Vulnerability Intelligence · All CVEs
Every Published CVE, Searchable.
Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status.
Synced hourly · figures as of Oct 20, 2026
138,428 vulnerabilities · newest first
- CVE-2026-110763Medium 5.3lamp-boot 4.16.0-java17 through 4.21.2-java17 contains an insecure direct object reference vulnerability in the oauth module's /anyone/findDeptByCompany endpoint that skips URI permission checks.Published Oct 14, 2026
- CVE-2026-110762Medium 6.3bbPress before 2.6.19 contains an information disclosure vulnerability that allows unauthenticated visitors to view restricted subforum posts because hide_sitewide ignores ancestor forum visibility.Published Oct 14, 2026
- CVE-2026-110667Medium 6.9Affected by this vulnerability is an unknown functionality of the file sar2html.py.Published Oct 14, 2026
- CVE-2026-110666Medium 6.9The manipulation leads to path traversal.Published Oct 14, 2026
- CVE-2026-110248Medium 6.0Insertion of sensitive information into log files in the git_utils[.]py component in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 before 2.257.3 might allow an authenticated remote user to obtain plaintext repository credentials…Published Oct 14, 2026
- CVE-2026-109506Medium 5.9Multiple TP-Link Wi-Fi range extenders use a custom, reversible XOR-and-dictionary transformation in the HTTP web-management login flow.Published Oct 14, 2026
- CVE-2026-103974Medium 5.4Prior to commit c54596c9e1569d378fe20f80d4c790c6fdee54c4, a user who can add a chapter to a study can place attacker-controlled text in the PGN Annotator tag, which…Published Oct 14, 2026
- CVE-2026-102756Medium 5.1Prior to 2.10.26, authenticated users who can edit dataset fields and chart configuration can store an HTML-bearing dimension value in a bar-horizontal chart.Published Oct 14, 2026
- CVE-2026-102755Medium 5.1Prior to 2.10.26, authenticated users with folder creation permission can store HTML-bearing names through datasource/createFolder or datasetTree/save.Published Oct 14, 2026
- CVE-2026-102682Medium 5.6From 0.0.98 until 1.6.0, the pipecat-ai package's built-in development runner exposes unauthenticated endpoints including…Published Oct 14, 2026
- CVE-2026-102471Medium 6.9In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the vertx-mail-client does not sanitize CR (\r) or LF (\n) characters in user-supplied email header names and values before writing them into…Published Oct 14, 2026
- CVE-2026-102354Medium 6.8In versions through 2.8.6, cloudflare/cors-proxy-worker.js performs a DNS-over-HTTPS safety check in hostnameResolvesToPrivate(), as used by isValidCertificateUrl() and…Published Oct 14, 2026
- CVE-2026-54701Medium 6.9Prior to 0.8.30, Markdown Preview Enhanced reads repository-controlled .crossnote/head.html content and passes it through resolvePathsInHeader before…Published Oct 14, 2026
- CVE-2026-54703Medium 5.8Prior to 0.8.30, the _crossnote.updateMarkdown command in Markdown Preview Enhanced accepts an arbitrary URI and attacker-controlled content, then passes…Published Oct 14, 2026
- CVE-2026-92160Medium 6.5Prior to 4.3.0, Svc::FileDownlink SendPartial range validation is vulnerable because the wrapping sum bypasses…Published Oct 14, 2026
- CVE-2026-92159Medium 6.5Prior to 4.3.0, Svc::TlmPacketizer TlmRecv_handler fixed-slot copy TlmRecv_handler copies val.getSize bytes into…Published Oct 14, 2026
- CVE-2026-92157Medium 6.5Prior to 4.3.0, Svc::FileDownlink SendPartial range validation is vulnerable because unchecked startOffset plus…Published Oct 14, 2026
- CVE-2026-92156Medium 6.5Prior to 4.3.0, Svc::EventManager loqQueue_internalInterfaceHandler packetization is vulnerable because…Published Oct 14, 2026
- CVE-2026-86856Medium 6.5Stack and heap buffers sized for a single queue pair can be overflowed when more virtqueues are configured, leading to a host crash or memory corruption.Published Oct 14, 2026
- CVE-2026-86849Medium 6.5Integer overflow in chain length checks, and missing length checks on the RSA path, can overflow a host buffer in the vhost-crypto backend.Published Oct 14, 2026
- CVE-2026-86847Medium 6.5Write-back chain cleanup can follow an uninitialized next pointer when mapping a guest descriptor fails, causing the host vhost-crypto process to hang or crash.Published Oct 14, 2026
- CVE-2026-86846Medium 6.5A guest can supply an avail-ring descriptor index that is used without bounds checking, causing an out-of-bounds write in the host vhost-crypto backend.Published Oct 14, 2026
- CVE-2026-86845Medium 6.5Session cleanup can leave a stale cached session pointer, and the data path does not check the session type before attaching it, leading to use-after-free or type confusion in the host…Published Oct 14, 2026
- CVE-2026-86566Medium 6.5A guest with runt RX descriptors can underflow the copy length in vhost enqueue, causing a denial of service in a shared vhost backend such as OVS-DPDK.Published Oct 14, 2026
- CVE-2026-76083Medium 4.9From 10.0.0 until 26.9.0, the JSON data source query runner in redash/query_runner/json_ds.py used _get_all_results() to combine its configured base_url with a user-supplied query…Published Oct 14, 2026
- CVE-2026-110777Medium 5.7Calendar events containing a file:// URI in their ATTACH property automatically read the targeted local file, base64-encode its contents and upload it back to the server when the event is saved.Published Oct 14, 2026
- CVE-2026-108151Medium 5.3Improper Control of Generation of Code ('Code Injection') vulnerability in PluginUs.Net MDTF wp-meta-data-filter-and-taxonomy-filter allows Code Injection.This issue affects MDTF: from n/a through 1.3.9.Published Oct 14, 2026
- CVE-2026-107348Medium 5.9Integer overflow in the message buffer growth logic (mbuf_make_room) in PgBouncer 1.21.0 through 1.26.0 allows a remote attacker to cause a denial of service when max_packet_size is configured above 2147483648.Published Oct 14, 2026
- CVE-2026-103975Medium 6.5Prior to 7.2.6, @appium/support ZIP extraction accepts an archive entry that creates a symbolic link to a location outside…Published Oct 14, 2026
- CVE-2026-96596Medium 5.9erl_tar:extract/2 loops forever on a GNU sparse member with a trailing holePublished Oct 14, 2026
- CVE-2026-105236Medium 6.3TLS 1.2 session resumption in ssl crosses SNI virtual-host client-certificate trust boundariesPublished Oct 14, 2026
- CVE-2026-102054Medium 5.3Junos OS and Junos OS Evolved: Insufficient validation of VXLAN overlay ping causes information disclosure when EVPN-VXLAN is configuredPublished Oct 14, 2026
- CVE-2026-102053Medium 6.9Junos OS and Junos OS Evolved: An EVPN-VXLAN memory leak causes denial of service when active-active multihoming is usedPublished Oct 14, 2026
- CVE-2026-75085Medium 4.2Out-of-bounds read from received-frame length underflow in the STM32WBA IEEE 802.15.4 driverPublished Oct 14, 2026
- CVE-2026-75084Medium 6.8Out-of-bounds write in the TI CC1200 IEEE 802.15.4 driver from an unvalidated radio-supplied packet lengthPublished Oct 14, 2026
- CVE-2026-75083Medium 5.9Integer underflow of the radio-reported frame length causes an out-of-bounds write in the NXP KW41Z IEEE 802.15.4 driverPublished Oct 14, 2026
- CVE-2026-102013Medium 6.7Junos OS and Junos OS Evolved: An attacker causes na-grpcd to crash when the InitialSync service is usedPublished Oct 14, 2026
- CVE-2026-101968Medium 5.3Junos OS and Junos OS Evolved: EX Series, MX Series, ACX Series: An attacker causes rpd heap memory disclosure when Rosen-MVPN data-MDT is enabledPublished Oct 14, 2026
- CVE-2026-101946Medium 5.3Junos OS and Junos OS Evolved: An attacker causes rpd process memory disclosure when IPv6 LDP is usedPublished Oct 14, 2026
- CVE-2026-101934Medium 6.7Junos OS and Junos OS Evolved: An attacker causes Denial of Service in eventdPublished Oct 14, 2026
- CVE-2016-15060Medium 6.9PCMan FTP Server PORT buffer overflowPublished Oct 14, 2026
- CVE-2026-102080Medium 6.0Junos OS: MX Series: Malformed SyncE or PTP clock input causes continuous RE switchoverPublished Oct 14, 2026
- CVE-2026-93635Medium 5.3Zimbra Collaboration Suite LDAP Filter Injection via Unescaped computeDn() Template SubstitutionPublished Oct 14, 2026
- CVE-2026-102085Medium 6.9Junos OS Evolved: A port which has been inadvertently exposed can be reached by an attackerPublished Oct 14, 2026
- CVE-2026-103993Medium 6.9Junos OS and Junos OS Evolved: If a specific set of BGP communities is present and graceful-shutdown sender is added while attempting to advertise rpd crashesPublished Oct 14, 2026
- CVE-2026-59951Medium 6.9MCP Python SDK: Unbounded Session Accumulation in StreamableHTTP Transport Enables Resource ExhaustionPublished Oct 14, 2026
- CVE-2026-101991Medium 5.3Junos OS and Junos OS Evolved: A BGP-LS peer causes heap data disclosure when traffic-engineering routing is enabledPublished Oct 14, 2026
- CVE-2026-101995Medium 5.3Junos OS and Junos OS Evolved: Malformed ICCP packets cause l2ald memory disclosure and disruptionPublished Oct 14, 2026
- CVE-2026-93683Medium 6.4When handling a virtio indirect descriptor table, the host reads the table length more than once from guest memory and can allocate a host copy before validating that length.Published Oct 14, 2026
- CVE-2026-91883Medium 4.3Dell Terraform Provider for OME, versions 1.0.0 through 1.2.3, contains an Insertion of Sensitive Information into Log File vulnerability in the provider configuration component.Published Oct 14, 2026
| CVE | Title | Severity | Published |
|---|---|---|---|
| CVE-2026-110763 | lamp-boot 4.16.0-java17 through 4.21.2-java17 contains an insecure direct object reference vulnerability in the oauth module's /anyone/findDeptByCompany endpoint that skips URI permission checks. | Medium 5.3 | |
| CVE-2026-110762 | bbPress before 2.6.19 contains an information disclosure vulnerability that allows unauthenticated visitors to view restricted subforum posts because hide_sitewide ignores ancestor forum visibility. | Medium 6.3 | |
| CVE-2026-110667 | Affected by this vulnerability is an unknown functionality of the file sar2html.py. | Medium 6.9 | |
| CVE-2026-110666 | The manipulation leads to path traversal. | Medium 6.9 | |
| CVE-2026-110248 | Insertion of sensitive information into log files in the git_utils[.]py component in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 before 2.257.3 might allow an authenticated remote user to obtain plaintext repository credentials… | Medium 6.0 | |
| CVE-2026-109506 | Multiple TP-Link Wi-Fi range extenders use a custom, reversible XOR-and-dictionary transformation in the HTTP web-management login flow. | Medium 5.9 | |
| CVE-2026-103974 | Prior to commit c54596c9e1569d378fe20f80d4c790c6fdee54c4, a user who can add a chapter to a study can place attacker-controlled text in the PGN Annotator tag, which… | Medium 5.4 | |
| CVE-2026-102756 | Prior to 2.10.26, authenticated users who can edit dataset fields and chart configuration can store an HTML-bearing dimension value in a bar-horizontal chart. | Medium 5.1 | |
| CVE-2026-102755 | Prior to 2.10.26, authenticated users with folder creation permission can store HTML-bearing names through datasource/createFolder or datasetTree/save. | Medium 5.1 | |
| CVE-2026-102682 | From 0.0.98 until 1.6.0, the pipecat-ai package's built-in development runner exposes unauthenticated endpoints including… | Medium 5.6 | |
| CVE-2026-102471 | In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the vertx-mail-client does not sanitize CR (\r) or LF (\n) characters in user-supplied email header names and values before writing them into… | Medium 6.9 | |
| CVE-2026-102354 | In versions through 2.8.6, cloudflare/cors-proxy-worker.js performs a DNS-over-HTTPS safety check in hostnameResolvesToPrivate(), as used by isValidCertificateUrl() and… | Medium 6.8 | |
| CVE-2026-54701 | Prior to 0.8.30, Markdown Preview Enhanced reads repository-controlled .crossnote/head.html content and passes it through resolvePathsInHeader before… | Medium 6.9 | |
| CVE-2026-54703 | Prior to 0.8.30, the _crossnote.updateMarkdown command in Markdown Preview Enhanced accepts an arbitrary URI and attacker-controlled content, then passes… | Medium 5.8 | |
| CVE-2026-92160 | Prior to 4.3.0, Svc::FileDownlink SendPartial range validation is vulnerable because the wrapping sum bypasses… | Medium 6.5 | |
| CVE-2026-92159 | Prior to 4.3.0, Svc::TlmPacketizer TlmRecv_handler fixed-slot copy TlmRecv_handler copies val.getSize bytes into… | Medium 6.5 | |
| CVE-2026-92157 | Prior to 4.3.0, Svc::FileDownlink SendPartial range validation is vulnerable because unchecked startOffset plus… | Medium 6.5 | |
| CVE-2026-92156 | Prior to 4.3.0, Svc::EventManager loqQueue_internalInterfaceHandler packetization is vulnerable because… | Medium 6.5 | |
| CVE-2026-86856 | Stack and heap buffers sized for a single queue pair can be overflowed when more virtqueues are configured, leading to a host crash or memory corruption. | Medium 6.5 | |
| CVE-2026-86849 | Integer overflow in chain length checks, and missing length checks on the RSA path, can overflow a host buffer in the vhost-crypto backend. | Medium 6.5 | |
| CVE-2026-86847 | Write-back chain cleanup can follow an uninitialized next pointer when mapping a guest descriptor fails, causing the host vhost-crypto process to hang or crash. | Medium 6.5 | |
| CVE-2026-86846 | A guest can supply an avail-ring descriptor index that is used without bounds checking, causing an out-of-bounds write in the host vhost-crypto backend. | Medium 6.5 | |
| CVE-2026-86845 | Session cleanup can leave a stale cached session pointer, and the data path does not check the session type before attaching it, leading to use-after-free or type confusion in the host… | Medium 6.5 | |
| CVE-2026-86566 | A guest with runt RX descriptors can underflow the copy length in vhost enqueue, causing a denial of service in a shared vhost backend such as OVS-DPDK. | Medium 6.5 | |
| CVE-2026-76083 | From 10.0.0 until 26.9.0, the JSON data source query runner in redash/query_runner/json_ds.py used _get_all_results() to combine its configured base_url with a user-supplied query… | Medium 4.9 | |
| CVE-2026-110777 | Calendar events containing a file:// URI in their ATTACH property automatically read the targeted local file, base64-encode its contents and upload it back to the server when the event is saved. | Medium 5.7 | |
| CVE-2026-108151 | Improper Control of Generation of Code ('Code Injection') vulnerability in PluginUs.Net MDTF wp-meta-data-filter-and-taxonomy-filter allows Code Injection.This issue affects MDTF: from n/a through 1.3.9. | Medium 5.3 | |
| CVE-2026-107348 | Integer overflow in the message buffer growth logic (mbuf_make_room) in PgBouncer 1.21.0 through 1.26.0 allows a remote attacker to cause a denial of service when max_packet_size is configured above 2147483648. | Medium 5.9 | |
| CVE-2026-103975 | Prior to 7.2.6, @appium/support ZIP extraction accepts an archive entry that creates a symbolic link to a location outside… | Medium 6.5 | |
| CVE-2026-96596 | erl_tar:extract/2 loops forever on a GNU sparse member with a trailing hole | Medium 5.9 | |
| CVE-2026-105236 | TLS 1.2 session resumption in ssl crosses SNI virtual-host client-certificate trust boundaries | Medium 6.3 | |
| CVE-2026-102054 | Junos OS and Junos OS Evolved: Insufficient validation of VXLAN overlay ping causes information disclosure when EVPN-VXLAN is configured | Medium 5.3 | |
| CVE-2026-102053 | Junos OS and Junos OS Evolved: An EVPN-VXLAN memory leak causes denial of service when active-active multihoming is used | Medium 6.9 | |
| CVE-2026-75085 | Out-of-bounds read from received-frame length underflow in the STM32WBA IEEE 802.15.4 driver | Medium 4.2 | |
| CVE-2026-75084 | Out-of-bounds write in the TI CC1200 IEEE 802.15.4 driver from an unvalidated radio-supplied packet length | Medium 6.8 | |
| CVE-2026-75083 | Integer underflow of the radio-reported frame length causes an out-of-bounds write in the NXP KW41Z IEEE 802.15.4 driver | Medium 5.9 | |
| CVE-2026-102013 | Junos OS and Junos OS Evolved: An attacker causes na-grpcd to crash when the InitialSync service is used | Medium 6.7 | |
| CVE-2026-101968 | Junos OS and Junos OS Evolved: EX Series, MX Series, ACX Series: An attacker causes rpd heap memory disclosure when Rosen-MVPN data-MDT is enabled | Medium 5.3 | |
| CVE-2026-101946 | Junos OS and Junos OS Evolved: An attacker causes rpd process memory disclosure when IPv6 LDP is used | Medium 5.3 | |
| CVE-2026-101934 | Junos OS and Junos OS Evolved: An attacker causes Denial of Service in eventd | Medium 6.7 | |
| CVE-2016-15060 | PCMan FTP Server PORT buffer overflow | Medium 6.9 | |
| CVE-2026-102080 | Junos OS: MX Series: Malformed SyncE or PTP clock input causes continuous RE switchover | Medium 6.0 | |
| CVE-2026-93635 | Zimbra Collaboration Suite LDAP Filter Injection via Unescaped computeDn() Template Substitution | Medium 5.3 | |
| CVE-2026-102085 | Junos OS Evolved: A port which has been inadvertently exposed can be reached by an attacker | Medium 6.9 | |
| CVE-2026-103993 | Junos OS and Junos OS Evolved: If a specific set of BGP communities is present and graceful-shutdown sender is added while attempting to advertise rpd crashes | Medium 6.9 | |
| CVE-2026-59951 | MCP Python SDK: Unbounded Session Accumulation in StreamableHTTP Transport Enables Resource Exhaustion | Medium 6.9 | |
| CVE-2026-101991 | Junos OS and Junos OS Evolved: A BGP-LS peer causes heap data disclosure when traffic-engineering routing is enabled | Medium 5.3 | |
| CVE-2026-101995 | Junos OS and Junos OS Evolved: Malformed ICCP packets cause l2ald memory disclosure and disruption | Medium 5.3 | |
| CVE-2026-93683 | When handling a virtio indirect descriptor table, the host reads the table length more than once from guest memory and can allocate a host copy before validating that length. | Medium 6.4 | |
| CVE-2026-91883 | Dell Terraform Provider for OME, versions 1.0.0 through 1.2.3, contains an Insertion of Sensitive Information into Log File vulnerability in the provider configuration component. | Medium 4.3 |
Showing 851–900 of 138,428. Narrow the filters to see the rest.
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status. Filter by severity and year here; the other filters work on the curated lists.