Vulnerability Intelligence · All CVEs
Every Published CVE, Searchable.
Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status.
Synced hourly · figures as of Oct 20, 2026
11,311 vulnerabilities · newest first
- CVE-2026-77508Low 3.5Prior to 2026.8, an authenticated user can change the account's primary email through PUT or PATCH requests to /api/users/{username}/ without verifying the new address, allowing a later team…Published Aug 26, 2026
- CVE-2026-56547Low 3.5The Apple profile generated for the Apple built-in Mail, Calendar and Contacts account to synchronize with HCL Traveler requires the Logon Name and Mail Address to be embedded in them.Published Aug 26, 2026
- CVE-2026-47844Low 3.7In specific scenarios, the Reactor Netty HTTP Server may leak exception details across unrelated requests.Published Aug 26, 2026
- CVE-2026-47843Low 3.7In specific scenarios involving multiple clients with different DNS resolver configurations, Reactor Netty may incorrectly reuse a previously configured DNS resolver.Published Aug 26, 2026
- CVE-2026-44701Low 3.5OpenSTAManager has HTML Injection in modules/utenti/edit.phpPublished Aug 26, 2026
- CVE-2026-81161Low 3.3Privilege Defined With Unsafe Actions vulnerability in Drupal Content Moderation Notifications allows Privilege Escalation.Published Aug 26, 2026
- CVE-2026-81159Low 3.7Observable Timing Discrepancy vulnerability in Drupal Commerce CyberSource allows Brute Force.Published Aug 26, 2026
- CVE-2026-81168Low 3.7Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CAPTCHA Protected Page allows Functionality Bypass.Published Aug 26, 2026
- CVE-2026-13480Low 3.1The LoRaWAN TS004 Fragmented Data Block Transport handler frag_transport_package_callback() in subsys/lorawan/services/frag_transport.c parses downlink command bytes without validating that enough payload bytes remain before each access.Published Aug 26, 2026
- CVE-2026-7487Low 3.5GitLab has remediated an issue in GitLab EE affecting all versions from 13.1 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with reporter-role permissions who authored a…Published Aug 26, 2026
- CVE-2026-58108Low 1.2The personal access token removal query selects from PersonalAccessTokenDB but filters on columns of Session, with no join between them.Published Aug 26, 2026
- CVE-2026-15366Low 2.4A control logic defect in a specific built-in webpage of Kids Mode allows users to view local gallery photos directly within the pagePublished Aug 26, 2026
- CVE-2026-15365Low 2.4A pop-up logic flaw in a certain feature of Kids Mode allows users to bypass password verification and use Quick Apps outside the app.Published Aug 26, 2026
- CVE-2026-19220Low 3.7The Forminator Forms WordPress plugin before 1.57.1 does not verify that site registration is enabled on the network before creating a site signup, allowing unauthenticated visitors to create a new site on a WordPress multisite network…Published Aug 26, 2026
- CVE-2026-9805Low 2.7SMM IHISI command handler, FMTSWriteUseIntelLib, for FMTS command 0x32, read and write data without checking buffer size and could cause buffer overflow.Published Aug 26, 2026
- CVE-2026-80201Low 2.0Kimai before 2.53.0 fails to block sensitive User methods in the Twig invoice template sandbox, allowing admins to call getApiToken() and getPlainApiToken() methods.kimai · kimaiPublished Aug 26, 2026
- CVE-2026-79289Low 3.1Improper control of a resource through its lifetime in Workers in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page.Published Aug 25, 2026
- CVE-2026-79272Low 3.1Improper input validation in FindInPage in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page.Published Aug 25, 2026
- CVE-2026-79255Low 3.1Improper input validation in WebRTC in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page.Published Aug 25, 2026
- CVE-2026-79228Low 3.1Incorrect authorization in SiteIsolation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass site isolation into a privileged page via a crafted HTML page.Published Aug 25, 2026
- CVE-2026-79203Low 3.1Improper input validation in DevTools in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page.Published Aug 25, 2026
- CVE-2026-79191Low 3.1Incorrect authorization in SiteIsolation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass site isolation via a crafted HTML page.Published Aug 25, 2026
- CVE-2026-79186Low 3.1Incorrect authorization in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page.Published Aug 25, 2026
- CVE-2026-79103Low 3.1Incorrect reference resolution in Speech in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page.Published Aug 25, 2026
- CVE-2026-79066Low 3.1Improper input validation in Navigation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page.Published Aug 25, 2026
- CVE-2026-79059Low 3.1Information leak in BFCache in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data via a crafted HTML page.Published Aug 25, 2026
- CVE-2026-79053Low 3.1Missing authorization in Lighthouse in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass site isolation via a crafted HTML page.Published Aug 25, 2026
- CVE-2026-79034Low 3.1Information leak in CORS in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page.Published Aug 25, 2026
- CVE-2026-79031Low 3.1Improper resource exposure in Preload in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass site isolation via a crafted HTML page.Published Aug 25, 2026
- CVE-2026-79007Low 3.1Uninitialized resource in GPU in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially read memory outside the sandbox via a crafted HTML page.Published Aug 25, 2026
- CVE-2026-79004Low 3.4Out of bounds read in Media in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page.Published Aug 25, 2026
- CVE-2026-79002Low 3.1Incorrect authorization in SiteIsolation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page.Published Aug 25, 2026
- CVE-2026-78986Low 3.1Uninitialized resource in GPU in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially obtain cross-origin data via a crafted HTML page.Published Aug 25, 2026
- CVE-2026-78984Low 3.4Uninitialized resource in GPU in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially read memory outside the sandbox via a crafted HTML page.Published Aug 25, 2026
- CVE-2026-78958Low 3.1Uninitialized resource in Skia in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially obtain cross-origin data via a crafted HTML page.Published Aug 25, 2026
- CVE-2026-78953Low 3.1Missing authorization in SiteIsolation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted PDF file.Published Aug 25, 2026
- CVE-2026-78949Low 2.9Observable discrepancy in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a local attacker to obtain cross-origin data via a co-installed app.Published Aug 25, 2026
- CVE-2026-78943Low 3.1Improper input validation in Editing in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass web origin policy via a crafted HTML page.Published Aug 25, 2026
- CVE-2026-78941Low 3.1Information leak in Core in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page.Published Aug 25, 2026
- CVE-2026-78936Low 2.9Observable discrepancy in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a local attacker to obtain cross-origin data via a co-installed app.Published Aug 25, 2026
- CVE-2026-78903Low 3.1Incomplete cleanup in SiteIsolation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page.Published Aug 25, 2026
- CVE-2026-78894Low 3.1Race condition in Payments in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page.Published Aug 25, 2026
- CVE-2026-72924Low 2.1GitHub CLI (gh) is GitHub's official command line tool.Published Aug 25, 2026
- CVE-2026-43657Low 3.3A permissions issue was addressed with additional restrictions.Published Aug 25, 2026
- CVE-2026-79783Low 2.0rclone before 1.74.4 fails to mask special permission bits when applying source-supplied mode metadata in the local backend, allowing attackers to set setuid/setgid bits on attacker-controlled files.Published Aug 25, 2026
- CVE-2026-70548Low 3.5Under specific circumstances, low-level user can run request to remote CocoaPods repos via JFrog Artifactory External Dependency.Published Aug 25, 2026
- CVE-2026-15310Low 2.1When decompressing crafted zip files using the bzip/LZMA/ZstandardPublished Aug 25, 2026
- CVE-2026-21758Low 3.7HCL Hive is affected by an information disclosure vulnerability, which could lead to an attacker gathering sensitive information about the host environment.Published Aug 25, 2026
- CVE-2026-66882Low 2.1Improper Neutralization of Input During Web Page Generation (XSS) vulnerability in team-alembic AshAuthentication allows reflected cross-site scripting via the confirmation and magic link interaction forms.Published Aug 25, 2026
- CVE-2026-16434Low 2.3Adminer 4.6.0 through 5.5.0 (fixed in 5.5.1) contains an incomplete fix for a prior X-Forwarded-Prefix vulnerability (GHSA-8478-xrj3-h9c2).Published Aug 25, 2026
| CVE | Title | Severity | Published |
|---|---|---|---|
| CVE-2026-77508 | Prior to 2026.8, an authenticated user can change the account's primary email through PUT or PATCH requests to /api/users/{username}/ without verifying the new address, allowing a later team… | Low 3.5 | |
| CVE-2026-56547 | The Apple profile generated for the Apple built-in Mail, Calendar and Contacts account to synchronize with HCL Traveler requires the Logon Name and Mail Address to be embedded in them. | Low 3.5 | |
| CVE-2026-47844 | In specific scenarios, the Reactor Netty HTTP Server may leak exception details across unrelated requests. | Low 3.7 | |
| CVE-2026-47843 | In specific scenarios involving multiple clients with different DNS resolver configurations, Reactor Netty may incorrectly reuse a previously configured DNS resolver. | Low 3.7 | |
| CVE-2026-44701 | OpenSTAManager has HTML Injection in modules/utenti/edit.php | Low 3.5 | |
| CVE-2026-81161 | Privilege Defined With Unsafe Actions vulnerability in Drupal Content Moderation Notifications allows Privilege Escalation. | Low 3.3 | |
| CVE-2026-81159 | Observable Timing Discrepancy vulnerability in Drupal Commerce CyberSource allows Brute Force. | Low 3.7 | |
| CVE-2026-81168 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CAPTCHA Protected Page allows Functionality Bypass. | Low 3.7 | |
| CVE-2026-13480 | The LoRaWAN TS004 Fragmented Data Block Transport handler frag_transport_package_callback() in subsys/lorawan/services/frag_transport.c parses downlink command bytes without validating that enough payload bytes remain before each access. | Low 3.1 | |
| CVE-2026-7487 | GitLab has remediated an issue in GitLab EE affecting all versions from 13.1 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with reporter-role permissions who authored a… | Low 3.5 | |
| CVE-2026-58108 | The personal access token removal query selects from PersonalAccessTokenDB but filters on columns of Session, with no join between them. | Low 1.2 | |
| CVE-2026-15366 | A control logic defect in a specific built-in webpage of Kids Mode allows users to view local gallery photos directly within the page | Low 2.4 | |
| CVE-2026-15365 | A pop-up logic flaw in a certain feature of Kids Mode allows users to bypass password verification and use Quick Apps outside the app. | Low 2.4 | |
| CVE-2026-19220 | The Forminator Forms WordPress plugin before 1.57.1 does not verify that site registration is enabled on the network before creating a site signup, allowing unauthenticated visitors to create a new site on a WordPress multisite network… | Low 3.7 | |
| CVE-2026-9805 | SMM IHISI command handler, FMTSWriteUseIntelLib, for FMTS command 0x32, read and write data without checking buffer size and could cause buffer overflow. | Low 2.7 | |
| CVE-2026-80201 | Kimai before 2.53.0 fails to block sensitive User methods in the Twig invoice template sandbox, allowing admins to call getApiToken() and getPlainApiToken() methods. kimai · kimai | Low 2.0 | |
| CVE-2026-79289 | Improper control of a resource through its lifetime in Workers in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. | Low 3.1 | |
| CVE-2026-79272 | Improper input validation in FindInPage in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. | Low 3.1 | |
| CVE-2026-79255 | Improper input validation in WebRTC in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. | Low 3.1 | |
| CVE-2026-79228 | Incorrect authorization in SiteIsolation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass site isolation into a privileged page via a crafted HTML page. | Low 3.1 | |
| CVE-2026-79203 | Improper input validation in DevTools in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. | Low 3.1 | |
| CVE-2026-79191 | Incorrect authorization in SiteIsolation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass site isolation via a crafted HTML page. | Low 3.1 | |
| CVE-2026-79186 | Incorrect authorization in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. | Low 3.1 | |
| CVE-2026-79103 | Incorrect reference resolution in Speech in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. | Low 3.1 | |
| CVE-2026-79066 | Improper input validation in Navigation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. | Low 3.1 | |
| CVE-2026-79059 | Information leak in BFCache in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data via a crafted HTML page. | Low 3.1 | |
| CVE-2026-79053 | Missing authorization in Lighthouse in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass site isolation via a crafted HTML page. | Low 3.1 | |
| CVE-2026-79034 | Information leak in CORS in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. | Low 3.1 | |
| CVE-2026-79031 | Improper resource exposure in Preload in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass site isolation via a crafted HTML page. | Low 3.1 | |
| CVE-2026-79007 | Uninitialized resource in GPU in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially read memory outside the sandbox via a crafted HTML page. | Low 3.1 | |
| CVE-2026-79004 | Out of bounds read in Media in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. | Low 3.4 | |
| CVE-2026-79002 | Incorrect authorization in SiteIsolation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. | Low 3.1 | |
| CVE-2026-78986 | Uninitialized resource in GPU in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially obtain cross-origin data via a crafted HTML page. | Low 3.1 | |
| CVE-2026-78984 | Uninitialized resource in GPU in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially read memory outside the sandbox via a crafted HTML page. | Low 3.4 | |
| CVE-2026-78958 | Uninitialized resource in Skia in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially obtain cross-origin data via a crafted HTML page. | Low 3.1 | |
| CVE-2026-78953 | Missing authorization in SiteIsolation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted PDF file. | Low 3.1 | |
| CVE-2026-78949 | Observable discrepancy in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a local attacker to obtain cross-origin data via a co-installed app. | Low 2.9 | |
| CVE-2026-78943 | Improper input validation in Editing in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass web origin policy via a crafted HTML page. | Low 3.1 | |
| CVE-2026-78941 | Information leak in Core in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. | Low 3.1 | |
| CVE-2026-78936 | Observable discrepancy in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a local attacker to obtain cross-origin data via a co-installed app. | Low 2.9 | |
| CVE-2026-78903 | Incomplete cleanup in SiteIsolation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. | Low 3.1 | |
| CVE-2026-78894 | Race condition in Payments in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. | Low 3.1 | |
| CVE-2026-72924 | GitHub CLI (gh) is GitHub's official command line tool. | Low 2.1 | |
| CVE-2026-43657 | A permissions issue was addressed with additional restrictions. | Low 3.3 | |
| CVE-2026-79783 | rclone before 1.74.4 fails to mask special permission bits when applying source-supplied mode metadata in the local backend, allowing attackers to set setuid/setgid bits on attacker-controlled files. | Low 2.0 | |
| CVE-2026-70548 | Under specific circumstances, low-level user can run request to remote CocoaPods repos via JFrog Artifactory External Dependency. | Low 3.5 | |
| CVE-2026-15310 | When decompressing crafted zip files using the bzip/LZMA/Zstandard | Low 2.1 | |
| CVE-2026-21758 | HCL Hive is affected by an information disclosure vulnerability, which could lead to an attacker gathering sensitive information about the host environment. | Low 3.7 | |
| CVE-2026-66882 | Improper Neutralization of Input During Web Page Generation (XSS) vulnerability in team-alembic AshAuthentication allows reflected cross-site scripting via the confirmation and magic link interaction forms. | Low 2.1 | |
| CVE-2026-16434 | Adminer 4.6.0 through 5.5.0 (fixed in 5.5.1) contains an incomplete fix for a prior X-Forwarded-Prefix vulnerability (GHSA-8478-xrj3-h9c2). | Low 2.3 |
Showing 851–900 of 11,311. Narrow the filters to see the rest.
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status. Filter by severity and year here; the other filters work on the curated lists.