Vulnerability Intelligence · All CVEs
Every Published CVE, Searchable.
Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status.
Synced hourly · figures as of Oct 20, 2026
126,406 vulnerabilities · newest first
- CVE-2026-91184High 8.7NGINX Gateway Fabric has a vulnerability when it renders the spec.basic.realm (and spec.jwt.realm) field of a namespaced AuthenticationFilter verbatim, unescaped and unvalidated, into the shared data-plane nginx.conf as…Published Oct 14, 2026
- CVE-2026-73804High 8.1Gitea allows a token with write:user scope to register an attacker-controlled SSH public key on the token owner's account.Published Oct 14, 2026
- CVE-2026-73800High 8.8Gitea resolves local reusable workflow files from a fork's head commit when a trusted base-branch workflow runs for a pull_request_target event.Published Oct 14, 2026
- CVE-2026-73539High 7.5Gitea substitutes a URL derived from the markup Context field into external renderer command templates without escaping the reference path before shell-style argument splitting.Published Oct 14, 2026
- CVE-2026-73535High 8.8Gitea's OpenID connect handler accepts a user's password without enforcing enrolled TOTP or WebAuthn verification before completing sign-in and linking an OpenID identifier.Published Oct 14, 2026
- CVE-2026-71184High 8.8Gitea's pull request review notifier does not attach the pull request to the Actions notification, so the fork workflow approval gate does not recognize the run as originating from a fork.Published Oct 14, 2026
- CVE-2026-66877High 8.1Gitea enforces first-time fork contributor approval by blocking jobs, but some job transition and dispatch paths do not re-check the run's approval requirement.Published Oct 14, 2026
- CVE-2026-110648High 8.5@offactory/compress-fonts before 1.1.1 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying font files with crafted names.Published Oct 14, 2026
- CVE-2026-110647High 8.5Turnpress through 0.4.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying .docx files with crafted names.Published Oct 14, 2026
- CVE-2026-110642High 8.5xhtml2pdf before 0.2.19 contains an OS command injection vulnerability in pisa.startViewer() that allows attackers to execute commands by interpolating unescaped file names into os.system.Published Oct 14, 2026
- CVE-2026-110641High 8.7@runnerty/executor-decompress through 3.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted archive file names to compress_file.Published Oct 14, 2026
- CVE-2026-110637High 8.5buildebooks before 0.2.2 contains an OS command injection vulnerability in lib/kindle.js that allows attackers to execute commands by supplying a crafted EPUB file name passed to kindlegen via child_process.exec.Published Oct 14, 2026
- CVE-2026-110633High 8.5MyReport Updater through 2.1.1 contains a local privilege escalation vulnerability that allows low-privileged users to make the SYSTEM updater service install attacker-supplied archives into arbitrary directories.Published Oct 14, 2026
- CVE-2026-110630High 7.0VentureDrake Laravel CRM before 2.4.0 contains an incorrect authorization vulnerability in user management that allows authenticated administrators to assign unrestricted roles via Role::find.Published Oct 14, 2026
- CVE-2026-110629High 7.1VentureDrake Laravel CRM before 2.4.0 contains a missing authorization vulnerability that allows authenticated users to bypass Spatie role permissions through Livewire action methods.Published Oct 14, 2026
- CVE-2026-110623High 7.7Papermerge Core through 3.5.3 contains a missing authorization vulnerability in the shared nodes API that allows authenticated users to share other users' documents by supplying arbitrary node UUIDs.Published Oct 14, 2026
- CVE-2026-110622High 7.7Papermerge Core through 3.5.3 contains a missing authorization vulnerability that allows authenticated users to manipulate other users' pages because page management and OCR endpoints skip has_node_perm checks.Published Oct 14, 2026
- CVE-2026-110621High 8.7Swetrix Cloud before 5.1.0 contains a missing authorization vulnerability in ProjectController.addProject that allows authenticated users to hijack arbitrary projects by moving them into their own organisation.Published Oct 14, 2026
- CVE-2026-110618High 8.6SmsForwarder through 3.5.0 contains a missing authentication vulnerability in its AndServer HTTP server that allows unauthenticated network attackers to invoke remote-control APIs.Published Oct 14, 2026
- CVE-2026-110615High 7.1jshERP through 3.6 contains a missing authorization vulnerability in the POST /user/batchSetStatus endpoint that allows authenticated low-privilege users to change other users' account status.Published Oct 14, 2026
- CVE-2026-110614High 7.1Yiuman citrus through 0.15.0 contains an ORDER BY sql injection vulnerability in the citrus-support generic query framework that allows users to inject SQL via the sortBy request parameter.Published Oct 14, 2026
- CVE-2026-110613High 7.1youlai-mall through commit 9f62de8 contains a missing authorization vulnerability that allows authenticated members to view every customer's orders via the app order list endpoint.Published Oct 14, 2026
- CVE-2026-110609High 7.1Dromara Skyeye through commit 65d3ddcede70 contains an sql injection vulnerability that allows authenticated low-privileged users to inject SQL via the keyword parameter in the queryErpOrderItem MyBatis statement using raw ${} substitution.Published Oct 14, 2026
- CVE-2026-110607High 7.1BizSpring Shop through commit cf22d39daaf1 contains a payment verification bypass vulnerability that allows authenticated buyers to mark orders paid by calling the PaymentController.testPostPay handler.Published Oct 14, 2026
- CVE-2026-104939High 8.7Description NGINX Ingress Controller has a vulnerability when implementing an externalAuth policy for ingress.Published Oct 14, 2026
- CVE-2026-101019High 8.3Description NGINX JavaScript (njs) has a vulnerability where the njs XML module exposes entity-backed XML attributes inconsistently with libxml2 canonicalization.Published Oct 14, 2026
- CVE-2025-71433High 7.7Kaneo before 2.1.6 contains a missing authorization vulnerability that allows authenticated users to access other workspaces by supplying project, task, label or workspace identifiers to API routes lacking membership checks.Published Oct 14, 2026
- CVE-2026-107870High 7.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows DOM-Based XSS.This issue affects JetEngine: from n/a through 3.8.16.Published Oct 14, 2026
- CVE-2017-20286High 8.5DevIL through 1.8.0 Heap Buffer Overflow via GIF iGetPalettePublished Oct 14, 2026
- CVE-2026-110690High 8.7Cloud Commander 19.20.2 through 19.21.1 Path Traversal via GET /api/v1/packPublished Oct 14, 2026
- CVE-2026-107426High 7.3Missing Authorization vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Paid Videochat Turnkey Site: from n/a through 7.Published Oct 14, 2026
- CVE-2026-82026High 8.7Radar < 1.12.2 Missing Authorization via /api/local-terminalPublished Oct 14, 2026
- CVE-2026-107867High 7.1WordPress JetProductTables plugin <= 1.2.4 - Cross Site Scripting (XSS) vulnerabilityPublished Oct 14, 2026
- CVE-2026-107421High 7.3WordPress Broadcast Live Video plugin <= 7.3.2 - Session Hijacking vulnerabilityPublished Oct 14, 2026
- CVE-2026-105874High 7.1WordPress SureCart plugin <= 4.9.3 - Cross Site Scripting (XSS) vulnerabilityPublished Oct 14, 2026
- CVE-2026-106599High 8.8WordPress SureCart plugin <= 4.9.3 - PHP Object Injection vulnerabilityPublished Oct 14, 2026
- CVE-2026-97278High 7.2WordPress Polylang plugin <= 3.8.9 - PHP Object Injection vulnerabilityPublished Oct 14, 2026
- CVE-2026-76655High 7.5HPE NonStop SNMP Trap Multiplexer - Buffer Overflow vulnerabilityPublished Oct 14, 2026
- CVE-2026-73798High 8.2HPE NonStop DNS 9.2.3 Non Secure VersionPublished Oct 14, 2026
- CVE-2026-108071High 8.7Incorrect authentication vulnerability in the TSplus Remote Access multi-factor authentication (MFA) mechanism.Published Oct 14, 2026
- CVE-2026-107431High 7.5Missing Authorization vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetFormBuilder: from n/a through 3.6.6.Published Oct 14, 2026
- CVE-2026-105067High 8.5Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Webnus Modern Events Calendar Lite modern-events-calendar-lite allows Blind SQL Injection.This issue affects Modern Events Calendar…Published Oct 14, 2026
- CVE-2026-103358High 7.5Improper Control of Generation of Code ('Code Injection') vulnerability in VillaTheme Email Template Customizer for WooCommerce email-template-customizer-for-woo allows Code Injection.This issue affects Email Template Customizer for…Published Oct 14, 2026
- CVE-2026-85298High 7.3Improper Authorization in Google Cloud Application Integration Leads to Privilege EscalationPublished Oct 14, 2026
- CVE-2026-101341High 8.7Stack overwrite from specially formatted TXT-DATA RDATA fieldPublished Oct 14, 2026
- CVE-2026-101339High 8.7Stack overwrite from a specially crafted and formatted HIP RRPublished Oct 14, 2026
- CVE-2026-101338High 8.7Stack overwrite from a specially crafted and formatted SVCB or HTTPS RRPublished Oct 14, 2026
- CVE-2026-101337High 8.7Stack overwrite from specially formatted base64 RDATA fieldPublished Oct 14, 2026
- CVE-2026-104795High 8.8Insights-runtime-extractor: insights-runtime-extractor: container escape via privileged binary executionPublished Oct 14, 2026
- CVE-2026-108070High 8.7Improper Access Control Allows Unauthorized Access to Protected Internal Web Resources in TSplus Remote AccessPublished Oct 14, 2026
| CVE | Title | Severity | Published |
|---|---|---|---|
| CVE-2026-91184 | NGINX Gateway Fabric has a vulnerability when it renders the spec.basic.realm (and spec.jwt.realm) field of a namespaced AuthenticationFilter verbatim, unescaped and unvalidated, into the shared data-plane nginx.conf as… | High 8.7 | |
| CVE-2026-73804 | Gitea allows a token with write:user scope to register an attacker-controlled SSH public key on the token owner's account. | High 8.1 | |
| CVE-2026-73800 | Gitea resolves local reusable workflow files from a fork's head commit when a trusted base-branch workflow runs for a pull_request_target event. | High 8.8 | |
| CVE-2026-73539 | Gitea substitutes a URL derived from the markup Context field into external renderer command templates without escaping the reference path before shell-style argument splitting. | High 7.5 | |
| CVE-2026-73535 | Gitea's OpenID connect handler accepts a user's password without enforcing enrolled TOTP or WebAuthn verification before completing sign-in and linking an OpenID identifier. | High 8.8 | |
| CVE-2026-71184 | Gitea's pull request review notifier does not attach the pull request to the Actions notification, so the fork workflow approval gate does not recognize the run as originating from a fork. | High 8.8 | |
| CVE-2026-66877 | Gitea enforces first-time fork contributor approval by blocking jobs, but some job transition and dispatch paths do not re-check the run's approval requirement. | High 8.1 | |
| CVE-2026-110648 | @offactory/compress-fonts before 1.1.1 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying font files with crafted names. | High 8.5 | |
| CVE-2026-110647 | Turnpress through 0.4.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying .docx files with crafted names. | High 8.5 | |
| CVE-2026-110642 | xhtml2pdf before 0.2.19 contains an OS command injection vulnerability in pisa.startViewer() that allows attackers to execute commands by interpolating unescaped file names into os.system. | High 8.5 | |
| CVE-2026-110641 | @runnerty/executor-decompress through 3.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted archive file names to compress_file. | High 8.7 | |
| CVE-2026-110637 | buildebooks before 0.2.2 contains an OS command injection vulnerability in lib/kindle.js that allows attackers to execute commands by supplying a crafted EPUB file name passed to kindlegen via child_process.exec. | High 8.5 | |
| CVE-2026-110633 | MyReport Updater through 2.1.1 contains a local privilege escalation vulnerability that allows low-privileged users to make the SYSTEM updater service install attacker-supplied archives into arbitrary directories. | High 8.5 | |
| CVE-2026-110630 | VentureDrake Laravel CRM before 2.4.0 contains an incorrect authorization vulnerability in user management that allows authenticated administrators to assign unrestricted roles via Role::find. | High 7.0 | |
| CVE-2026-110629 | VentureDrake Laravel CRM before 2.4.0 contains a missing authorization vulnerability that allows authenticated users to bypass Spatie role permissions through Livewire action methods. | High 7.1 | |
| CVE-2026-110623 | Papermerge Core through 3.5.3 contains a missing authorization vulnerability in the shared nodes API that allows authenticated users to share other users' documents by supplying arbitrary node UUIDs. | High 7.7 | |
| CVE-2026-110622 | Papermerge Core through 3.5.3 contains a missing authorization vulnerability that allows authenticated users to manipulate other users' pages because page management and OCR endpoints skip has_node_perm checks. | High 7.7 | |
| CVE-2026-110621 | Swetrix Cloud before 5.1.0 contains a missing authorization vulnerability in ProjectController.addProject that allows authenticated users to hijack arbitrary projects by moving them into their own organisation. | High 8.7 | |
| CVE-2026-110618 | SmsForwarder through 3.5.0 contains a missing authentication vulnerability in its AndServer HTTP server that allows unauthenticated network attackers to invoke remote-control APIs. | High 8.6 | |
| CVE-2026-110615 | jshERP through 3.6 contains a missing authorization vulnerability in the POST /user/batchSetStatus endpoint that allows authenticated low-privilege users to change other users' account status. | High 7.1 | |
| CVE-2026-110614 | Yiuman citrus through 0.15.0 contains an ORDER BY sql injection vulnerability in the citrus-support generic query framework that allows users to inject SQL via the sortBy request parameter. | High 7.1 | |
| CVE-2026-110613 | youlai-mall through commit 9f62de8 contains a missing authorization vulnerability that allows authenticated members to view every customer's orders via the app order list endpoint. | High 7.1 | |
| CVE-2026-110609 | Dromara Skyeye through commit 65d3ddcede70 contains an sql injection vulnerability that allows authenticated low-privileged users to inject SQL via the keyword parameter in the queryErpOrderItem MyBatis statement using raw ${} substitution. | High 7.1 | |
| CVE-2026-110607 | BizSpring Shop through commit cf22d39daaf1 contains a payment verification bypass vulnerability that allows authenticated buyers to mark orders paid by calling the PaymentController.testPostPay handler. | High 7.1 | |
| CVE-2026-104939 | Description NGINX Ingress Controller has a vulnerability when implementing an externalAuth policy for ingress. | High 8.7 | |
| CVE-2026-101019 | Description NGINX JavaScript (njs) has a vulnerability where the njs XML module exposes entity-backed XML attributes inconsistently with libxml2 canonicalization. | High 8.3 | |
| CVE-2025-71433 | Kaneo before 2.1.6 contains a missing authorization vulnerability that allows authenticated users to access other workspaces by supplying project, task, label or workspace identifiers to API routes lacking membership checks. | High 7.7 | |
| CVE-2026-107870 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows DOM-Based XSS.This issue affects JetEngine: from n/a through 3.8.16. | High 7.1 | |
| CVE-2017-20286 | DevIL through 1.8.0 Heap Buffer Overflow via GIF iGetPalette | High 8.5 | |
| CVE-2026-110690 | Cloud Commander 19.20.2 through 19.21.1 Path Traversal via GET /api/v1/pack | High 8.7 | |
| CVE-2026-107426 | Missing Authorization vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Paid Videochat Turnkey Site: from n/a through 7. | High 7.3 | |
| CVE-2026-82026 | Radar < 1.12.2 Missing Authorization via /api/local-terminal | High 8.7 | |
| CVE-2026-107867 | WordPress JetProductTables plugin <= 1.2.4 - Cross Site Scripting (XSS) vulnerability | High 7.1 | |
| CVE-2026-107421 | WordPress Broadcast Live Video plugin <= 7.3.2 - Session Hijacking vulnerability | High 7.3 | |
| CVE-2026-105874 | WordPress SureCart plugin <= 4.9.3 - Cross Site Scripting (XSS) vulnerability | High 7.1 | |
| CVE-2026-106599 | WordPress SureCart plugin <= 4.9.3 - PHP Object Injection vulnerability | High 8.8 | |
| CVE-2026-97278 | WordPress Polylang plugin <= 3.8.9 - PHP Object Injection vulnerability | High 7.2 | |
| CVE-2026-76655 | HPE NonStop SNMP Trap Multiplexer - Buffer Overflow vulnerability | High 7.5 | |
| CVE-2026-73798 | HPE NonStop DNS 9.2.3 Non Secure Version | High 8.2 | |
| CVE-2026-108071 | Incorrect authentication vulnerability in the TSplus Remote Access multi-factor authentication (MFA) mechanism. | High 8.7 | |
| CVE-2026-107431 | Missing Authorization vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetFormBuilder: from n/a through 3.6.6. | High 7.5 | |
| CVE-2026-105067 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Webnus Modern Events Calendar Lite modern-events-calendar-lite allows Blind SQL Injection.This issue affects Modern Events Calendar… | High 8.5 | |
| CVE-2026-103358 | Improper Control of Generation of Code ('Code Injection') vulnerability in VillaTheme Email Template Customizer for WooCommerce email-template-customizer-for-woo allows Code Injection.This issue affects Email Template Customizer for… | High 7.5 | |
| CVE-2026-85298 | Improper Authorization in Google Cloud Application Integration Leads to Privilege Escalation | High 7.3 | |
| CVE-2026-101341 | Stack overwrite from specially formatted TXT-DATA RDATA field | High 8.7 | |
| CVE-2026-101339 | Stack overwrite from a specially crafted and formatted HIP RR | High 8.7 | |
| CVE-2026-101338 | Stack overwrite from a specially crafted and formatted SVCB or HTTPS RR | High 8.7 | |
| CVE-2026-101337 | Stack overwrite from specially formatted base64 RDATA field | High 8.7 | |
| CVE-2026-104795 | Insights-runtime-extractor: insights-runtime-extractor: container escape via privileged binary execution | High 8.8 | |
| CVE-2026-108070 | Improper Access Control Allows Unauthorized Access to Protected Internal Web Resources in TSplus Remote Access | High 8.7 |
Showing 851–900 of 126,406. Narrow the filters to see the rest.
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status. Filter by severity and year here; the other filters work on the curated lists.