Vulnerability Intelligence · All CVEs
Every Published CVE, Searchable.
Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status.
Synced hourly · figures as of Oct 19, 2026
40,398 vulnerabilities · newest first
- CVE-2026-104730Critical 9.8Sunshine Photo Cart <= 3.7.4 - Unauthenticated PHP Object Injection via 'key' ParameterPublished Oct 16, 2026
- CVE-2026-103768Critical 9.8ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.7 - Unauthenticated Arbitrary File Upload via IMAP Email AttachmentPublished Oct 16, 2026
- CVE-2026-89079Critical 9.8Theme My Login <= 7.2.1 - Unauthenticated Privilege Escalation via 'user_pass1' POST Parameter in wp_pre_insert_user_data FilterPublished Oct 16, 2026
- CVE-2026-104798Critical 9.8My Calendar <= 3.8.7 - Unauthenticated Privilege Escalation to 'mcs' Parameter via Reflected Shortcode Injection into 'above' AttributePublished Oct 16, 2026
- CVE-2026-109515Critical 9.8MailOptin <= 1.2.78.6 - Unauthenticated Privilege Escalation to 'form_custom_field_mappings' ParameterPublished Oct 16, 2026
- CVE-2026-109219Critical 9.8Mang Board <= 2.4.4 - Unauthenticated Arbitrary File Upload via 'image_path' ParameterPublished Oct 16, 2026
- CVE-2026-111444Critical 9.8Wheels through 4.1.2 allows SQL injection on MySQL/MariaDB with backslash escaping enabled (NO_BACKSLASH_ESCAPES absent) when an application supplies request data to inline-literal paths.Published Oct 16, 2026
- CVE-2026-94134Critical 9.1The Apache Airflow SSH provider hook disables SSH host-key verification by default: unless host_key is configured or no_host_key_check is explicitly set to false, it accepts any server key.Published Oct 15, 2026
- CVE-2026-110916Critical 9.6Improper input validation in Desktop in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page.Published Oct 15, 2026
- CVE-2026-111356Critical 9.1MacCMS v10 through 2026.1000.4056 Account Takeover via Password Recovery Brute-ForcePublished Oct 15, 2026
- CVE-2026-111329Critical 9.3JuggleIM im-server through 1.8.16 Default Admin Credentials in Admin ConsolePublished Oct 15, 2026
- CVE-2026-111322Critical 9.3Archon 0.2.13 through 0.11.1 Missing Authentication via /api/* Control APIPublished Oct 15, 2026
- CVE-2026-111312Critical 9.2OpenHealth through 0.2.0 Missing Authentication via /api/health-data/[id] RoutePublished Oct 15, 2026
- CVE-2026-111283Critical 9.5BMC Helix Network Management before 26.3.01 Authentication Bypass via SAML ConfigurationPublished Oct 15, 2026
- CVE-2026-111281Critical 9.3Jooan JA-A12 Unauthenticated Root RCE via SetDiagMode Hard-Coded CredentialsPublished Oct 15, 2026
- CVE-2026-105039Critical 9.6EnergizeLab Station Middleware Admin APIs Missing Role ChecksPublished Oct 15, 2026
- CVE-2026-105038Critical 9.8EnergizeLab Eilik Unauthenticated AI Model Administration and Runtime Model SwitchingPublished Oct 15, 2026
- CVE-2026-105037Critical 9.9EnergizeLab Station Middleware Authenticated Path Traversal Arbitrary File ReadPublished Oct 15, 2026
- CVE-2026-105032Critical 9.1EnergizeLab Eilik AI Skill Upload Unauthenticated Path Traversal Arbitrary File WritePublished Oct 15, 2026
- CVE-2026-102764Critical 9.3Improper Origin Validation in Internal Messaging Components of BeyondTrust Remote SupportBeyondTrust · Remote SupportPublished Oct 15, 2026
- CVE-2026-55240Critical 9.1Prior to 1.31.29, formatString() in src/server/utils/template.ts passes survey feedTemplate and monitor notification templates to lodash template(), while…Published Oct 15, 2026
- CVE-2026-47218Critical 9.3runwasi facilitates running Wasm and WASI workloads managed by containerd.Published Oct 15, 2026
- CVE-2026-111235Critical 9.1OpenNMS REST authorization bypass via non-canonical HTTP methodPublished Oct 15, 2026
- CVE-2026-102946Critical 9.1joserfc: JWS signature verification bypass via empty signatures array in jws.deserialize_jsonPublished Oct 15, 2026
- CVE-2026-84731Critical 9.3An unauthenticated remote attacker can bypass authentication and gain full access to administrative API endpoints in Nutanix Prism Element by including a crafted internal management HTTP header.Published Oct 15, 2026
- CVE-2026-110812Critical 9.4Deserialization of untrusted data in the Gremlin graph-import path in Amazon NeptunePublished Oct 15, 2026
- CVE-2026-110958Critical 10.0Wavlink WN530HG4B api.cgi heap-based overflowPublished Oct 15, 2026
- CVE-2026-111094Critical 9.8In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 remote code execution via a whitelist bypass in the build messages protocol was possiblePublished Oct 15, 2026
- CVE-2026-105474Critical 9.4A server-side template injection exists in SolusVM 2 up to version 2.0.0-44576 that allows remote authenticated users to execute arbitrary code as root.Published Oct 15, 2026
- CVE-2026-57155Critical 9.9OPNsense: Root RCE via Arbitrary File Write in GeoIP Alias ImporterPublished Oct 15, 2026
- CVE-2026-110957Critical 10.0Wavlink WL-WN530BE2-A Login Processing api.cgi sub_12580 os command injectionPublished Oct 15, 2026
- CVE-2026-47168Critical 9.1EspoCRM: Authenticated RCE via Unsafe PHP Object Deserialization in MassAction/Export paramsPublished Oct 15, 2026
- CVE-2026-109686Critical 9.8WordPress Link Whisper Free plugin <= 0.9.7 - PHP Object Injection vulnerabilityPublished Oct 15, 2026
- CVE-2026-109892Critical 9.8WordPress Frontend Admin by DynamiApps plugin <= 3.29.13 - Privilege Escalation vulnerabilityPublished Oct 15, 2026
- CVE-2026-109688Critical 9.3WordPress Link Whisper Free plugin <= 0.9.7 - SQL Injection vulnerabilityPublished Oct 15, 2026
- CVE-2026-109698Critical 9.3WordPress Mang Board WP plugin <= 2.4.4 - SQL Injection vulnerabilityPublished Oct 15, 2026
- CVE-2026-109694Critical 9.8Incorrect Privilege Assignment vulnerability in WP ManageNinja LLC Fluent CRM fluent-crm allows Privilege Escalation.This issue affects Fluent CRM: from n/a through 3.2.5.Published Oct 15, 2026
- CVE-2026-108497Critical 9.3Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TMS Amelia ameliabooking allows SQL Injection.This issue affects Amelia: from n/a through 2.4.10.Published Oct 15, 2026
- CVE-2026-50619Critical 9.3A path traversal vulnerability has been reported to affect Qsirch.Published Oct 15, 2026
- CVE-2026-50612Critical 9.4An unix symbolic link (symlink) following vulnerability has been reported to affect QuMagie.Published Oct 15, 2026
- CVE-2026-47786Critical 9.3An OS command injection vulnerability has been reported to affect HybridDesk Station.Published Oct 15, 2026
- CVE-2026-19863Critical 9.3An unauthenticated client may access certain protected resources when using EthereumAuthenticator if the request path contains the configured login path.Published Oct 15, 2026
- CVE-2026-34006Critical 9.3Pre-Authentication Multiple Critical Vulnerabilities in QNAP sMedioDTCPServerPublished Oct 15, 2026
- CVE-2026-101287Critical 9.3Authentication bypass in Stela by Diaple NetworkingPublished Oct 15, 2026
- CVE-2026-16438Critical 9.4An arbitrary operation vulnerability in GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, and MC Works64Published Oct 15, 2026
- CVE-2026-16436Critical 9.2An authentication bypass vulnerability in GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizVizPublished Oct 15, 2026
- CVE-2026-102469Critical 9.2In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x DB2 client (vertx-db2-client) contains DRDA protocol handling code that deserializes User Defined Type (UDT) column data using a…Published Oct 15, 2026
- CVE-2026-101306Critical 9.8Multiple jail filesystem root escapesPublished Oct 15, 2026
- CVE-2026-109145Critical 9.8User Rights Access Manager <= 1.1.3 - Unauthenticated Privilege Escalation via AJAX Registration HandlerPublished Oct 15, 2026
- CVE-2026-108587Critical 9.8The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.34.10 via the compressCustom function.Published Oct 15, 2026
| CVE | Title | Severity | Published |
|---|---|---|---|
| CVE-2026-104730 | Sunshine Photo Cart <= 3.7.4 - Unauthenticated PHP Object Injection via 'key' Parameter | Critical 9.8 | |
| CVE-2026-103768 | ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.7 - Unauthenticated Arbitrary File Upload via IMAP Email Attachment | Critical 9.8 | |
| CVE-2026-89079 | Theme My Login <= 7.2.1 - Unauthenticated Privilege Escalation via 'user_pass1' POST Parameter in wp_pre_insert_user_data Filter | Critical 9.8 | |
| CVE-2026-104798 | My Calendar <= 3.8.7 - Unauthenticated Privilege Escalation to 'mcs' Parameter via Reflected Shortcode Injection into 'above' Attribute | Critical 9.8 | |
| CVE-2026-109515 | MailOptin <= 1.2.78.6 - Unauthenticated Privilege Escalation to 'form_custom_field_mappings' Parameter | Critical 9.8 | |
| CVE-2026-109219 | Mang Board <= 2.4.4 - Unauthenticated Arbitrary File Upload via 'image_path' Parameter | Critical 9.8 | |
| CVE-2026-111444 | Wheels through 4.1.2 allows SQL injection on MySQL/MariaDB with backslash escaping enabled (NO_BACKSLASH_ESCAPES absent) when an application supplies request data to inline-literal paths. | Critical 9.8 | |
| CVE-2026-94134 | The Apache Airflow SSH provider hook disables SSH host-key verification by default: unless host_key is configured or no_host_key_check is explicitly set to false, it accepts any server key. | Critical 9.1 | |
| CVE-2026-110916 | Improper input validation in Desktop in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. | Critical 9.6 | |
| CVE-2026-111356 | MacCMS v10 through 2026.1000.4056 Account Takeover via Password Recovery Brute-Force | Critical 9.1 | |
| CVE-2026-111329 | JuggleIM im-server through 1.8.16 Default Admin Credentials in Admin Console | Critical 9.3 | |
| CVE-2026-111322 | Archon 0.2.13 through 0.11.1 Missing Authentication via /api/* Control API | Critical 9.3 | |
| CVE-2026-111312 | OpenHealth through 0.2.0 Missing Authentication via /api/health-data/[id] Route | Critical 9.2 | |
| CVE-2026-111283 | BMC Helix Network Management before 26.3.01 Authentication Bypass via SAML Configuration | Critical 9.5 | |
| CVE-2026-111281 | Jooan JA-A12 Unauthenticated Root RCE via SetDiagMode Hard-Coded Credentials | Critical 9.3 | |
| CVE-2026-105039 | EnergizeLab Station Middleware Admin APIs Missing Role Checks | Critical 9.6 | |
| CVE-2026-105038 | EnergizeLab Eilik Unauthenticated AI Model Administration and Runtime Model Switching | Critical 9.8 | |
| CVE-2026-105037 | EnergizeLab Station Middleware Authenticated Path Traversal Arbitrary File Read | Critical 9.9 | |
| CVE-2026-105032 | EnergizeLab Eilik AI Skill Upload Unauthenticated Path Traversal Arbitrary File Write | Critical 9.1 | |
| CVE-2026-102764 | Improper Origin Validation in Internal Messaging Components of BeyondTrust Remote Support BeyondTrust · Remote Support | Critical 9.3 | |
| CVE-2026-55240 | Prior to 1.31.29, formatString() in src/server/utils/template.ts passes survey feedTemplate and monitor notification templates to lodash template(), while… | Critical 9.1 | |
| CVE-2026-47218 | runwasi facilitates running Wasm and WASI workloads managed by containerd. | Critical 9.3 | |
| CVE-2026-111235 | OpenNMS REST authorization bypass via non-canonical HTTP method | Critical 9.1 | |
| CVE-2026-102946 | joserfc: JWS signature verification bypass via empty signatures array in jws.deserialize_json | Critical 9.1 | |
| CVE-2026-84731 | An unauthenticated remote attacker can bypass authentication and gain full access to administrative API endpoints in Nutanix Prism Element by including a crafted internal management HTTP header. | Critical 9.3 | |
| CVE-2026-110812 | Deserialization of untrusted data in the Gremlin graph-import path in Amazon Neptune | Critical 9.4 | |
| CVE-2026-110958 | Wavlink WN530HG4B api.cgi heap-based overflow | Critical 10.0 | |
| CVE-2026-111094 | In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 remote code execution via a whitelist bypass in the build messages protocol was possible | Critical 9.8 | |
| CVE-2026-105474 | A server-side template injection exists in SolusVM 2 up to version 2.0.0-44576 that allows remote authenticated users to execute arbitrary code as root. | Critical 9.4 | |
| CVE-2026-57155 | OPNsense: Root RCE via Arbitrary File Write in GeoIP Alias Importer | Critical 9.9 | |
| CVE-2026-110957 | Wavlink WL-WN530BE2-A Login Processing api.cgi sub_12580 os command injection | Critical 10.0 | |
| CVE-2026-47168 | EspoCRM: Authenticated RCE via Unsafe PHP Object Deserialization in MassAction/Export params | Critical 9.1 | |
| CVE-2026-109686 | WordPress Link Whisper Free plugin <= 0.9.7 - PHP Object Injection vulnerability | Critical 9.8 | |
| CVE-2026-109892 | WordPress Frontend Admin by DynamiApps plugin <= 3.29.13 - Privilege Escalation vulnerability | Critical 9.8 | |
| CVE-2026-109688 | WordPress Link Whisper Free plugin <= 0.9.7 - SQL Injection vulnerability | Critical 9.3 | |
| CVE-2026-109698 | WordPress Mang Board WP plugin <= 2.4.4 - SQL Injection vulnerability | Critical 9.3 | |
| CVE-2026-109694 | Incorrect Privilege Assignment vulnerability in WP ManageNinja LLC Fluent CRM fluent-crm allows Privilege Escalation.This issue affects Fluent CRM: from n/a through 3.2.5. | Critical 9.8 | |
| CVE-2026-108497 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TMS Amelia ameliabooking allows SQL Injection.This issue affects Amelia: from n/a through 2.4.10. | Critical 9.3 | |
| CVE-2026-50619 | A path traversal vulnerability has been reported to affect Qsirch. | Critical 9.3 | |
| CVE-2026-50612 | An unix symbolic link (symlink) following vulnerability has been reported to affect QuMagie. | Critical 9.4 | |
| CVE-2026-47786 | An OS command injection vulnerability has been reported to affect HybridDesk Station. | Critical 9.3 | |
| CVE-2026-19863 | An unauthenticated client may access certain protected resources when using EthereumAuthenticator if the request path contains the configured login path. | Critical 9.3 | |
| CVE-2026-34006 | Pre-Authentication Multiple Critical Vulnerabilities in QNAP sMedioDTCPServer | Critical 9.3 | |
| CVE-2026-101287 | Authentication bypass in Stela by Diaple Networking | Critical 9.3 | |
| CVE-2026-16438 | An arbitrary operation vulnerability in GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, and MC Works64 | Critical 9.4 | |
| CVE-2026-16436 | An authentication bypass vulnerability in GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz | Critical 9.2 | |
| CVE-2026-102469 | In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x DB2 client (vertx-db2-client) contains DRDA protocol handling code that deserializes User Defined Type (UDT) column data using a… | Critical 9.2 | |
| CVE-2026-101306 | Multiple jail filesystem root escapes | Critical 9.8 | |
| CVE-2026-109145 | User Rights Access Manager <= 1.1.3 - Unauthenticated Privilege Escalation via AJAX Registration Handler | Critical 9.8 | |
| CVE-2026-108587 | The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.34.10 via the compressCustom function. | Critical 9.8 |
Showing 51–100 of 40,398. Narrow the filters to see the rest.
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status. Filter by severity and year here; the other filters work on the curated lists.