Vulnerability Intelligence · All CVEs
Every Published CVE, Searchable.
Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status.
Synced hourly · figures as of Oct 20, 2026
138,429 vulnerabilities · newest first
- CVE-2026-91883Medium 4.3Dell Terraform Provider for OME, versions 1.0.0 through 1.2.3, contains an Insertion of Sensitive Information into Log File vulnerability in the provider configuration component.Published Oct 14, 2026
- CVE-2026-89069Medium 5.4Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Transfer (Ad Hoc module).Published Oct 14, 2026
- CVE-2026-86561Medium 6.5Memory size is not adequately validated before mmap during vhost memory-region setup, which can lead to a host crash or memory corruption.Published Oct 14, 2026
- CVE-2026-76113Medium 4.3Dell Terraform Provider for Redfish, versions 1.1.0 through 1.6.1, contains an Exposure of Sensitive Information to an Unauthorized Actor vulnerability in the redfish_certificate resource component.Published Oct 14, 2026
- CVE-2026-62858Medium 5.3Prior to 1.10.5, yourls_get_request() extracted the request path without sanitization, after which yourls_sanitize_url() and yourls_esc_url() preserved dot and slash…Published Oct 14, 2026
- CVE-2026-110719Medium 6.9Portkey AI Gateway 1.14.0 through 1.15.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to reach loopback and Docker host services because isValidCustomHost trusts localhost-style hosts when…Published Oct 14, 2026
- CVE-2026-110717Medium 6.9Janus WebRTC Server through 1.4.3 contains a path traversal vulnerability in the Record&Play plugin that allows unauthenticated attackers to write files outside recordings_path via the record request filename.Published Oct 14, 2026
- CVE-2026-110716Medium 6.8unshield through 1.6.2 contains a heap out-of-bounds read vulnerability in unshield_get_file_table() that allows attackers to read past heap allocations via unchecked cabinet header offsets.Published Oct 14, 2026
- CVE-2026-110715Medium 6.9MuJS 1.3.6 before 1.3.9 contains a heap out-of-bounds read and write vulnerability in Array.prototype.sort that allows attackers to corrupt memory by inflating a simple array's length.Published Oct 14, 2026
- CVE-2026-110661Medium 4.8CGNS through 4.5.2 contains a stack out-of-bounds read vulnerability in ADFI_read_node_header that allows attackers to crash applications by supplying crafted ADF node headers.Published Oct 14, 2026
- CVE-2026-110660Medium 4.8vgmstream through r2117 contains a stack out-of-bounds read vulnerability in the G.722.1/Siren14 decoder in g7221_lib.c, whose bit reader refills without checking the data_u32 array end.Published Oct 14, 2026
- CVE-2026-110659Medium 6.8ELFIO through 3.12 contains a NULL pointer dereference vulnerability in relocation_section_accessor get_entry() that allows attackers to crash applications via an unvalidated sh_link index.Published Oct 14, 2026
- CVE-2026-110658Medium 6.9Sofia-SIP through 1.13.18 contains a heap out-of-bounds read vulnerability in msg_multipart_parse() that allows unauthenticated remote attackers to crash the process by sending oversized MIME boundaries.Published Oct 14, 2026
- CVE-2026-110657Medium 4.8Khronos NNEF-Tools nnef through 1.0.10 and nnef-tools through 1.0.11 contain a path traversal vulnerability that allows attackers to write files outside the model directory via crafted variable labels.Published Oct 14, 2026
- CVE-2026-110654Medium 6.9libzvbi through 0.2.45 contains an out-of-bounds write vulnerability in the Teletext decoder that allows attackers to corrupt memory by supplying unvalidated DRCS pixel-mode values in X/28/3 packets.Published Oct 14, 2026
- CVE-2026-109438Medium 6.33proxy from 0.9.7 through 1.0.1, fixed in commit 206c923, contains an uninitialized stack memory disclosure vulnerability that allows unauthenticated attackers to leak stack bytes via the SOCKS4 reply path when the external-NAT option…Published Oct 14, 2026
- CVE-2026-100404Medium 6.5In Zulip Server versions through 12.1, guest users can receive new message events for public channels outside their subscriptions.Published Oct 14, 2026
- CVE-2026-100394Medium 6.5From 2.2.7 until 2.2.11, ServiceSentinel.worker in service/singleton/servicesentinel.go checked an owned service under servicesLock and later…Published Oct 14, 2026
- CVE-2026-95101Medium 6.9Description NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module.Published Oct 14, 2026
- CVE-2026-78433Medium 5.9Gitea's web attachment handler skips its cross-repository ownership check for attachments created before 16 January 2026 and checks permissions against the repository named in the request URL instead.Published Oct 14, 2026
- CVE-2026-78231Medium 5.3When OpenID sign-in is enabled, Gitea processes unauthenticated assertion parameters and sends an HTTP POST request to the caller-supplied OpenID provider endpoint during verification.Published Oct 14, 2026
- CVE-2026-73814Medium 6.5Gitea's collaboration access-mode endpoint accepts the Owner access mode from an authenticated repository collaborator with Admin access.Published Oct 14, 2026
- CVE-2026-73273Medium 4.3Gitea's Maven upload handler reads checksum uploads entirely into memory and returns before enforcing package-size quotas.Published Oct 14, 2026
- CVE-2026-73135Medium 5.3Gitea uses inconsistent repository visibility predicates, and the condition used by some repository-listing endpoints admits repositories whose owners are hidden from the viewer.Published Oct 14, 2026
- CVE-2026-73130Medium 4.3Gitea does not limit the length of the gitignores field accepted by repository-creation forms and the API.Published Oct 14, 2026
- CVE-2026-73126Medium 4.3Gitea's Actions workflow status badge endpoint does not enforce repository-read scope or the public-only restriction on the token authenticating the request.Published Oct 14, 2026
- CVE-2026-71301Medium 4.3Gitea's repository markup endpoint resolves same-repository pull request references without enforcing the viewer's Pull Requests permission.Published Oct 14, 2026
- CVE-2026-70407Medium 4.3Gitea's organization-list API does not enforce the read:organization token scope.Published Oct 14, 2026
- CVE-2026-70406Medium 6.5Gitea's shared comparison helper omits the token repository-access check used when updating pull requests.Published Oct 14, 2026
- CVE-2026-70402Medium 5.8Gitea creates server-side Git hook directories and scripts with mode 0777 and relies on the process umask to restrict access.Published Oct 14, 2026
- CVE-2026-70400Medium 5.4Gitea's repository migration API accepts a public-only token when the request specifies creation of a private repository.Published Oct 14, 2026
- CVE-2026-70396Medium 5.4Gitea's organization repository-creation API requires write:organization but omits the write:repository token scope enforced by other repository-creation routes.Published Oct 14, 2026
- CVE-2026-68964Medium 4.3Gitea's user SSH and GPG key-list API endpoints omit the profile visibility check applied by their web equivalents.Published Oct 14, 2026
- CVE-2026-68957Medium 4.3Gitea's API and web issue-search paths do not treat restricted accounts as anonymous viewers when evaluating Limited-visibility repository owners.Published Oct 14, 2026
- CVE-2026-67577Medium 4.3Gitea's activity-feed and contribution-heatmap API handlers do not apply the profile visibility check for restricted accounts viewing Limited-visibility users.Published Oct 14, 2026
- CVE-2026-66874Medium 6.5For pull request events, Gitea reads workflow definitions from the pull request head and posts a synthetic skipped status when workflow branch or path filters exclude execution.Published Oct 14, 2026
- CVE-2026-66853Medium 4.3Gitea's user organization-list API includes Limited-visibility organizations for authenticated restricted accounts without applying the visibility restriction enforced by the single-organization endpoint.Published Oct 14, 2026
- CVE-2026-66849Medium 4.3Gitea's package registry grants authenticated users read access to packages owned by Limited-visibility users without excluding restricted accounts.Published Oct 14, 2026
- CVE-2026-63792Medium 5.3Gitea's collaborative-owner authorization path for reading cross-repository reusable workflows does not exclude fork pull request runs.Published Oct 14, 2026
- CVE-2026-63021Medium 6.5Gitea's Swift package parser limits each manifest to 128 KiB but does not limit the number of manifests or their aggregate size before reading them into memory.Published Oct 14, 2026
- CVE-2026-62925Medium 6.5Gitea parses Alpine package uploads before enforcing package-size quotas and does not bound the decompressed .PKGINFO data or its dependency and provides entry counts.Published Oct 14, 2026
- CVE-2026-60021Medium 6.5Gitea's initial GitLab migration version probe uses an HTTP client without a timeout and does not attach the migration task's cancellation context.Published Oct 14, 2026
- CVE-2026-60018Medium 6.5Gitea's OneDev migration downloader reads the entire remote version response into memory without a size limit and uses a client without a timeout.Published Oct 14, 2026
- CVE-2026-60010Medium 6.5Gitea's repository-side team-link API allows a repository administrator who is not an organization owner to attach organization teams to a repository despite RepoAdminChangeTeamAccess being disabled.Published Oct 14, 2026
- CVE-2026-25946Medium 5.3When OpenID sign-in is enabled, Gitea accepts a user-supplied OpenID URL and performs discovery requests without validating the destination against internal network addresses.Published Oct 14, 2026
- CVE-2026-110626Medium 5.1ClipBucket v5 through 5.5.3-#206 contains a reflected cross-site scripting vulnerability in admin_area/language_settings.php via the unencoded edit_language GET parameter.Published Oct 14, 2026
- CVE-2026-110625Medium 5.1ClipBucket v5 through 5.5.3-#206 contains a reflected cross-site scripting vulnerability in admin_area/flagged_item.php via the unencoded type GET parameter.Published Oct 14, 2026
- CVE-2026-110620Medium 6.1Formbricks before 4.9.0 contains an authorization bypass vulnerability in server actions like resetSurveyAction and updateSegmentAction that fail to verify resource ownership against the supplied organizationId.Published Oct 14, 2026
- CVE-2026-110619Medium 6.3frp 0.41.0 through 0.71.1 contains a missing authentication vulnerability that allows unauthenticated remote attackers to access pprof debug endpoints because handlers are registered on the root mux outside Basic Authentication.Published Oct 14, 2026
- CVE-2026-110617Medium 6.3we-mp-rss through 1.5.3 contains a missing authorization vulnerability in the /api/v1/wx/tools/export/download endpoint that allows unauthenticated attackers to download export archives because its authentication dependency is commented…Published Oct 14, 2026
| CVE | Title | Severity | Published |
|---|---|---|---|
| CVE-2026-91883 | Dell Terraform Provider for OME, versions 1.0.0 through 1.2.3, contains an Insertion of Sensitive Information into Log File vulnerability in the provider configuration component. | Medium 4.3 | |
| CVE-2026-89069 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Transfer (Ad Hoc module). | Medium 5.4 | |
| CVE-2026-86561 | Memory size is not adequately validated before mmap during vhost memory-region setup, which can lead to a host crash or memory corruption. | Medium 6.5 | |
| CVE-2026-76113 | Dell Terraform Provider for Redfish, versions 1.1.0 through 1.6.1, contains an Exposure of Sensitive Information to an Unauthorized Actor vulnerability in the redfish_certificate resource component. | Medium 4.3 | |
| CVE-2026-62858 | Prior to 1.10.5, yourls_get_request() extracted the request path without sanitization, after which yourls_sanitize_url() and yourls_esc_url() preserved dot and slash… | Medium 5.3 | |
| CVE-2026-110719 | Portkey AI Gateway 1.14.0 through 1.15.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to reach loopback and Docker host services because isValidCustomHost trusts localhost-style hosts when… | Medium 6.9 | |
| CVE-2026-110717 | Janus WebRTC Server through 1.4.3 contains a path traversal vulnerability in the Record&Play plugin that allows unauthenticated attackers to write files outside recordings_path via the record request filename. | Medium 6.9 | |
| CVE-2026-110716 | unshield through 1.6.2 contains a heap out-of-bounds read vulnerability in unshield_get_file_table() that allows attackers to read past heap allocations via unchecked cabinet header offsets. | Medium 6.8 | |
| CVE-2026-110715 | MuJS 1.3.6 before 1.3.9 contains a heap out-of-bounds read and write vulnerability in Array.prototype.sort that allows attackers to corrupt memory by inflating a simple array's length. | Medium 6.9 | |
| CVE-2026-110661 | CGNS through 4.5.2 contains a stack out-of-bounds read vulnerability in ADFI_read_node_header that allows attackers to crash applications by supplying crafted ADF node headers. | Medium 4.8 | |
| CVE-2026-110660 | vgmstream through r2117 contains a stack out-of-bounds read vulnerability in the G.722.1/Siren14 decoder in g7221_lib.c, whose bit reader refills without checking the data_u32 array end. | Medium 4.8 | |
| CVE-2026-110659 | ELFIO through 3.12 contains a NULL pointer dereference vulnerability in relocation_section_accessor get_entry() that allows attackers to crash applications via an unvalidated sh_link index. | Medium 6.8 | |
| CVE-2026-110658 | Sofia-SIP through 1.13.18 contains a heap out-of-bounds read vulnerability in msg_multipart_parse() that allows unauthenticated remote attackers to crash the process by sending oversized MIME boundaries. | Medium 6.9 | |
| CVE-2026-110657 | Khronos NNEF-Tools nnef through 1.0.10 and nnef-tools through 1.0.11 contain a path traversal vulnerability that allows attackers to write files outside the model directory via crafted variable labels. | Medium 4.8 | |
| CVE-2026-110654 | libzvbi through 0.2.45 contains an out-of-bounds write vulnerability in the Teletext decoder that allows attackers to corrupt memory by supplying unvalidated DRCS pixel-mode values in X/28/3 packets. | Medium 6.9 | |
| CVE-2026-109438 | 3proxy from 0.9.7 through 1.0.1, fixed in commit 206c923, contains an uninitialized stack memory disclosure vulnerability that allows unauthenticated attackers to leak stack bytes via the SOCKS4 reply path when the external-NAT option… | Medium 6.3 | |
| CVE-2026-100404 | In Zulip Server versions through 12.1, guest users can receive new message events for public channels outside their subscriptions. | Medium 6.5 | |
| CVE-2026-100394 | From 2.2.7 until 2.2.11, ServiceSentinel.worker in service/singleton/servicesentinel.go checked an owned service under servicesLock and later… | Medium 6.5 | |
| CVE-2026-95101 | Description NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. | Medium 6.9 | |
| CVE-2026-78433 | Gitea's web attachment handler skips its cross-repository ownership check for attachments created before 16 January 2026 and checks permissions against the repository named in the request URL instead. | Medium 5.9 | |
| CVE-2026-78231 | When OpenID sign-in is enabled, Gitea processes unauthenticated assertion parameters and sends an HTTP POST request to the caller-supplied OpenID provider endpoint during verification. | Medium 5.3 | |
| CVE-2026-73814 | Gitea's collaboration access-mode endpoint accepts the Owner access mode from an authenticated repository collaborator with Admin access. | Medium 6.5 | |
| CVE-2026-73273 | Gitea's Maven upload handler reads checksum uploads entirely into memory and returns before enforcing package-size quotas. | Medium 4.3 | |
| CVE-2026-73135 | Gitea uses inconsistent repository visibility predicates, and the condition used by some repository-listing endpoints admits repositories whose owners are hidden from the viewer. | Medium 5.3 | |
| CVE-2026-73130 | Gitea does not limit the length of the gitignores field accepted by repository-creation forms and the API. | Medium 4.3 | |
| CVE-2026-73126 | Gitea's Actions workflow status badge endpoint does not enforce repository-read scope or the public-only restriction on the token authenticating the request. | Medium 4.3 | |
| CVE-2026-71301 | Gitea's repository markup endpoint resolves same-repository pull request references without enforcing the viewer's Pull Requests permission. | Medium 4.3 | |
| CVE-2026-70407 | Gitea's organization-list API does not enforce the read:organization token scope. | Medium 4.3 | |
| CVE-2026-70406 | Gitea's shared comparison helper omits the token repository-access check used when updating pull requests. | Medium 6.5 | |
| CVE-2026-70402 | Gitea creates server-side Git hook directories and scripts with mode 0777 and relies on the process umask to restrict access. | Medium 5.8 | |
| CVE-2026-70400 | Gitea's repository migration API accepts a public-only token when the request specifies creation of a private repository. | Medium 5.4 | |
| CVE-2026-70396 | Gitea's organization repository-creation API requires write:organization but omits the write:repository token scope enforced by other repository-creation routes. | Medium 5.4 | |
| CVE-2026-68964 | Gitea's user SSH and GPG key-list API endpoints omit the profile visibility check applied by their web equivalents. | Medium 4.3 | |
| CVE-2026-68957 | Gitea's API and web issue-search paths do not treat restricted accounts as anonymous viewers when evaluating Limited-visibility repository owners. | Medium 4.3 | |
| CVE-2026-67577 | Gitea's activity-feed and contribution-heatmap API handlers do not apply the profile visibility check for restricted accounts viewing Limited-visibility users. | Medium 4.3 | |
| CVE-2026-66874 | For pull request events, Gitea reads workflow definitions from the pull request head and posts a synthetic skipped status when workflow branch or path filters exclude execution. | Medium 6.5 | |
| CVE-2026-66853 | Gitea's user organization-list API includes Limited-visibility organizations for authenticated restricted accounts without applying the visibility restriction enforced by the single-organization endpoint. | Medium 4.3 | |
| CVE-2026-66849 | Gitea's package registry grants authenticated users read access to packages owned by Limited-visibility users without excluding restricted accounts. | Medium 4.3 | |
| CVE-2026-63792 | Gitea's collaborative-owner authorization path for reading cross-repository reusable workflows does not exclude fork pull request runs. | Medium 5.3 | |
| CVE-2026-63021 | Gitea's Swift package parser limits each manifest to 128 KiB but does not limit the number of manifests or their aggregate size before reading them into memory. | Medium 6.5 | |
| CVE-2026-62925 | Gitea parses Alpine package uploads before enforcing package-size quotas and does not bound the decompressed .PKGINFO data or its dependency and provides entry counts. | Medium 6.5 | |
| CVE-2026-60021 | Gitea's initial GitLab migration version probe uses an HTTP client without a timeout and does not attach the migration task's cancellation context. | Medium 6.5 | |
| CVE-2026-60018 | Gitea's OneDev migration downloader reads the entire remote version response into memory without a size limit and uses a client without a timeout. | Medium 6.5 | |
| CVE-2026-60010 | Gitea's repository-side team-link API allows a repository administrator who is not an organization owner to attach organization teams to a repository despite RepoAdminChangeTeamAccess being disabled. | Medium 6.5 | |
| CVE-2026-25946 | When OpenID sign-in is enabled, Gitea accepts a user-supplied OpenID URL and performs discovery requests without validating the destination against internal network addresses. | Medium 5.3 | |
| CVE-2026-110626 | ClipBucket v5 through 5.5.3-#206 contains a reflected cross-site scripting vulnerability in admin_area/language_settings.php via the unencoded edit_language GET parameter. | Medium 5.1 | |
| CVE-2026-110625 | ClipBucket v5 through 5.5.3-#206 contains a reflected cross-site scripting vulnerability in admin_area/flagged_item.php via the unencoded type GET parameter. | Medium 5.1 | |
| CVE-2026-110620 | Formbricks before 4.9.0 contains an authorization bypass vulnerability in server actions like resetSurveyAction and updateSegmentAction that fail to verify resource ownership against the supplied organizationId. | Medium 6.1 | |
| CVE-2026-110619 | frp 0.41.0 through 0.71.1 contains a missing authentication vulnerability that allows unauthenticated remote attackers to access pprof debug endpoints because handlers are registered on the root mux outside Basic Authentication. | Medium 6.3 | |
| CVE-2026-110617 | we-mp-rss through 1.5.3 contains a missing authorization vulnerability in the /api/v1/wx/tools/export/download endpoint that allows unauthenticated attackers to download export archives because its authentication dependency is commented… | Medium 6.3 |
Showing 901–950 of 138,429. Narrow the filters to see the rest.
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status. Filter by severity and year here; the other filters work on the curated lists.