contains a stored cross-site scripting vulnerability that allows users with upload permission to inject script by setting a malicious video trailer1 URL. | Critical 9.3 | |
| CVE-2026-105086 | WWBN AVideo 12.4 through 29.2.0 contains a stored cross-site scripting vulnerability that allows authenticated uploaders to inject HTML by submitting doubly-encoded entities in video titles. | Critical 9.3 | |
| CVE-2026-105215 | ZITADEL before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 UI because the 'external account not found' registration endpoint trusts client-supplied external identity fields without a completed IdP… | Critical 9.3 | |
| CVE-2026-105211 | ZITADEL before 4.17.1 contains an authentication bypass vulnerability in Login V2 that allows unauthenticated attackers to take over accounts by obtaining OTP codes via the returnCode delivery type. | Critical 9.2 | |
| CVE-2026-105209 | ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains an improper authorization vulnerability: when issuing passkey or passwordless enrollment codes, it checks only the organization in the x-zitadel-orgid header, not the target user's… | Critical 9.3 | |
| CVE-2026-105207 | ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.17.3 creates links between user accounts and external identity providers without verifying a primary factor or the caller's permission, including on identify-only Login V2 sessions and via… | Critical 9.3 | |
| CVE-2026-103355 | WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.20 - SQL Injection vulnerability | Critical 9.3 | |
| CVE-2026-105135 | InternLM MindSearch Planner Agent graph.py ExecutionAction.run code injection | Critical 10.0 | |
| CVE-2026-105134 | Ahsay AhsayCBS Replication Receiver UpdateReceivers.do os command injection Ahsay · AhsayCBS | Critical 10.0 | |
| CVE-2026-105105 | CWE-306: Missing Authentication for Critical Function in the ait.core.server telemetry and command broker (ait-server) in NASA-AMMOS AIT-Core through 3.1.1 allows an unauthenticated remote attacker with network access to the ZeroMQ message bus to inject spacecraft command data,… | Critical 9.8 | |
| CVE-2026-71885 | MLS X.509 credential not bound to the LeafNode signature key | Critical 9.2 | |
| CVE-2026-92084 | Beaver Builder Page Builder <= 2.11.0.5 - Unauthenticated Arbitrary Shortcode Execution via Sidebar Module Widget Output | Critical 9.1 | |
| CVE-2026-87115 | VikAppointments Services Booking Calendar <= 1.2.21 - Unauthenticated Arbitrary File Deletion via 'old_vapcfN' Parameter | Critical 9.1 | |
| CVE-2026-105080 | In ConvertX before 0.19.0, converters/calibre.ts does not block recipe files, and instead passes them to the ebook-convert program from Calibre. | Critical 9.4 | |
| CVE-2026-73802 | gitea-runner: workflow container.options passes host namespaces and capability flags to job container when privileged mode is disabled | Critical 9.9 | |
| CVE-2026-84411 | The web management service in affected RouterOS versions contains an integer underflow in its HTTP request body handling that is reachable before authentication. | Critical 9.3 | |
| CVE-2026-95102 | Monta monta.app Missing Authentication for Critical Function | Critical 9.3 | |
| CVE-2026-75937 | OS Command Injection in Digi Accelerated Linux (DAL OS) | Critical 9.4 | |
| CVE-2026-82042 | UTMStack < 11.2.16 Authentication Bypass via InternalApiKeyFilter | Critical 9.3 | |
| CVE-2026-104019 | OS command injection in the Studio Space startup validation script in Amazon SageMaker Distribution when running on Amazon SageMaker Unified Studio | Critical 9.3 | |
| CVE-2026-103956 | Missing authentication for critical function in the authentication dependency in Loom for AWS before 1.6.1 allowed remote actors to obtain super-admin authority over the agent control plane, including registering tool servers, reading… | Critical 10.0 | |
| CVE-2023-54405 | H3C CVM Unauthenticated File Upload via fileUpload/upload Token | Critical 9.3 | |
| CVE-2026-104849 | Tinypool: Prototype Pollution Gadget to RCE in run() options | Critical 9.5 | |
| CVE-2026-104846 | Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. | Critical 9.8 | |
| CVE-2026-103648 | Path traversal in image-downloader 4.3.0 allows an attacker who can control the download URL to cause downloaded response data to be written outside the configured destination directory. | Critical 9.1 | |
| CVE-2026-103630 | Use after free in FedCM in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. | Critical 9.6 | |
| CVE-2026-103628 | Out of bounds write in WebGL in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. | Critical 9.6 | |
| CVE-2026-103626 | Incorrect authorization in FileSystem in Google Chrome on on Windows prior to 154.0.8037.97 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. | Critical 9.6 | |
| CVE-2026-104848 | Tinypool: Prototype Pollution gadget in worker options leads to Remote Code Execution | Critical 9.5 | |
| CVE-2026-90970 | GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.1.6 before 19.2.4, 19.3 before 19.3.2, and 19.4 before 19.4.1 that, under certain conditions, could have allowed an… | Critical 9.9 | |
| CVE-2026-83632 | Apache Thrift: C++ THttpTransport grows its line buffer without bound | Critical 9.2 |
Showing 801–850 of 40,422. Narrow the filters to see the rest.
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status. Filter by severity and year here; the other filters work on the curated lists.