Vulnerability Intelligence · All CVEs
Every Published CVE, Searchable.
Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status.
Synced hourly · figures as of Oct 20, 2026
40,422 vulnerabilities · newest first
- CVE-2026-104467Critical 9.2YesWiki before 4.6.7 contains an authorization bypass vulnerability in ApiService::isAuthorized() that allows unauthenticated attackers to call admin-only API routes when public API mode is enabled.Published Oct 2, 2026
- CVE-2026-104611Critical 9.4Tenda AC9 POST Request fast_setting_internet_set stack-based overflowPublished Oct 2, 2026
- CVE-2026-104610Critical 10.0Tenda HG7/HG9/HG10 Boa Web Server formLoopBack boaGetVar stack-based overflowPublished Oct 2, 2026
- CVE-2026-91135Critical 9.2Heap-based buffer overflow vulnerability in Apache Thrift C++ THeaderTransport.Published Oct 2, 2026
- CVE-2026-86325Critical 9.4A stack-based buffer overflow vulnerability exists in protocol gateways' account management interface.Published Oct 2, 2026
- CVE-2026-103877Critical 9.8Deserialization of Untrusted Data vulnerability in Apache Directory LDAP API.Published Oct 2, 2026
- CVE-2026-94541Critical 9.8WPMobile.App <= 11.82 - Unauthenticated Admin Account Takeover via 'wpapp_category[]' ParameterPublished Oct 2, 2026
- CVE-2026-97637Critical 9.8JSON API Auth <= 3.1.2 - Unauthenticated Authentication Bypass via Cached 'generate_auth_cookie' ResponsePublished Oct 2, 2026
- CVE-2026-63569Critical 9.1MTI/A0 DHAgreement does not validate the peer's ephemeral valuePublished Oct 2, 2026
- CVE-2026-93029Critical 9.0There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Manage SSL Hosts interface.Published Oct 2, 2026
- CVE-2026-93697Critical 9.0There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Mass Modify Accounts interface.Published Oct 2, 2026
- CVE-2026-93698Critical 9.9Insufficient validation allows arbitrary commands to be executed via the Multilang adminbin.Published Oct 2, 2026
- CVE-2026-15896Critical 9.1Super Forms <= 6.3.316 - Unauthenticated Path Traversal to Arbitrary File Read via 'sfgtfi' URL Path ParameterPublished Oct 2, 2026
- CVE-2026-19660Critical 9.8Divi Membership <= 2.3.0 - Unauthenticated Authentication Bypass via 'paypal_param' ParameterPublished Oct 2, 2026
- CVE-2026-14378Critical 9.8The DevKit Pro plugin for WordPress is vulnerable to Authentication Bypass Leading to Administrator Account Takeover in all versions up to, and including, 2.3.0 This is due to the revert_switch handler trusting the attacker-controlled…Published Oct 2, 2026
- CVE-2026-104480Critical 9.4Improper MLS Welcome roster validation in Discord libdave allows unauthorized group membershipPublished Oct 2, 2026
- CVE-2026-86345Critical 9.0The server does not discard plaintext bytes already buffered from a client connection when negotiating StartTLS, allowing an on-path attacker to inject a crafted LDAP message that is processed after the…Published Oct 2, 2026
- CVE-2026-51922Critical 9.8agentscope v1.0.20 contains code injection in execute_shell_command (src/agentscope/tool/_coding/_shell.py).Published Oct 2, 2026
- CVE-2026-51918Critical 9.8FinRobot 1.0.0 contains code injection in CodingUtils.create_file_with_code ().Published Oct 2, 2026
- CVE-2026-51915Critical 9.8TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in the tool controller.Published Oct 2, 2026
- CVE-2026-51911Critical 9.8vanna v2.0.2 contains a code injection vulnerability in VannaBase.get_plotly_figure (src/vanna/legacy/base/base.py).Published Oct 2, 2026
- CVE-2026-51906Critical 9.1In TaskingAI v0.3.0 in the DALL-E 3 image generation tool save_url_image function, a path traversal vulnerability allows attackers to write downloaded images to arbitrary locations on the server filesystem by manipulating the project_id…Published Oct 2, 2026
- CVE-2026-51904Critical 9.8SuperAGI up to v0.0.14 contains an improper access control vulnerability in the agent execution controller.Published Oct 2, 2026
- CVE-2026-51898Critical 9.8sinaptik-ai pandas-ai 3.0.0 is vulnerable to Code Injection in CodeExecutor.execute.Published Oct 2, 2026
- CVE-2026-103764Critical 9.3Mooncake transfer engine before 0.3.13 Unauthenticated Arbitrary Memory Read/Write via TCP TransportPublished Oct 1, 2026
- CVE-2026-71449Critical 9.3: Use of Hard-coded Cryptographic Key vulnerability in Johnson Controls EasyIO FS32 allows : Retrieve Embedded Sensitive Data.Published Oct 1, 2026
- CVE-2026-51897Critical 9.8RAGFlow 0.24.0 contains improper access control in get_dataset (api/apps/evaluation_app).Published Oct 1, 2026
- CVE-2026-51893Critical 9.8infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via trace_mindmap.Published Oct 1, 2026
- CVE-2026-51884Critical 9.8The /knowledge_base/upload_temp_docs temporary document upload endpoint in Langchain Chatchat 0.3.1 is vulnerable to path traversal.Published Oct 1, 2026
- CVE-2026-51883Critical 9.1The knowledge base creation and document upload interfaces in Langchain-Chatchat 0.3.0;0.3.1 is vulnerable to path traversal.Published Oct 1, 2026
- CVE-2026-51882Critical 9.1The OpenAI-compatible file upload endpoint /v1/files in Langchain-Chatchat 0.3.0 is vulnerable to path traversal.Published Oct 1, 2026
- CVE-2026-51881Critical 9.8deeptutor 1.4.0 contains code injection in ExecTool.execute.Published Oct 1, 2026
- CVE-2026-51880Critical 9.8deeptutor 1.4.0 contains a path traversal issue in EditFileTool.execute.Published Oct 1, 2026
- CVE-2026-51879Critical 9.1deeptutor 1.4.0 contains an authorization bypass through a user-controlled object identifier in TutorBotManager.write_bot_file.Published Oct 1, 2026
- CVE-2026-51876Critical 9.1DeepTutor 1.4.0 contains an authorization bypass vulnerability in the book confirmation flow.Published Oct 1, 2026
- CVE-2026-51875Critical 9.1In Devika v1.0, the Feature Agent save_code_to_project function contains a path traversal vulnerability that allows attackers to write files outside the intended project workspace, potentially compromising the entire server.Published Oct 1, 2026
- CVE-2026-18397Critical 9.4This vulnerability enables unauthenticated remote code execution (RCE) on a victim's machine by exploiting a combination of cryptographic weaknesses and memory management issues in the SConnect native host component.Published Oct 1, 2026
- CVE-2026-55395Critical 9.4Hardcoded Passwords in Teledyne FLIR Robots running Aware2Published Oct 1, 2026
- CVE-2026-55393Critical 10.0Local File Inclusion in Teledyne FLIR Robots running Aware2Published Oct 1, 2026
- CVE-2026-14984Critical 9.4Cleartext HTTP for Control Traffic in Teledyne FLIR Robots running Aware2Published Oct 1, 2026
- CVE-2026-102628Critical 9.2Cadmos LTI exposure of sensitive information via debug modePublished Oct 1, 2026
- CVE-2026-102667Critical 9.0Joyland AI WebView command injectionPublished Oct 1, 2026
- CVE-2026-56662Critical 9.6GetSimple CMS: Missing CSRF protection in UpdateCE allows forging a privileged server-side update requestPublished Oct 1, 2026
- CVE-2026-56660Critical 9.1GetSimple CMS: CSRF, SSRF, and Unrestricted Zip ExtractionPublished Oct 1, 2026
- CVE-2026-53953Critical 9.1GetSimple CMS: Predictable Password Reset Password Allows Administrator Account TakeoverPublished Oct 1, 2026
- CVE-2026-104286Critical 9.8An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2.0 through 7.2.9 may allow an unauthenticated attacker to write…Fortinet · FortiMailPublished Oct 1, 2026
- CVE-2026-104056Critical 9.8CVE-2026-104056Published Oct 1, 2026
- CVE-2026-55083Critical 9.1DHIS2: Unsafe Java Deserialization - Remote Code Execution (RCE)Published Oct 1, 2026
- CVE-2026-103922Critical 9.3Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy pathPublished Oct 1, 2026
- CVE-2026-96658Critical 9.9Foreman: safemode bypass leading to rcePublished Oct 1, 2026
| CVE | Title | Severity | Published |
|---|---|---|---|
| CVE-2026-104467 | YesWiki before 4.6.7 contains an authorization bypass vulnerability in ApiService::isAuthorized() that allows unauthenticated attackers to call admin-only API routes when public API mode is enabled. | Critical 9.2 | |
| CVE-2026-104611 | Tenda AC9 POST Request fast_setting_internet_set stack-based overflow | Critical 9.4 | |
| CVE-2026-104610 | Tenda HG7/HG9/HG10 Boa Web Server formLoopBack boaGetVar stack-based overflow | Critical 10.0 | |
| CVE-2026-91135 | Heap-based buffer overflow vulnerability in Apache Thrift C++ THeaderTransport. | Critical 9.2 | |
| CVE-2026-86325 | A stack-based buffer overflow vulnerability exists in protocol gateways' account management interface. | Critical 9.4 | |
| CVE-2026-103877 | Deserialization of Untrusted Data vulnerability in Apache Directory LDAP API. | Critical 9.8 | |
| CVE-2026-94541 | WPMobile.App <= 11.82 - Unauthenticated Admin Account Takeover via 'wpapp_category[]' Parameter | Critical 9.8 | |
| CVE-2026-97637 | JSON API Auth <= 3.1.2 - Unauthenticated Authentication Bypass via Cached 'generate_auth_cookie' Response | Critical 9.8 | |
| CVE-2026-63569 | MTI/A0 DHAgreement does not validate the peer's ephemeral value | Critical 9.1 | |
| CVE-2026-93029 | There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Manage SSL Hosts interface. | Critical 9.0 | |
| CVE-2026-93697 | There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Mass Modify Accounts interface. | Critical 9.0 | |
| CVE-2026-93698 | Insufficient validation allows arbitrary commands to be executed via the Multilang adminbin. | Critical 9.9 | |
| CVE-2026-15896 | Super Forms <= 6.3.316 - Unauthenticated Path Traversal to Arbitrary File Read via 'sfgtfi' URL Path Parameter | Critical 9.1 | |
| CVE-2026-19660 | Divi Membership <= 2.3.0 - Unauthenticated Authentication Bypass via 'paypal_param' Parameter | Critical 9.8 | |
| CVE-2026-14378 | The DevKit Pro plugin for WordPress is vulnerable to Authentication Bypass Leading to Administrator Account Takeover in all versions up to, and including, 2.3.0 This is due to the revert_switch handler trusting the attacker-controlled… | Critical 9.8 | |
| CVE-2026-104480 | Improper MLS Welcome roster validation in Discord libdave allows unauthorized group membership | Critical 9.4 | |
| CVE-2026-86345 | The server does not discard plaintext bytes already buffered from a client connection when negotiating StartTLS, allowing an on-path attacker to inject a crafted LDAP message that is processed after the… | Critical 9.0 | |
| CVE-2026-51922 | agentscope v1.0.20 contains code injection in execute_shell_command (src/agentscope/tool/_coding/_shell.py). | Critical 9.8 | |
| CVE-2026-51918 | FinRobot 1.0.0 contains code injection in CodingUtils.create_file_with_code (). | Critical 9.8 | |
| CVE-2026-51915 | TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in the tool controller. | Critical 9.8 | |
| CVE-2026-51911 | vanna v2.0.2 contains a code injection vulnerability in VannaBase.get_plotly_figure (src/vanna/legacy/base/base.py). | Critical 9.8 | |
| CVE-2026-51906 | In TaskingAI v0.3.0 in the DALL-E 3 image generation tool save_url_image function, a path traversal vulnerability allows attackers to write downloaded images to arbitrary locations on the server filesystem by manipulating the project_id… | Critical 9.1 | |
| CVE-2026-51904 | SuperAGI up to v0.0.14 contains an improper access control vulnerability in the agent execution controller. | Critical 9.8 | |
| CVE-2026-51898 | sinaptik-ai pandas-ai 3.0.0 is vulnerable to Code Injection in CodeExecutor.execute. | Critical 9.8 | |
| CVE-2026-103764 | Mooncake transfer engine before 0.3.13 Unauthenticated Arbitrary Memory Read/Write via TCP Transport | Critical 9.3 | |
| CVE-2026-71449 | : Use of Hard-coded Cryptographic Key vulnerability in Johnson Controls EasyIO FS32 allows : Retrieve Embedded Sensitive Data. | Critical 9.3 | |
| CVE-2026-51897 | RAGFlow 0.24.0 contains improper access control in get_dataset (api/apps/evaluation_app). | Critical 9.8 | |
| CVE-2026-51893 | infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via trace_mindmap. | Critical 9.8 | |
| CVE-2026-51884 | The /knowledge_base/upload_temp_docs temporary document upload endpoint in Langchain Chatchat 0.3.1 is vulnerable to path traversal. | Critical 9.8 | |
| CVE-2026-51883 | The knowledge base creation and document upload interfaces in Langchain-Chatchat 0.3.0;0.3.1 is vulnerable to path traversal. | Critical 9.1 | |
| CVE-2026-51882 | The OpenAI-compatible file upload endpoint /v1/files in Langchain-Chatchat 0.3.0 is vulnerable to path traversal. | Critical 9.1 | |
| CVE-2026-51881 | deeptutor 1.4.0 contains code injection in ExecTool.execute. | Critical 9.8 | |
| CVE-2026-51880 | deeptutor 1.4.0 contains a path traversal issue in EditFileTool.execute. | Critical 9.8 | |
| CVE-2026-51879 | deeptutor 1.4.0 contains an authorization bypass through a user-controlled object identifier in TutorBotManager.write_bot_file. | Critical 9.1 | |
| CVE-2026-51876 | DeepTutor 1.4.0 contains an authorization bypass vulnerability in the book confirmation flow. | Critical 9.1 | |
| CVE-2026-51875 | In Devika v1.0, the Feature Agent save_code_to_project function contains a path traversal vulnerability that allows attackers to write files outside the intended project workspace, potentially compromising the entire server. | Critical 9.1 | |
| CVE-2026-18397 | This vulnerability enables unauthenticated remote code execution (RCE) on a victim's machine by exploiting a combination of cryptographic weaknesses and memory management issues in the SConnect native host component. | Critical 9.4 | |
| CVE-2026-55395 | Hardcoded Passwords in Teledyne FLIR Robots running Aware2 | Critical 9.4 | |
| CVE-2026-55393 | Local File Inclusion in Teledyne FLIR Robots running Aware2 | Critical 10.0 | |
| CVE-2026-14984 | Cleartext HTTP for Control Traffic in Teledyne FLIR Robots running Aware2 | Critical 9.4 | |
| CVE-2026-102628 | Cadmos LTI exposure of sensitive information via debug mode | Critical 9.2 | |
| CVE-2026-102667 | Joyland AI WebView command injection | Critical 9.0 | |
| CVE-2026-56662 | GetSimple CMS: Missing CSRF protection in UpdateCE allows forging a privileged server-side update request | Critical 9.6 | |
| CVE-2026-56660 | GetSimple CMS: CSRF, SSRF, and Unrestricted Zip Extraction | Critical 9.1 | |
| CVE-2026-53953 | GetSimple CMS: Predictable Password Reset Password Allows Administrator Account Takeover | Critical 9.1 | |
| CVE-2026-104286 | An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2.0 through 7.2.9 may allow an unauthenticated attacker to write… Fortinet · FortiMail | Critical 9.8 | |
| CVE-2026-104056 | CVE-2026-104056 | Critical 9.8 | |
| CVE-2026-55083 | DHIS2: Unsafe Java Deserialization - Remote Code Execution (RCE) | Critical 9.1 | |
| CVE-2026-103922 | Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path | Critical 9.3 | |
| CVE-2026-96658 | Foreman: safemode bypass leading to rce | Critical 9.9 |
Showing 851–900 of 40,422. Narrow the filters to see the rest.
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status. Filter by severity and year here; the other filters work on the curated lists.