Vulnerability Intelligence · All CVEs
Every Published CVE, Searchable.
Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status.
Synced hourly · figures as of Oct 20, 2026
138,428 vulnerabilities · newest first
- CVE-2026-110831Medium 5.3FreeRDP versions 3.13.0 before 3.32.0 contain a resource retention flaw in drive_process_irp_create, which registers an opened local file in the drive dictionary before applying the allocation size and does not remove it when that…Published Oct 14, 2026
- CVE-2026-110807Medium 5.3A weakness has been identified in sgl-project SGLang up to 0.5.19.Published Oct 14, 2026
- CVE-2026-110816Medium 6.3qs.stringify with arrayFormat: 'comma' throws TypeError: Cannot convert object to primitive value when an array element cannot be coerced to a string, such as an object with an own non-callable toString ({…Published Oct 14, 2026
- CVE-2026-110698Medium 5.3A security vulnerability has been detected in Praat up to 7.0.02.Published Oct 14, 2026
- CVE-2026-110696Medium 6.9A weakness has been identified in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449.Published Oct 14, 2026
- CVE-2026-110695Medium 5.3A vulnerability was detected in turboderp ExLlamaV2 up to 0.3.2.Published Oct 14, 2026
- CVE-2026-77427Medium 5.9From 3.9.0 until 3.22.0, pristine manual FileRise installations without PERSISTENT_TOKENS_KEY or metadata/persistent_tokens.key can…Published Oct 14, 2026
- CVE-2026-69194Medium 4.8Prior to 3.21.0, FileRise returns the stored branding.footerHtml value through the unauthenticated public site configuration API…Published Oct 14, 2026
- CVE-2026-69193Medium 6.5Prior to 3.21.0, FileRise tracks failed logins only by the combination of source IP address and username.Published Oct 14, 2026
- CVE-2026-69191Medium 5.4Prior to 3.21.0, FileRise enforces disableFormLogin, disableBasicAuth, and disableOIDCLogin in the client interface but not…Published Oct 14, 2026
- CVE-2026-62664Medium 5.4Prior to 3.19.0, FileRise validates the complete folderName string but does not reject dot-dot path segments before…Published Oct 14, 2026
- CVE-2026-57493Medium 6.8Prior to 3.16.0, FileRise stores the isAdmin flag in remember-me tokens and restores that stale value during automatic login instead…Published Oct 14, 2026
- CVE-2026-57491Medium 6.5Prior to 3.16.0, FileRise archive extraction does not apply UploadNamePolicy::isAllowedForWrite() before ZipArchive::extractTo()…Published Oct 14, 2026
- CVE-2026-110694Medium 5.3Such manipulation of the…Published Oct 14, 2026
- CVE-2026-110689Medium 4.8This impacts the function shouldSkipTargetPath of the file internal/runner/runner.go of the component Static Scanner.Published Oct 14, 2026
- CVE-2026-110679Medium 6.9A vulnerability was determined in OpenSIPS up to 3.6.8/4.0.1.Published Oct 14, 2026
- CVE-2026-110670Medium 6.9The manipulation of the argument s2host results in sql injection.Published Oct 14, 2026
- CVE-2026-104110Medium 5.3Prior to 3.24.0, FileRise Pro /api/pro/portals/get.php returns a configured client portal's full internal record to an unauthenticated…Published Oct 14, 2026
- CVE-2026-104109Medium 6.8Prior to 3.23.0, FileRise validates archive entry names but extracts them directly into the authorized live destination before…Published Oct 14, 2026
- CVE-2026-104107Medium 6.5In FileRise 3.22.0, the /api/file/saveFile.php operation accepts dot and dot-dot segments in its attacker-controlled folder input…Published Oct 14, 2026
- CVE-2026-104106Medium 6.5Prior to 3.23.0, FileRise permits an authenticated session with a valid CSRF token to disable TOTP without recent full…Published Oct 14, 2026
- CVE-2026-104105Medium 6.4Prior to 3.23.0, FileRise verifies that a TOTP code is valid for the accepted time window but does not record that the same account…Published Oct 14, 2026
- CVE-2026-103988Medium 5.4Prior to 3.23.0, FileRise /api/folder/renameFolder.php authorizes an authenticated, non-folder-scoped, non-administrator with a valid…Published Oct 14, 2026
- CVE-2026-0320Medium 6.1A command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restrictions and run arbitrary commands as a root user.Published Oct 14, 2026
- CVE-2026-0319Medium 4.9An improper input handling vulnerability in the GlobalProtect™ gateway of Palo Alto Networks PAN-OS software enables an authenticated user to establish a GlobalProtect session using the identity of another user.Published Oct 14, 2026
- CVE-2026-0318Medium 4.6A stack-based buffer overflow vulnerability in the log processing functionality of Palo Alto Networks PAN-OS® software on Panorama enables an attacker to cause a denial of service (DoS) condition.Published Oct 14, 2026
- CVE-2026-0315Medium 5.9A local privilege escalation vulnerability in the Palo Alto Networks GlobalProtect™ app enables a local user to escalate their privileges to root on macOS.Published Oct 14, 2026
- CVE-2026-0314Medium 4.3A type confusion vulnerability in Palo Alto Networks GlobalProtect™ app on Windows enables a local user with low privileges to cause a denial of service (DoS) condition.Published Oct 14, 2026
- CVE-2026-0313Medium 6.1A command injection vulnerability in Palo Alto Networks Cortex XSOAR and Cortex XSIAM OS Query content pack enables an authenticated administrator to execute arbitrary OS commands on remote endpoints.Published Oct 14, 2026
- CVE-2026-0312Medium 4.3Path traversal vulnerabilities in Palo Alto Networks Checkov by Prisma® Cloud enable an unauthenticated local user to write files to arbitrary locations on the scanning filesystem.Published Oct 14, 2026
- CVE-2026-55679Medium 6.5Prior to 3.8.6, the pre-installation web/instalador/instalador.php endpoint is reachable before config.php exists and processes unauthenticated installation POST data.Published Oct 14, 2026
- CVE-2026-55498Medium 4.8Prior to 3.15.0, FileRise public shared-folder links with subfolder browsing enabled can follow a symbolic link inside the shared…Published Oct 14, 2026
- CVE-2026-55385Medium 6.8Prior to version 2.4.0, InvoiceShelf's PDFConfigurationRequest.php validates the owner-controlled…Published Oct 14, 2026
- CVE-2026-110669Medium 6.9A security vulnerability has been detected in cemtan sar2html 4.0.0.Published Oct 14, 2026
- CVE-2026-110668Medium 6.9A weakness has been identified in cemtan sar2html 4.0.0.Published Oct 14, 2026
- CVE-2026-110310Medium 6.0A remote user who can read encrypted objects in the S3 bucket can force a padding downgrade by altering the padding scheme recorded in an object's metadata to legacy PKCS#1 v1.5.Published Oct 14, 2026
- CVE-2026-102985Medium 6.5In 1.3.1 and earlier, ProjectMemberViewSet.partial_update places its authorization checks inside the role update branch, so a guest or member can omit role and change another ProjectMember…Published Oct 14, 2026
- CVE-2026-102980Medium 6.5Prior to 1.4.0, PageVersionEndpoint in apps/api/plane/app/views/page/version.py scopes page-version lookups by workspace and page identifiers but not by the project_id from the URL.Published Oct 14, 2026
- CVE-2026-0321Medium 6.6Denial of service vulnerabilities in Palo Alto Networks PAN-OS® software allow an unauthenticated attacker with network access to cause a denial of service (DoS) condition by sending specially crafted network traffic to or through a…Published Oct 14, 2026
- CVE-2026-62847Medium 6.0Metalama allows local code execution through DLL planting in shared temporary directoriesPublished Oct 14, 2026
- CVE-2026-55384Medium 5.3Prior to version 2.4.0, InvoiceShelf invoice, estimate, and recurring-invoice creation paths accept…Published Oct 14, 2026
- CVE-2026-82402Medium 5.3Prior to 0.15.0+dev, an unauthenticated attacker can provide a backslash-containing target to the /redirect endpoint, and similar post-action redirect flows are also affected.Published Oct 14, 2026
- CVE-2026-55167Medium 4.2users, groups, DHCP settings) stored in an LDAP directory.Published Oct 14, 2026
- CVE-2026-110774Medium 6.0Blinko through 1.8.8 contains a broken access control vulnerability in the /api/file route that allows authenticated users to read other users' private attachments due to a flawed owner check.Published Oct 14, 2026
- CVE-2026-110773Medium 5.3GrowChief through 0.3.0 contains a missing authorization vulnerability in the getAllUsers handler that allows any authenticated user to list users across all organizations because the IsSuperAdmin guard is absent.Published Oct 14, 2026
- CVE-2026-110772Medium 5.3Sure 0.7.0 through 0.7.6-alpha.6 contains a missing authorization vulnerability in Transactions::BulkUpdatesController#create that allows family members to bypass account sharing permissions.Published Oct 14, 2026
- CVE-2026-110771Medium 5.3Shopizer through 3.2.5 contains an authorization bypass vulnerability that allows authenticated customers to post reviews as other customers by supplying a customerId field.Published Oct 14, 2026
- CVE-2026-110768Medium 6.3holaOS through 2026.822.1 contains an authorization bypass vulnerability in the channel-gateway Telegram connector that authorizes senders by mutable username rather than only numeric id.Published Oct 14, 2026
- CVE-2026-110766Medium 5.3Colanode server through 0.4.7 contains a path traversal vulnerability that allows authenticated users to read arbitrary .jpeg files by supplying an encoded traversal sequence in avatarId.Published Oct 14, 2026
- CVE-2026-110764Medium 6.0AstronRPA through 1.1.6 contains an insecure direct object reference vulnerability in the resource-service /file/download endpoint that allows authenticated users to download other tenants' files by supplying their fileId.Published Oct 14, 2026
| CVE | Title | Severity | Published |
|---|---|---|---|
| CVE-2026-110831 | FreeRDP versions 3.13.0 before 3.32.0 contain a resource retention flaw in drive_process_irp_create, which registers an opened local file in the drive dictionary before applying the allocation size and does not remove it when that… | Medium 5.3 | |
| CVE-2026-110807 | A weakness has been identified in sgl-project SGLang up to 0.5.19. | Medium 5.3 | |
| CVE-2026-110816 | qs.stringify with arrayFormat: 'comma' throws TypeError: Cannot convert object to primitive value when an array element cannot be coerced to a string, such as an object with an own non-callable toString ({… | Medium 6.3 | |
| CVE-2026-110698 | A security vulnerability has been detected in Praat up to 7.0.02. | Medium 5.3 | |
| CVE-2026-110696 | A weakness has been identified in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. | Medium 6.9 | |
| CVE-2026-110695 | A vulnerability was detected in turboderp ExLlamaV2 up to 0.3.2. | Medium 5.3 | |
| CVE-2026-77427 | From 3.9.0 until 3.22.0, pristine manual FileRise installations without PERSISTENT_TOKENS_KEY or metadata/persistent_tokens.key can… | Medium 5.9 | |
| CVE-2026-69194 | Prior to 3.21.0, FileRise returns the stored branding.footerHtml value through the unauthenticated public site configuration API… | Medium 4.8 | |
| CVE-2026-69193 | Prior to 3.21.0, FileRise tracks failed logins only by the combination of source IP address and username. | Medium 6.5 | |
| CVE-2026-69191 | Prior to 3.21.0, FileRise enforces disableFormLogin, disableBasicAuth, and disableOIDCLogin in the client interface but not… | Medium 5.4 | |
| CVE-2026-62664 | Prior to 3.19.0, FileRise validates the complete folderName string but does not reject dot-dot path segments before… | Medium 5.4 | |
| CVE-2026-57493 | Prior to 3.16.0, FileRise stores the isAdmin flag in remember-me tokens and restores that stale value during automatic login instead… | Medium 6.8 | |
| CVE-2026-57491 | Prior to 3.16.0, FileRise archive extraction does not apply UploadNamePolicy::isAllowedForWrite() before ZipArchive::extractTo()… | Medium 6.5 | |
| CVE-2026-110694 | Such manipulation of the… | Medium 5.3 | |
| CVE-2026-110689 | This impacts the function shouldSkipTargetPath of the file internal/runner/runner.go of the component Static Scanner. | Medium 4.8 | |
| CVE-2026-110679 | A vulnerability was determined in OpenSIPS up to 3.6.8/4.0.1. | Medium 6.9 | |
| CVE-2026-110670 | The manipulation of the argument s2host results in sql injection. | Medium 6.9 | |
| CVE-2026-104110 | Prior to 3.24.0, FileRise Pro /api/pro/portals/get.php returns a configured client portal's full internal record to an unauthenticated… | Medium 5.3 | |
| CVE-2026-104109 | Prior to 3.23.0, FileRise validates archive entry names but extracts them directly into the authorized live destination before… | Medium 6.8 | |
| CVE-2026-104107 | In FileRise 3.22.0, the /api/file/saveFile.php operation accepts dot and dot-dot segments in its attacker-controlled folder input… | Medium 6.5 | |
| CVE-2026-104106 | Prior to 3.23.0, FileRise permits an authenticated session with a valid CSRF token to disable TOTP without recent full… | Medium 6.5 | |
| CVE-2026-104105 | Prior to 3.23.0, FileRise verifies that a TOTP code is valid for the accepted time window but does not record that the same account… | Medium 6.4 | |
| CVE-2026-103988 | Prior to 3.23.0, FileRise /api/folder/renameFolder.php authorizes an authenticated, non-folder-scoped, non-administrator with a valid… | Medium 5.4 | |
| CVE-2026-0320 | A command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restrictions and run arbitrary commands as a root user. | Medium 6.1 | |
| CVE-2026-0319 | An improper input handling vulnerability in the GlobalProtect™ gateway of Palo Alto Networks PAN-OS software enables an authenticated user to establish a GlobalProtect session using the identity of another user. | Medium 4.9 | |
| CVE-2026-0318 | A stack-based buffer overflow vulnerability in the log processing functionality of Palo Alto Networks PAN-OS® software on Panorama enables an attacker to cause a denial of service (DoS) condition. | Medium 4.6 | |
| CVE-2026-0315 | A local privilege escalation vulnerability in the Palo Alto Networks GlobalProtect™ app enables a local user to escalate their privileges to root on macOS. | Medium 5.9 | |
| CVE-2026-0314 | A type confusion vulnerability in Palo Alto Networks GlobalProtect™ app on Windows enables a local user with low privileges to cause a denial of service (DoS) condition. | Medium 4.3 | |
| CVE-2026-0313 | A command injection vulnerability in Palo Alto Networks Cortex XSOAR and Cortex XSIAM OS Query content pack enables an authenticated administrator to execute arbitrary OS commands on remote endpoints. | Medium 6.1 | |
| CVE-2026-0312 | Path traversal vulnerabilities in Palo Alto Networks Checkov by Prisma® Cloud enable an unauthenticated local user to write files to arbitrary locations on the scanning filesystem. | Medium 4.3 | |
| CVE-2026-55679 | Prior to 3.8.6, the pre-installation web/instalador/instalador.php endpoint is reachable before config.php exists and processes unauthenticated installation POST data. | Medium 6.5 | |
| CVE-2026-55498 | Prior to 3.15.0, FileRise public shared-folder links with subfolder browsing enabled can follow a symbolic link inside the shared… | Medium 4.8 | |
| CVE-2026-55385 | Prior to version 2.4.0, InvoiceShelf's PDFConfigurationRequest.php validates the owner-controlled… | Medium 6.8 | |
| CVE-2026-110669 | A security vulnerability has been detected in cemtan sar2html 4.0.0. | Medium 6.9 | |
| CVE-2026-110668 | A weakness has been identified in cemtan sar2html 4.0.0. | Medium 6.9 | |
| CVE-2026-110310 | A remote user who can read encrypted objects in the S3 bucket can force a padding downgrade by altering the padding scheme recorded in an object's metadata to legacy PKCS#1 v1.5. | Medium 6.0 | |
| CVE-2026-102985 | In 1.3.1 and earlier, ProjectMemberViewSet.partial_update places its authorization checks inside the role update branch, so a guest or member can omit role and change another ProjectMember… | Medium 6.5 | |
| CVE-2026-102980 | Prior to 1.4.0, PageVersionEndpoint in apps/api/plane/app/views/page/version.py scopes page-version lookups by workspace and page identifiers but not by the project_id from the URL. | Medium 6.5 | |
| CVE-2026-0321 | Denial of service vulnerabilities in Palo Alto Networks PAN-OS® software allow an unauthenticated attacker with network access to cause a denial of service (DoS) condition by sending specially crafted network traffic to or through a… | Medium 6.6 | |
| CVE-2026-62847 | Metalama allows local code execution through DLL planting in shared temporary directories | Medium 6.0 | |
| CVE-2026-55384 | Prior to version 2.4.0, InvoiceShelf invoice, estimate, and recurring-invoice creation paths accept… | Medium 5.3 | |
| CVE-2026-82402 | Prior to 0.15.0+dev, an unauthenticated attacker can provide a backslash-containing target to the /redirect endpoint, and similar post-action redirect flows are also affected. | Medium 5.3 | |
| CVE-2026-55167 | users, groups, DHCP settings) stored in an LDAP directory. | Medium 4.2 | |
| CVE-2026-110774 | Blinko through 1.8.8 contains a broken access control vulnerability in the /api/file route that allows authenticated users to read other users' private attachments due to a flawed owner check. | Medium 6.0 | |
| CVE-2026-110773 | GrowChief through 0.3.0 contains a missing authorization vulnerability in the getAllUsers handler that allows any authenticated user to list users across all organizations because the IsSuperAdmin guard is absent. | Medium 5.3 | |
| CVE-2026-110772 | Sure 0.7.0 through 0.7.6-alpha.6 contains a missing authorization vulnerability in Transactions::BulkUpdatesController#create that allows family members to bypass account sharing permissions. | Medium 5.3 | |
| CVE-2026-110771 | Shopizer through 3.2.5 contains an authorization bypass vulnerability that allows authenticated customers to post reviews as other customers by supplying a customerId field. | Medium 5.3 | |
| CVE-2026-110768 | holaOS through 2026.822.1 contains an authorization bypass vulnerability in the channel-gateway Telegram connector that authorizes senders by mutable username rather than only numeric id. | Medium 6.3 | |
| CVE-2026-110766 | Colanode server through 0.4.7 contains a path traversal vulnerability that allows authenticated users to read arbitrary .jpeg files by supplying an encoded traversal sequence in avatarId. | Medium 5.3 | |
| CVE-2026-110764 | AstronRPA through 1.1.6 contains an insecure direct object reference vulnerability in the resource-service /file/download endpoint that allows authenticated users to download other tenants' files by supplying their fileId. | Medium 6.0 |
Showing 801–850 of 138,428. Narrow the filters to see the rest.
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status. Filter by severity and year here; the other filters work on the curated lists.