Vulnerability Intelligence · All CVEs
Every Published CVE, Searchable.
Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status.
Synced hourly · figures as of Oct 20, 2026
11,311 vulnerabilities · newest first
- CVE-2026-76816Low 3.5Prior to versions 4.1.137.Final and 4.2.17.Final, MqttEncoder does not validate client identifiers, will topics, usernames, and PUBLISH topic names before encoding,…Published Aug 24, 2026
- CVE-2026-75554Low 2.3Explicit organization scopes survive token refresh after membership endsPublished Aug 24, 2026
- CVE-2026-78187Low 2.3This impacts an unknown function of the component Public Authentication Page.Published Aug 24, 2026
- CVE-2026-78177Low 2.0Affected by this issue is the function installPackage of the file packages/devtools-bundler-core/src/package-manager.ts of the component Development Devtools Event Bus.Published Aug 24, 2026
- CVE-2026-19565Low 3.7Apache::AppSamurai::Util versions through 1.01 for Perl generate predictable session authentication keys from the clock and process id in CreateSessionAuthKey.Published Aug 23, 2026
- CVE-2026-77003Low 2.7The Content Mask WordPress plugin before 1.8.5.5 does not check the capability required to publish the post type being created, allowing users with a role as low as Contributor to publish posts and pages on the site without holding the…Published Aug 23, 2026
- CVE-2026-71514Low 2.0NLTK 3.9.4 through 3.10.2 contains a path traversal vulnerability in CrubadanCorpusReader.Published Aug 22, 2026
- CVE-2026-14187Low 2.7The Tutor LMS WordPress plugin before 4.0.6 does not enforce per-object ownership checks on its course content type, allowing any user with the instructor role to read the content of private courses belonging to other instructors.Published Aug 22, 2026
- CVE-2026-33333Low 3.5Prior to 3.2.3, there is sensitive information disclosure in the error messages.Published Aug 21, 2026
- CVE-2026-18356Low 3.7The Limit Login Attempts Reloaded WordPress plugin before 3.3.5 does not compare logins against its username denylist case-insensitively and does not account for the account's email address, allowing an account an administrator intended…Published Aug 21, 2026
- CVE-2026-13176Low 2.7The Eventin WordPress plugin before 4.1.21 does not validate a user-supplied webhook URL stored on events nor verify event ownership, allowing users with contributor-level access and above to trigger blind server-side requests to…Published Aug 21, 2026
- CVE-2026-47079Low 2.1Round-trip Corruption via Improper Entity Escaping in xml_builderPublished Aug 21, 2026
- CVE-2026-48590Low 2.1Element and Attribute Names Injected Verbatim into XML Output in xml_builderPublished Aug 21, 2026
- CVE-2026-47080Low 2.1CDATA Section Breakout via Unsanitised ]]> in xml_builderPublished Aug 21, 2026
- CVE-2026-66721Low 2.7Missing authorization issue for domain admins in CloudStack's host tags listing functionality.Published Aug 21, 2026
- CVE-2026-19435Low 2.7The Duplicate Post WordPress plugin before 1.5.6 does not check the user's capabilities before returning post data, allowing users with a delegated role to read the content, metadata and passwords of posts they are not allowed to access,…Published Aug 21, 2026
- CVE-2026-19085Low 2.7The Duplicate Post WordPress plugin before 1.5.6 does not check that a user may read the content of a post before duplicating it, allowing users with a delegated role to republish another user's password-protected post as publicly readable.Published Aug 21, 2026
- CVE-2026-16577Low 2.7The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 does not validate a client-supplied payment amount against the vendor's actual outstanding balance when recording a reverse-withdrawal…Published Aug 21, 2026
- CVE-2026-14325Low 3.5The Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin before 1.3.9.9 does not escape one of its settings before using it as an HTML tag name in front-end output, allowing users with administrator access to inject…Published Aug 21, 2026
- CVE-2026-43679Low 2.4This issue was addressed with improved permissions checking.Published Aug 21, 2026
- CVE-2026-77648Low 2.2In OpenStack Glance through 32.0.0, the /v2/tasks API accepts type=import tasks that bypass import_filtering_opts, allowing an admin to fetch internal URLs from the Glance service network (aka SSRF), as long as https:// or http:// is used.Published Aug 20, 2026
- CVE-2026-54505Low 2.0Prior to 3.1.0, when the Journey add-on is enabled, TREK interpolates the unescaped activeSuggestion.title value into journey.frontpage.suggestionText through client/src/i18n/TranslationContext.tsx…Published Aug 20, 2026
- CVE-2026-70652Low 2.0Prior to version 8.18.3, libvips built with libultrahdr support can incorrectly size an output buffer in libvips/foreign/uhdrsave.c within…Published Aug 20, 2026
- CVE-2026-49996Low 3.7securedrop-proxy origin limitation can be bypassed with redirectsPublished Aug 20, 2026
- CVE-2026-72847Low 2.4broot Terminal Escape Sequence Injection via Unsanitized File and Directory Names in the Tree ViewPublished Aug 20, 2026
- CVE-2026-18283Low 2.4Sony XAV-9500ES udev USB Rules Authorization Bypass Vulnerability.Published Aug 20, 2026
- CVE-2026-18280Low 3.9Sony XAV-9500ES gpsd Buffer Overflow Arbitrary Code Execution Vulnerability.Published Aug 20, 2026
- CVE-2026-18278Low 3.5Sony XAV-9500ES prh_l2_decode_packet Out-Of-Bounds Read Information Disclosure Vulnerability.Published Aug 20, 2026
- CVE-2026-64846Low 2.8Nix: Arbitrary file truncation outside the sandbox with recursive-nix experimental featurePublished Aug 20, 2026
- CVE-2026-76993Low 2.3GreyDGL PentestGPT Web-Page Crawling injectionPublished Aug 20, 2026
- CVE-2026-64963Low 2.3Path Traversal in ATutorPublished Aug 20, 2026
- CVE-2026-7485Low 2.3Incorrect authorization in frozen BI aggregations in Checkmk <2.5.0p2, <2.4.0p29, <2.3.0p47, and all 2.2.0 versions allows an authenticated user with restricted host and service visibility to learn the names and the existence of hosts and…Published Aug 20, 2026
- CVE-2026-77069Low 2.3n8n before 1.123.69, 2.33.4, and 2.34.1 contains an SSRF protection bypass in the OAuth2 credential authorization-code-to-access-token exchange.Published Aug 20, 2026
- CVE-2026-19699Low 2.7The GutenKit WordPress plugin before 2.5.0 does not have a sufficient capability check on some of its REST API endpoints, allowing users with the Contributor role and above to retrieve mailing-list audience metadata from the site's…Published Aug 20, 2026
- CVE-2026-76371Low 2.7In FireAMP versions below 2.1.15, a user who holds a role that can edit, create, or run playbooks in Splunk SOAR could run the add listitem action in a Safe Mode playbook while that action is listed as read-only, which could allow for…Published Aug 19, 2026
- CVE-2026-76369Low 2.7In Splunk SOAR versions below 8.6.0, a user who holds the OnPrem Broker role could write files outside the intended Automation Broker log directory.Published Aug 19, 2026
- CVE-2026-76368Low 2.7In Splunk SOAR versions below 8.6.0, a user who holds a role that contains the playbooks:view permission could view metadata about a playbook repository that they are not authorized to view.Published Aug 19, 2026
- CVE-2026-76361Low 2.7In Splunk SOAR versions below 8.6.0, a user with the "Administrator" role could use the /rest/support/connectivity/.../check_connectivity endpoint to make Splunk SOAR initiate outbound network connections to arbitrary destinations and…Published Aug 19, 2026
- CVE-2026-76348Low 3.8In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds a Splunk role that contains the high-privilege list_search_head_clustering capability could send a read request to Search Head Cluster member control…Published Aug 19, 2026
- CVE-2026-75476Low 3.1Tanium addressed a compression bomb vulnerability in Threat Response.Published Aug 19, 2026
- CVE-2026-68554Low 2.3Prior to 4.15.0, an on-path attacker can append attributes after MESSAGE-INTEGRITY to an authenticated STUN request on plain UDP or TCP, adjust the STUN header length,…Published Aug 19, 2026
- CVE-2026-11617Low 3.1Tanium addressed a compression bomb vulnerability in Findings.Published Aug 19, 2026
- CVE-2026-61712Low 2.3Prior to 0.31.1, BuildKit read attacker-controlled /etc/passwd and /etc/group files without an upper bound while…Published Aug 19, 2026
- CVE-2026-16891Low 3.3IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to obtain sensitive information due to an out-of-bounds read.Published Aug 19, 2026
- CVE-2026-16890Low 3.6IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to obtain sensitive information or cause a denial of service due to an integer overflow.Published Aug 19, 2026
- CVE-2026-16888Low 3.7IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to obtain sensitive information due to a path traversal vulnerability.Published Aug 19, 2026
- CVE-2026-75583Low 2.3keeper.sh's calendar module version prior to 2.18.14 contains a server-side request forgery (SSRF) guard bypass vulnerability that allows authenticated attackers to reach private network addresses by exploiting a DNS rebinding attack…Published Aug 19, 2026
- CVE-2026-62670Low 2.3Grav Flex Objects Plugin allows you to build custom collections of objects.Published Aug 19, 2026
- CVE-2026-65610Low 2.4nnn stores homelen variable as uchar_t, which can only represent values in the range 0-255.Published Aug 19, 2026
- CVE-2026-65609Low 2.4nnn is vulnerable to Out-of-Bound write vulnerability.Published Aug 19, 2026
| CVE | Title | Severity | Published |
|---|---|---|---|
| CVE-2026-76816 | Prior to versions 4.1.137.Final and 4.2.17.Final, MqttEncoder does not validate client identifiers, will topics, usernames, and PUBLISH topic names before encoding,… | Low 3.5 | |
| CVE-2026-75554 | Explicit organization scopes survive token refresh after membership ends | Low 2.3 | |
| CVE-2026-78187 | This impacts an unknown function of the component Public Authentication Page. | Low 2.3 | |
| CVE-2026-78177 | Affected by this issue is the function installPackage of the file packages/devtools-bundler-core/src/package-manager.ts of the component Development Devtools Event Bus. | Low 2.0 | |
| CVE-2026-19565 | Apache::AppSamurai::Util versions through 1.01 for Perl generate predictable session authentication keys from the clock and process id in CreateSessionAuthKey. | Low 3.7 | |
| CVE-2026-77003 | The Content Mask WordPress plugin before 1.8.5.5 does not check the capability required to publish the post type being created, allowing users with a role as low as Contributor to publish posts and pages on the site without holding the… | Low 2.7 | |
| CVE-2026-71514 | NLTK 3.9.4 through 3.10.2 contains a path traversal vulnerability in CrubadanCorpusReader. | Low 2.0 | |
| CVE-2026-14187 | The Tutor LMS WordPress plugin before 4.0.6 does not enforce per-object ownership checks on its course content type, allowing any user with the instructor role to read the content of private courses belonging to other instructors. | Low 2.7 | |
| CVE-2026-33333 | Prior to 3.2.3, there is sensitive information disclosure in the error messages. | Low 3.5 | |
| CVE-2026-18356 | The Limit Login Attempts Reloaded WordPress plugin before 3.3.5 does not compare logins against its username denylist case-insensitively and does not account for the account's email address, allowing an account an administrator intended… | Low 3.7 | |
| CVE-2026-13176 | The Eventin WordPress plugin before 4.1.21 does not validate a user-supplied webhook URL stored on events nor verify event ownership, allowing users with contributor-level access and above to trigger blind server-side requests to… | Low 2.7 | |
| CVE-2026-47079 | Round-trip Corruption via Improper Entity Escaping in xml_builder | Low 2.1 | |
| CVE-2026-48590 | Element and Attribute Names Injected Verbatim into XML Output in xml_builder | Low 2.1 | |
| CVE-2026-47080 | CDATA Section Breakout via Unsanitised ]]> in xml_builder | Low 2.1 | |
| CVE-2026-66721 | Missing authorization issue for domain admins in CloudStack's host tags listing functionality. | Low 2.7 | |
| CVE-2026-19435 | The Duplicate Post WordPress plugin before 1.5.6 does not check the user's capabilities before returning post data, allowing users with a delegated role to read the content, metadata and passwords of posts they are not allowed to access,… | Low 2.7 | |
| CVE-2026-19085 | The Duplicate Post WordPress plugin before 1.5.6 does not check that a user may read the content of a post before duplicating it, allowing users with a delegated role to republish another user's password-protected post as publicly readable. | Low 2.7 | |
| CVE-2026-16577 | The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 does not validate a client-supplied payment amount against the vendor's actual outstanding balance when recording a reverse-withdrawal… | Low 2.7 | |
| CVE-2026-14325 | The Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin before 1.3.9.9 does not escape one of its settings before using it as an HTML tag name in front-end output, allowing users with administrator access to inject… | Low 3.5 | |
| CVE-2026-43679 | This issue was addressed with improved permissions checking. | Low 2.4 | |
| CVE-2026-77648 | In OpenStack Glance through 32.0.0, the /v2/tasks API accepts type=import tasks that bypass import_filtering_opts, allowing an admin to fetch internal URLs from the Glance service network (aka SSRF), as long as https:// or http:// is used. | Low 2.2 | |
| CVE-2026-54505 | Prior to 3.1.0, when the Journey add-on is enabled, TREK interpolates the unescaped activeSuggestion.title value into journey.frontpage.suggestionText through client/src/i18n/TranslationContext.tsx… | Low 2.0 | |
| CVE-2026-70652 | Prior to version 8.18.3, libvips built with libultrahdr support can incorrectly size an output buffer in libvips/foreign/uhdrsave.c within… | Low 2.0 | |
| CVE-2026-49996 | securedrop-proxy origin limitation can be bypassed with redirects | Low 3.7 | |
| CVE-2026-72847 | broot Terminal Escape Sequence Injection via Unsanitized File and Directory Names in the Tree View | Low 2.4 | |
| CVE-2026-18283 | Sony XAV-9500ES udev USB Rules Authorization Bypass Vulnerability. | Low 2.4 | |
| CVE-2026-18280 | Sony XAV-9500ES gpsd Buffer Overflow Arbitrary Code Execution Vulnerability. | Low 3.9 | |
| CVE-2026-18278 | Sony XAV-9500ES prh_l2_decode_packet Out-Of-Bounds Read Information Disclosure Vulnerability. | Low 3.5 | |
| CVE-2026-64846 | Nix: Arbitrary file truncation outside the sandbox with recursive-nix experimental feature | Low 2.8 | |
| CVE-2026-76993 | GreyDGL PentestGPT Web-Page Crawling injection | Low 2.3 | |
| CVE-2026-64963 | Path Traversal in ATutor | Low 2.3 | |
| CVE-2026-7485 | Incorrect authorization in frozen BI aggregations in Checkmk <2.5.0p2, <2.4.0p29, <2.3.0p47, and all 2.2.0 versions allows an authenticated user with restricted host and service visibility to learn the names and the existence of hosts and… | Low 2.3 | |
| CVE-2026-77069 | n8n before 1.123.69, 2.33.4, and 2.34.1 contains an SSRF protection bypass in the OAuth2 credential authorization-code-to-access-token exchange. | Low 2.3 | |
| CVE-2026-19699 | The GutenKit WordPress plugin before 2.5.0 does not have a sufficient capability check on some of its REST API endpoints, allowing users with the Contributor role and above to retrieve mailing-list audience metadata from the site's… | Low 2.7 | |
| CVE-2026-76371 | In FireAMP versions below 2.1.15, a user who holds a role that can edit, create, or run playbooks in Splunk SOAR could run the add listitem action in a Safe Mode playbook while that action is listed as read-only, which could allow for… | Low 2.7 | |
| CVE-2026-76369 | In Splunk SOAR versions below 8.6.0, a user who holds the OnPrem Broker role could write files outside the intended Automation Broker log directory. | Low 2.7 | |
| CVE-2026-76368 | In Splunk SOAR versions below 8.6.0, a user who holds a role that contains the playbooks:view permission could view metadata about a playbook repository that they are not authorized to view. | Low 2.7 | |
| CVE-2026-76361 | In Splunk SOAR versions below 8.6.0, a user with the "Administrator" role could use the /rest/support/connectivity/.../check_connectivity endpoint to make Splunk SOAR initiate outbound network connections to arbitrary destinations and… | Low 2.7 | |
| CVE-2026-76348 | In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds a Splunk role that contains the high-privilege list_search_head_clustering capability could send a read request to Search Head Cluster member control… | Low 3.8 | |
| CVE-2026-75476 | Tanium addressed a compression bomb vulnerability in Threat Response. | Low 3.1 | |
| CVE-2026-68554 | Prior to 4.15.0, an on-path attacker can append attributes after MESSAGE-INTEGRITY to an authenticated STUN request on plain UDP or TCP, adjust the STUN header length,… | Low 2.3 | |
| CVE-2026-11617 | Tanium addressed a compression bomb vulnerability in Findings. | Low 3.1 | |
| CVE-2026-61712 | Prior to 0.31.1, BuildKit read attacker-controlled /etc/passwd and /etc/group files without an upper bound while… | Low 2.3 | |
| CVE-2026-16891 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to obtain sensitive information due to an out-of-bounds read. | Low 3.3 | |
| CVE-2026-16890 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to obtain sensitive information or cause a denial of service due to an integer overflow. | Low 3.6 | |
| CVE-2026-16888 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to obtain sensitive information due to a path traversal vulnerability. | Low 3.7 | |
| CVE-2026-75583 | keeper.sh's calendar module version prior to 2.18.14 contains a server-side request forgery (SSRF) guard bypass vulnerability that allows authenticated attackers to reach private network addresses by exploiting a DNS rebinding attack… | Low 2.3 | |
| CVE-2026-62670 | Grav Flex Objects Plugin allows you to build custom collections of objects. | Low 2.3 | |
| CVE-2026-65610 | nnn stores homelen variable as uchar_t, which can only represent values in the range 0-255. | Low 2.4 | |
| CVE-2026-65609 | nnn is vulnerable to Out-of-Bound write vulnerability. | Low 2.4 |
Showing 901–950 of 11,311. Narrow the filters to see the rest.
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status. Filter by severity and year here; the other filters work on the curated lists.