Vulnerability Intelligence · All CVEs
Every Published CVE, Searchable.
Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status.
Synced hourly · figures as of Oct 19, 2026
391,979 vulnerabilities · newest first
- CVE-2026-111829Medium 6.5Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WP Mailster WP Mailster wp-mailster allows PHP Local File Inclusion.This issue affects WP Mailster: from n/a through 1.Published Oct 19, 2026
- CVE-2026-111828Medium 4.3Improper Validation of Specified Quantity in Input vulnerability in Mamunur Rashid Classified Listing classified-listing allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Classified Listing: from n/a…Published Oct 19, 2026
- CVE-2026-110902Medium 4.3Authorization Bypass Through User-Controlled Key vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a…Published Oct 19, 2026
- CVE-2026-110008Medium 4.2In versions 7.2.0 through 8.3.1, the state and code-verifier cookies are set without a Path attribute at a login route with two or more path segments, while the clearing step at…Published Oct 19, 2026
- CVE-2026-38671UnscoredCross Site Scripting vulnerability in Ellucian Banner Student Registration Self-Service (StudentRegistrationSsb) 9.23 and prior (no fixed version available) allows a remote attacker to execute arbitrary code via the mepCode parameter of…Published Oct 19, 2026
- CVE-2026-112214Medium 6.5When parsing a Simple Index object, an attacker-controlled entry count is used to size a heap allocation without being limited to the payload available in the object.Published Oct 19, 2026
- CVE-2026-112199Medium 6.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITH YITH WooCommerce Wishlist yith-woocommerce-wishlist allows Stored XSS.This issue affects YITH WooCommerce Wishlist: from n/a…Published Oct 19, 2026
- CVE-2026-112142Medium 5.5Affected by this vulnerability is an unknown functionality of the file dodelete.php of the component…Published Oct 19, 2026
- CVE-2026-112141Medium 5.5A vulnerability was determined in satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f46f7871b83f425383a.Published Oct 19, 2026
- CVE-2026-111845Medium 5.3Missing Authorization vulnerability in YITH YITH WooCommerce Product Bundles yith-woocommerce-product-bundles allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH WooCommerce Product Bundles:…Published Oct 19, 2026
- CVE-2026-111839Medium 5.3Missing Authorization vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Broadcast Live Video: from n/a…Published Oct 19, 2026
- CVE-2026-111836Medium 4.3Missing Authorization vulnerability in WP ManageNinja LLC FluentCommunity fluent-community allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FluentCommunity: from n/a through 2.11.0.Published Oct 19, 2026
- CVE-2026-111831Medium 5.3Missing Authorization vulnerability in WP ManageNinja LLC FluentForm fluentform allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FluentForm: from n/a through 6.2.15.Published Oct 19, 2026
- CVE-2026-111414Medium 6.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through…Published Oct 19, 2026
- CVE-2026-111410Medium 6.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in E2Pdf.com e2pdf e2pdf allows Stored XSS.This issue affects e2pdf: from n/a through 1.32.57.Published Oct 19, 2026
- CVE-2026-110363Medium 5.4Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnPress: from n/a through 4.4.10.Published Oct 19, 2026
- CVE-2026-103314High 7.4The Central SAML authentication ACS endpoint does not retain used SAML assertion or response identifiers to prevent replay.Published Oct 19, 2026
- CVE-2026-88900High 8.8Deserialization of Untrusted Data vulnerability in Apache Camel Camel-Jgroups component.Published Oct 19, 2026
- CVE-2026-112210Medium 6.0The service runs as root and operates on a file inside a directory owned by an unprivileged system user without verifying that the file is not a symbolic…Published Oct 19, 2026
- CVE-2026-112140Low 2.1This impacts the function _get_lib_module of the file python/mlc_chat/chat_module.py.Published Oct 19, 2026
- CVE-2026-112139Medium 5.5TPublished Oct 19, 2026
- CVE-2026-112138Low 2.0Executing a manipulation can…Published Oct 19, 2026
- CVE-2026-112108Low 2.1A vulnerability was determined in ztxz16 fastllm up to 0.1.8.2.Published Oct 19, 2026
- CVE-2026-112107Low 2.1Affected by this issue is the function SafeTensorItem::CreateBuffer of the file src/model.cpp of the component Safetensors Weight Loading.Published Oct 19, 2026
- CVE-2026-91858Medium 6.5FopProducer transforms the incoming XSL-FO message body by creating a javax.xml.transform.TransformerFactory through TransformerFactory.newInstance() and enabling only FEATURE_SECURE_PROCESSING before running an identity transform over…Published Oct 19, 2026
- CVE-2026-88901High 8.2Improper Restriction of XML External Entity Reference vulnerability in Apache Camel.Published Oct 19, 2026
- CVE-2026-85317Medium 4.8Use of Cache Containing Sensitive Information vulnerability in Apache Camel HTTP component.Published Oct 19, 2026
- CVE-2026-85316Medium 4.8Insufficient Granularity of Access Control vulnerability in Apache Camel Platform HTTP component.Published Oct 19, 2026
- CVE-2026-85315Medium 5.3Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel gRPC component.Published Oct 19, 2026
- CVE-2026-85314Medium 6.5Improper Input Validation vulnerability in Apache Camel Mail component.Published Oct 19, 2026
- CVE-2026-85313Medium 4.3Permissive Cross-domain Policy with Untrusted Domains vulnerability in Apache Camel Jetty component.Published Oct 19, 2026
- CVE-2026-85312Medium 4.8Improper Input Validation vulnerability in Apache Camel Core component.Published Oct 19, 2026
- CVE-2026-85301Medium 4.8Improper Authentication vulnerability in Apache Camel Keycloak component.Published Oct 19, 2026
- CVE-2026-85300Medium 5.5Incorrect Default Permissions vulnerability in Apache Camel PQC component.Published Oct 19, 2026
- CVE-2026-85296Medium 6.5Exposure of Data Element to Wrong Session vulnerability in Apache Camel AS2 component.Published Oct 19, 2026
- CVE-2026-85260Medium 5.5Insertion of Sensitive Information into Log File vulnerability in Apache Camel MLLP component.Published Oct 19, 2026
- CVE-2026-85257Medium 5.3Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel CXF component.Published Oct 19, 2026
- CVE-2026-85254Medium 6.5Improper Handling of Case Sensitivity vulnerability in Apache Camel Platform HTTP component.Published Oct 19, 2026
- CVE-2026-85251High 7.5Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel HTTP component.Published Oct 19, 2026
- CVE-2026-85250High 7.5Improper Restriction of XML External Entity Reference vulnerability in Apache Camel XPath component.Published Oct 19, 2026
- CVE-2026-85249Medium 6.5Improper Input Validation vulnerability in Apache Camel Tika component.Published Oct 19, 2026
- CVE-2026-85248Medium 5.9Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Camel PQC component.Published Oct 19, 2026
- CVE-2026-85247Medium 5.9Improper Certificate Validation vulnerability in Apache Camel Knative component.Published Oct 19, 2026
- CVE-2026-85246Medium 5.3Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel Mina component.Published Oct 19, 2026
- CVE-2026-85245Medium 5.9Exposure of Data Element to Wrong Session vulnerability in Apache Camel Thrift component.Published Oct 19, 2026
- CVE-2026-85243Medium 5.9Improper Validation of Integrity Check Value vulnerability in Apache Camel Crypto PGP component.Published Oct 19, 2026
- CVE-2026-84181Medium 5.9Improper Authentication vulnerability in Apache Camel Shiro component.Published Oct 19, 2026
- CVE-2026-84180Medium 5.3Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel Knative component.Published Oct 19, 2026
- CVE-2026-84178Medium 6.1Cross-Site Request Forgery (CSRF) vulnerability in Apache Camel OAuth component.Published Oct 19, 2026
- CVE-2026-84176Medium 6.5Permissive Cross-domain Policy with Untrusted Domains vulnerability in Apache Camel Platform HTTP Vertx component.Published Oct 19, 2026
| CVE | Title | Severity | Published |
|---|---|---|---|
| CVE-2026-111829 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WP Mailster WP Mailster wp-mailster allows PHP Local File Inclusion.This issue affects WP Mailster: from n/a through 1. | Medium 6.5 | |
| CVE-2026-111828 | Improper Validation of Specified Quantity in Input vulnerability in Mamunur Rashid Classified Listing classified-listing allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Classified Listing: from n/a… | Medium 4.3 | |
| CVE-2026-110902 | Authorization Bypass Through User-Controlled Key vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a… | Medium 4.3 | |
| CVE-2026-110008 | In versions 7.2.0 through 8.3.1, the state and code-verifier cookies are set without a Path attribute at a login route with two or more path segments, while the clearing step at… | Medium 4.2 | |
| CVE-2026-38671 | Cross Site Scripting vulnerability in Ellucian Banner Student Registration Self-Service (StudentRegistrationSsb) 9.23 and prior (no fixed version available) allows a remote attacker to execute arbitrary code via the mepCode parameter of… | Unscored | |
| CVE-2026-112214 | When parsing a Simple Index object, an attacker-controlled entry count is used to size a heap allocation without being limited to the payload available in the object. | Medium 6.5 | |
| CVE-2026-112199 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITH YITH WooCommerce Wishlist yith-woocommerce-wishlist allows Stored XSS.This issue affects YITH WooCommerce Wishlist: from n/a… | Medium 6.5 | |
| CVE-2026-112142 | Affected by this vulnerability is an unknown functionality of the file dodelete.php of the component… | Medium 5.5 | |
| CVE-2026-112141 | A vulnerability was determined in satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f46f7871b83f425383a. | Medium 5.5 | |
| CVE-2026-111845 | Missing Authorization vulnerability in YITH YITH WooCommerce Product Bundles yith-woocommerce-product-bundles allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH WooCommerce Product Bundles:… | Medium 5.3 | |
| CVE-2026-111839 | Missing Authorization vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Broadcast Live Video: from n/a… | Medium 5.3 | |
| CVE-2026-111836 | Missing Authorization vulnerability in WP ManageNinja LLC FluentCommunity fluent-community allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FluentCommunity: from n/a through 2.11.0. | Medium 4.3 | |
| CVE-2026-111831 | Missing Authorization vulnerability in WP ManageNinja LLC FluentForm fluentform allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FluentForm: from n/a through 6.2.15. | Medium 5.3 | |
| CVE-2026-111414 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through… | Medium 6.5 | |
| CVE-2026-111410 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in E2Pdf.com e2pdf e2pdf allows Stored XSS.This issue affects e2pdf: from n/a through 1.32.57. | Medium 6.5 | |
| CVE-2026-110363 | Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnPress: from n/a through 4.4.10. | Medium 5.4 | |
| CVE-2026-103314 | The Central SAML authentication ACS endpoint does not retain used SAML assertion or response identifiers to prevent replay. | High 7.4 | |
| CVE-2026-88900 | Deserialization of Untrusted Data vulnerability in Apache Camel Camel-Jgroups component. | High 8.8 | |
| CVE-2026-112210 | The service runs as root and operates on a file inside a directory owned by an unprivileged system user without verifying that the file is not a symbolic… | Medium 6.0 | |
| CVE-2026-112140 | This impacts the function _get_lib_module of the file python/mlc_chat/chat_module.py. | Low 2.1 | |
| CVE-2026-112139 | T | Medium 5.5 | |
| CVE-2026-112138 | Executing a manipulation can… | Low 2.0 | |
| CVE-2026-112108 | A vulnerability was determined in ztxz16 fastllm up to 0.1.8.2. | Low 2.1 | |
| CVE-2026-112107 | Affected by this issue is the function SafeTensorItem::CreateBuffer of the file src/model.cpp of the component Safetensors Weight Loading. | Low 2.1 | |
| CVE-2026-91858 | FopProducer transforms the incoming XSL-FO message body by creating a javax.xml.transform.TransformerFactory through TransformerFactory.newInstance() and enabling only FEATURE_SECURE_PROCESSING before running an identity transform over… | Medium 6.5 | |
| CVE-2026-88901 | Improper Restriction of XML External Entity Reference vulnerability in Apache Camel. | High 8.2 | |
| CVE-2026-85317 | Use of Cache Containing Sensitive Information vulnerability in Apache Camel HTTP component. | Medium 4.8 | |
| CVE-2026-85316 | Insufficient Granularity of Access Control vulnerability in Apache Camel Platform HTTP component. | Medium 4.8 | |
| CVE-2026-85315 | Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel gRPC component. | Medium 5.3 | |
| CVE-2026-85314 | Improper Input Validation vulnerability in Apache Camel Mail component. | Medium 6.5 | |
| CVE-2026-85313 | Permissive Cross-domain Policy with Untrusted Domains vulnerability in Apache Camel Jetty component. | Medium 4.3 | |
| CVE-2026-85312 | Improper Input Validation vulnerability in Apache Camel Core component. | Medium 4.8 | |
| CVE-2026-85301 | Improper Authentication vulnerability in Apache Camel Keycloak component. | Medium 4.8 | |
| CVE-2026-85300 | Incorrect Default Permissions vulnerability in Apache Camel PQC component. | Medium 5.5 | |
| CVE-2026-85296 | Exposure of Data Element to Wrong Session vulnerability in Apache Camel AS2 component. | Medium 6.5 | |
| CVE-2026-85260 | Insertion of Sensitive Information into Log File vulnerability in Apache Camel MLLP component. | Medium 5.5 | |
| CVE-2026-85257 | Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel CXF component. | Medium 5.3 | |
| CVE-2026-85254 | Improper Handling of Case Sensitivity vulnerability in Apache Camel Platform HTTP component. | Medium 6.5 | |
| CVE-2026-85251 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel HTTP component. | High 7.5 | |
| CVE-2026-85250 | Improper Restriction of XML External Entity Reference vulnerability in Apache Camel XPath component. | High 7.5 | |
| CVE-2026-85249 | Improper Input Validation vulnerability in Apache Camel Tika component. | Medium 6.5 | |
| CVE-2026-85248 | Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Camel PQC component. | Medium 5.9 | |
| CVE-2026-85247 | Improper Certificate Validation vulnerability in Apache Camel Knative component. | Medium 5.9 | |
| CVE-2026-85246 | Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel Mina component. | Medium 5.3 | |
| CVE-2026-85245 | Exposure of Data Element to Wrong Session vulnerability in Apache Camel Thrift component. | Medium 5.9 | |
| CVE-2026-85243 | Improper Validation of Integrity Check Value vulnerability in Apache Camel Crypto PGP component. | Medium 5.9 | |
| CVE-2026-84181 | Improper Authentication vulnerability in Apache Camel Shiro component. | Medium 5.9 | |
| CVE-2026-84180 | Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel Knative component. | Medium 5.3 | |
| CVE-2026-84178 | Cross-Site Request Forgery (CSRF) vulnerability in Apache Camel OAuth component. | Medium 6.1 | |
| CVE-2026-84176 | Permissive Cross-domain Policy with Untrusted Domains vulnerability in Apache Camel Platform HTTP Vertx component. | Medium 6.5 |
Showing 51–100 of 391,979. Narrow the filters to see the rest.
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status. Filter by severity and year here; the other filters work on the curated lists.