Vulnerability Intelligence · All CVEs
Every Published CVE, Searchable.
Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status.
Synced hourly · figures as of Oct 20, 2026
40,422 vulnerabilities · newest first
- CVE-2026-96659Critical 9.1Foreman: excessive permissions for viewer role on previewPublished Oct 1, 2026
- CVE-2026-19652Critical 9.8Divi Membership <= 2.2.0 - Unauthenticated Privilege Escalation via 'form_id' ParameterPublished Oct 1, 2026
- CVE-2026-59797Critical 9.8Apache HTTP Server: mod_ssl SSLRequire allows .htaccess ap_expr file-functionPublished Oct 1, 2026
- CVE-2026-13043Critical 9.3WatchGuard Endpoint Security Missing Authentication in Kernel Memory Access Driver Allows Arbitrary Kernel Memory AccessPublished Oct 1, 2026
- CVE-2026-57941Critical 9.8Apache HTTP Server: mod_http2 use-after-free / wild write via shared session->bbtmp re-entrancyPublished Oct 1, 2026
- CVE-2026-56154Critical 9.8Apache HTTP Server: mod_rewrite use-after-free via %{LA-U:HTTP:...}Published Oct 1, 2026
- CVE-2026-94620Critical 9.4Classroom 50 vulnerable to arbitrary file overwrite on the teacher's machine via symlink in a student repo (gh teacher download)Published Oct 1, 2026
- CVE-2026-12627Critical 9.8Fortra's Core Privileged Access Manager (BoKS) autoregistration stack buffer overflow vulnerabilityPublished Oct 1, 2026
- CVE-2026-79898Critical 9.1Fortra BoKS Manager contains a command injection vulnerability in crlserver.Published Oct 1, 2026
- CVE-2026-62071Critical 9.3Unauthenticated SQL Injection in WordPress File Upload <= 5.1.10 versions.Published Oct 1, 2026
- CVE-2026-103752Critical 9.8Unauthenticated Privilege Escalation in Authorizer <= 3.15.3 versions.Published Oct 1, 2026
- CVE-2026-79901Critical 9.9Predictable Active Directory service-account passwords in BoKS ManagerPublished Oct 1, 2026
- CVE-2026-103264Critical 9.3Fleet versions before 4.87.0 contain an authentication bypass vulnerability in the device API that accepts hostnames and hardware serials as authentication tokens in addition to device UUIDs.Published Oct 1, 2026
- CVE-2026-103244Critical 9.3ground-station versions before 0.8.0 contain an authentication bypass vulnerability in the setup.restore command that allows unauthenticated attackers to execute arbitrary SQL during first-run setup mode.Published Oct 1, 2026
- CVE-2026-103655Critical 9.3MISP TOTP Code Replay Allows Duplicate Authentication Within Validity PeriodPublished Oct 1, 2026
- CVE-2026-15989Critical 9.8Super Forms <= 6.3.316 - Unauthenticated Privilege Escalation via 'role' ParameterPublished Oct 1, 2026
- CVE-2026-75957Critical 9.8Ultimate Multisite <= 2.15.0 - Unauthenticated Authentication Bypass via 'checkout_form' ParameterPublished Oct 1, 2026
- CVE-2025-41753Critical 9.3Path traversal in dynamically created BACnet File ObjectsPublished Oct 1, 2026
- CVE-2026-101148Critical 10.0BackupSheep <= 1.8 - Unauthenticated Arbitrary File Deletion and Backup Exfiltration via Empty Integration KeyPublished Oct 1, 2026
- CVE-2026-82824Critical 9.3Path traversal may allow arbitrary files to be viewed, created, modified, or deletedPublished Oct 1, 2026
- CVE-2026-82825Critical 9.3Missing proper authentication for critical APIs may allow sensitive information to be obtained or modified, or unauthorized operations to be performedPublished Oct 1, 2026
- CVE-2026-82827Critical 9.3A hard-coded JWT signing secret key may allow administrative functions to be abused using fraudulently generated Bearer tokensPublished Oct 1, 2026
- CVE-2026-82829Critical 9.3Hidden accounts or hard-coded credentials may permit unauthorized access without the legitimate authentication processPublished Oct 1, 2026
- CVE-2026-76142Critical 9.3Genians, Inc.Published Oct 1, 2026
- CVE-2026-92966Critical 9.1Appointment Booking Plugin <= 5.7.0 - Unauthenticated Arbitrary Shortcode Execution via First/Last Name FieldPublished Oct 1, 2026
- CVE-2026-14157Critical 9.4Use of an Externally Controlled Format String in the ASUS Router modules allow a remote authenticated user to execute arbitrary commands via a crafted file uploaded through the web management interface.Published Oct 1, 2026
- CVE-2026-55330Critical 9.8In BluetoothCccHandlerCallbackImpl of bluetooth_ccc.cc, there is a possible use-after-free due to a logic error in the code.Published Oct 1, 2026
- CVE-2026-101283Critical 9.2iperf3 3.20–3.21 (esnet/iperf) has a pre-auth heap buffer overflow in decrypt_rsa_message(): a 256-byte RSA buffer is BIO_read with the attacker-controlled ciphertext length (guard warns only), so an unauthenticated client overflows the…Published Sep 30, 2026
- CVE-2026-92173Critical 9.1Prior to v74.0.0.878.1682 of Meta Horizon OS, MediaSyncJobReceiver could be induced to send a privileged PendingIntent including a com.oculus.vrshell CallerIdentity to an arbitrary application listening via NotificationListenerService.Published Sep 30, 2026
- CVE-2026-51872Critical 9.8Devika v1.0 is vulnerable to Code Injection via the Runner.run_code function in src/agents/runner/runner.py.Published Sep 30, 2026
- CVE-2026-51871Critical 9.8Devika v1.0 is vulnerable to Code Injection in the Runner.execute function in src/agents/runner/runner.py which allows an attacker to achieve arbitrary code execution by exploiting the direct execution of LLM-generated content.Published Sep 30, 2026
- CVE-2026-51870Critical 9.8DeepTutor v1.4.0 is vulnerable to command execution in /tutorbot/agent/tools/shell.py:ExecTool.execute.Published Sep 30, 2026
- CVE-2026-51869Critical 9.8DB-GPT v0.8.0 sandbox API silently falls back to LocalRuntime and executes code on host.Published Sep 30, 2026
- CVE-2026-51867Critical 9.8agentgpt v.1.0.0 is vulnerable to Incorrect Access Control in next/src/server/api/routers/agentRouter.ts.Published Sep 30, 2026
- CVE-2026-51866Critical 9.8In DB-GPT 0.7.5 and 0.8.0, a skill uploaded through the real /api/v1/skills/upload route can later be executed through the real /api/v1/chat/react-agent flow.Published Sep 30, 2026
- CVE-2026-51864Critical 9.1DB-GPT v0.7.5 and v0.8.0 contains directory traversal in python_file_upload (packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/python_upload_api.py:42).Published Sep 30, 2026
- CVE-2026-101276Critical 9.2iperf3 3.21 (esnet/iperf) contains a remote, unauthenticated heap use-after-free: the server's per-test watchdog server_timer_proc() frees streams without cancelling/joining their worker threads, so a blocked worker dereferences a freed…Published Sep 30, 2026
- CVE-2026-102105Critical 9.1Kiteworks Email Protection Gateway server-side request forgeryPublished Sep 30, 2026
- CVE-2026-102106Critical 9.1Kiteworks Email Protection Gateway improper authenticationPublished Sep 30, 2026
- CVE-2026-102115Critical 9.8Kiteworks Core Authentication Bypass in the Password Reset WorkflowPublished Sep 30, 2026
- CVE-2026-102104Critical 9.1Kiteworks Email Protection Gateway server-side request forgeryPublished Sep 30, 2026
- CVE-2026-102103Critical 9.1Kiteworks Email Protection Gateway server-side request forgeryPublished Sep 30, 2026
- CVE-2026-102102Critical 9.1Kiteworks Email Protection Gateway server-side request forgeryPublished Sep 30, 2026
- CVE-2026-102149Critical 9.4Kiteworks Email Protection Gateway Improper Access ControlPublished Sep 30, 2026
- CVE-2026-102147Critical 9.3Kiteworks Core Administrative Account Takeover through Stored Cross-site Scripting (XSS)Published Sep 30, 2026
- CVE-2026-102095Critical 9.1Kiteworks Email Protection Gateway server-side request forgeryPublished Sep 30, 2026
- CVE-2026-102992Critical 9.2piscina: Prototype-pollution gadget in ThreadPool.options allows RCE via execArgv / loadBalancer / envPublished Sep 30, 2026
- CVE-2026-103547Critical 9.2In ldapd in OpenBSD 7.8 before errata 057 and 7.9 before errata 021, delegated BSD authentication results are correlated only by the LDAP child process client file descriptor and LDAP message ID.Published Sep 30, 2026
- CVE-2026-100512Critical 9.8WordPress Nested Pages plugin <= 3.3.2 - PHP Object Injection vulnerabilityPublished Sep 30, 2026
- CVE-2026-103475Critical 9.3yii2-starter-kit through 4.2.0 Debug and Gii Module ExposurePublished Sep 30, 2026
| CVE | Title | Severity | Published |
|---|---|---|---|
| CVE-2026-96659 | Foreman: excessive permissions for viewer role on preview | Critical 9.1 | |
| CVE-2026-19652 | Divi Membership <= 2.2.0 - Unauthenticated Privilege Escalation via 'form_id' Parameter | Critical 9.8 | |
| CVE-2026-59797 | Apache HTTP Server: mod_ssl SSLRequire allows .htaccess ap_expr file-function | Critical 9.8 | |
| CVE-2026-13043 | WatchGuard Endpoint Security Missing Authentication in Kernel Memory Access Driver Allows Arbitrary Kernel Memory Access | Critical 9.3 | |
| CVE-2026-57941 | Apache HTTP Server: mod_http2 use-after-free / wild write via shared session->bbtmp re-entrancy | Critical 9.8 | |
| CVE-2026-56154 | Apache HTTP Server: mod_rewrite use-after-free via %{LA-U:HTTP:...} | Critical 9.8 | |
| CVE-2026-94620 | Classroom 50 vulnerable to arbitrary file overwrite on the teacher's machine via symlink in a student repo (gh teacher download) | Critical 9.4 | |
| CVE-2026-12627 | Fortra's Core Privileged Access Manager (BoKS) autoregistration stack buffer overflow vulnerability | Critical 9.8 | |
| CVE-2026-79898 | Fortra BoKS Manager contains a command injection vulnerability in crlserver. | Critical 9.1 | |
| CVE-2026-62071 | Unauthenticated SQL Injection in WordPress File Upload <= 5.1.10 versions. | Critical 9.3 | |
| CVE-2026-103752 | Unauthenticated Privilege Escalation in Authorizer <= 3.15.3 versions. | Critical 9.8 | |
| CVE-2026-79901 | Predictable Active Directory service-account passwords in BoKS Manager | Critical 9.9 | |
| CVE-2026-103264 | Fleet versions before 4.87.0 contain an authentication bypass vulnerability in the device API that accepts hostnames and hardware serials as authentication tokens in addition to device UUIDs. | Critical 9.3 | |
| CVE-2026-103244 | ground-station versions before 0.8.0 contain an authentication bypass vulnerability in the setup.restore command that allows unauthenticated attackers to execute arbitrary SQL during first-run setup mode. | Critical 9.3 | |
| CVE-2026-103655 | MISP TOTP Code Replay Allows Duplicate Authentication Within Validity Period | Critical 9.3 | |
| CVE-2026-15989 | Super Forms <= 6.3.316 - Unauthenticated Privilege Escalation via 'role' Parameter | Critical 9.8 | |
| CVE-2026-75957 | Ultimate Multisite <= 2.15.0 - Unauthenticated Authentication Bypass via 'checkout_form' Parameter | Critical 9.8 | |
| CVE-2025-41753 | Path traversal in dynamically created BACnet File Objects | Critical 9.3 | |
| CVE-2026-101148 | BackupSheep <= 1.8 - Unauthenticated Arbitrary File Deletion and Backup Exfiltration via Empty Integration Key | Critical 10.0 | |
| CVE-2026-82824 | Path traversal may allow arbitrary files to be viewed, created, modified, or deleted | Critical 9.3 | |
| CVE-2026-82825 | Missing proper authentication for critical APIs may allow sensitive information to be obtained or modified, or unauthorized operations to be performed | Critical 9.3 | |
| CVE-2026-82827 | A hard-coded JWT signing secret key may allow administrative functions to be abused using fraudulently generated Bearer tokens | Critical 9.3 | |
| CVE-2026-82829 | Hidden accounts or hard-coded credentials may permit unauthorized access without the legitimate authentication process | Critical 9.3 | |
| CVE-2026-76142 | Genians, Inc. | Critical 9.3 | |
| CVE-2026-92966 | Appointment Booking Plugin <= 5.7.0 - Unauthenticated Arbitrary Shortcode Execution via First/Last Name Field | Critical 9.1 | |
| CVE-2026-14157 | Use of an Externally Controlled Format String in the ASUS Router modules allow a remote authenticated user to execute arbitrary commands via a crafted file uploaded through the web management interface. | Critical 9.4 | |
| CVE-2026-55330 | In BluetoothCccHandlerCallbackImpl of bluetooth_ccc.cc, there is a possible use-after-free due to a logic error in the code. | Critical 9.8 | |
| CVE-2026-101283 | iperf3 3.20–3.21 (esnet/iperf) has a pre-auth heap buffer overflow in decrypt_rsa_message(): a 256-byte RSA buffer is BIO_read with the attacker-controlled ciphertext length (guard warns only), so an unauthenticated client overflows the… | Critical 9.2 | |
| CVE-2026-92173 | Prior to v74.0.0.878.1682 of Meta Horizon OS, MediaSyncJobReceiver could be induced to send a privileged PendingIntent including a com.oculus.vrshell CallerIdentity to an arbitrary application listening via NotificationListenerService. | Critical 9.1 | |
| CVE-2026-51872 | Devika v1.0 is vulnerable to Code Injection via the Runner.run_code function in src/agents/runner/runner.py. | Critical 9.8 | |
| CVE-2026-51871 | Devika v1.0 is vulnerable to Code Injection in the Runner.execute function in src/agents/runner/runner.py which allows an attacker to achieve arbitrary code execution by exploiting the direct execution of LLM-generated content. | Critical 9.8 | |
| CVE-2026-51870 | DeepTutor v1.4.0 is vulnerable to command execution in /tutorbot/agent/tools/shell.py:ExecTool.execute. | Critical 9.8 | |
| CVE-2026-51869 | DB-GPT v0.8.0 sandbox API silently falls back to LocalRuntime and executes code on host. | Critical 9.8 | |
| CVE-2026-51867 | agentgpt v.1.0.0 is vulnerable to Incorrect Access Control in next/src/server/api/routers/agentRouter.ts. | Critical 9.8 | |
| CVE-2026-51866 | In DB-GPT 0.7.5 and 0.8.0, a skill uploaded through the real /api/v1/skills/upload route can later be executed through the real /api/v1/chat/react-agent flow. | Critical 9.8 | |
| CVE-2026-51864 | DB-GPT v0.7.5 and v0.8.0 contains directory traversal in python_file_upload (packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/python_upload_api.py:42). | Critical 9.1 | |
| CVE-2026-101276 | iperf3 3.21 (esnet/iperf) contains a remote, unauthenticated heap use-after-free: the server's per-test watchdog server_timer_proc() frees streams without cancelling/joining their worker threads, so a blocked worker dereferences a freed… | Critical 9.2 | |
| CVE-2026-102105 | Kiteworks Email Protection Gateway server-side request forgery | Critical 9.1 | |
| CVE-2026-102106 | Kiteworks Email Protection Gateway improper authentication | Critical 9.1 | |
| CVE-2026-102115 | Kiteworks Core Authentication Bypass in the Password Reset Workflow | Critical 9.8 | |
| CVE-2026-102104 | Kiteworks Email Protection Gateway server-side request forgery | Critical 9.1 | |
| CVE-2026-102103 | Kiteworks Email Protection Gateway server-side request forgery | Critical 9.1 | |
| CVE-2026-102102 | Kiteworks Email Protection Gateway server-side request forgery | Critical 9.1 | |
| CVE-2026-102149 | Kiteworks Email Protection Gateway Improper Access Control | Critical 9.4 | |
| CVE-2026-102147 | Kiteworks Core Administrative Account Takeover through Stored Cross-site Scripting (XSS) | Critical 9.3 | |
| CVE-2026-102095 | Kiteworks Email Protection Gateway server-side request forgery | Critical 9.1 | |
| CVE-2026-102992 | piscina: Prototype-pollution gadget in ThreadPool.options allows RCE via execArgv / loadBalancer / env | Critical 9.2 | |
| CVE-2026-103547 | In ldapd in OpenBSD 7.8 before errata 057 and 7.9 before errata 021, delegated BSD authentication results are correlated only by the LDAP child process client file descriptor and LDAP message ID. | Critical 9.2 | |
| CVE-2026-100512 | WordPress Nested Pages plugin <= 3.3.2 - PHP Object Injection vulnerability | Critical 9.8 | |
| CVE-2026-103475 | yii2-starter-kit through 4.2.0 Debug and Gii Module Exposure | Critical 9.3 |
Showing 901–950 of 40,422. Narrow the filters to see the rest.
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status. Filter by severity and year here; the other filters work on the curated lists.