Vulnerability Intelligence · All CVEs
Every Published CVE, Searchable.
Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status.
Synced hourly · figures as of Oct 19, 2026
138,360 vulnerabilities · newest first
- CVE-2026-85315Medium 5.3Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel gRPC component.Published Oct 19, 2026
- CVE-2026-85314Medium 6.5Improper Input Validation vulnerability in Apache Camel Mail component.Published Oct 19, 2026
- CVE-2026-85313Medium 4.3Permissive Cross-domain Policy with Untrusted Domains vulnerability in Apache Camel Jetty component.Published Oct 19, 2026
- CVE-2026-85312Medium 4.8Improper Input Validation vulnerability in Apache Camel Core component.Published Oct 19, 2026
- CVE-2026-85301Medium 4.8Improper Authentication vulnerability in Apache Camel Keycloak component.Published Oct 19, 2026
- CVE-2026-85300Medium 5.5Incorrect Default Permissions vulnerability in Apache Camel PQC component.Published Oct 19, 2026
- CVE-2026-85296Medium 6.5Exposure of Data Element to Wrong Session vulnerability in Apache Camel AS2 component.Published Oct 19, 2026
- CVE-2026-85260Medium 5.5Insertion of Sensitive Information into Log File vulnerability in Apache Camel MLLP component.Published Oct 19, 2026
- CVE-2026-85257Medium 5.3Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel CXF component.Published Oct 19, 2026
- CVE-2026-85254Medium 6.5Improper Handling of Case Sensitivity vulnerability in Apache Camel Platform HTTP component.Published Oct 19, 2026
- CVE-2026-85249Medium 6.5Improper Input Validation vulnerability in Apache Camel Tika component.Published Oct 19, 2026
- CVE-2026-85248Medium 5.9Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Camel PQC component.Published Oct 19, 2026
- CVE-2026-85247Medium 5.9Improper Certificate Validation vulnerability in Apache Camel Knative component.Published Oct 19, 2026
- CVE-2026-85246Medium 5.3Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel Mina component.Published Oct 19, 2026
- CVE-2026-85245Medium 5.9Exposure of Data Element to Wrong Session vulnerability in Apache Camel Thrift component.Published Oct 19, 2026
- CVE-2026-85243Medium 5.9Improper Validation of Integrity Check Value vulnerability in Apache Camel Crypto PGP component.Published Oct 19, 2026
- CVE-2026-84181Medium 5.9Improper Authentication vulnerability in Apache Camel Shiro component.Published Oct 19, 2026
- CVE-2026-84180Medium 5.3Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel Knative component.Published Oct 19, 2026
- CVE-2026-84178Medium 6.1Cross-Site Request Forgery (CSRF) vulnerability in Apache Camel OAuth component.Published Oct 19, 2026
- CVE-2026-84176Medium 6.5Permissive Cross-domain Policy with Untrusted Domains vulnerability in Apache Camel Platform HTTP Vertx component.Published Oct 19, 2026
- CVE-2026-78163Medium 5.9Server-Side Request Forgery (SSRF), Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') and Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel Docling…Published Oct 19, 2026
- CVE-2026-112106Medium 6.3A security vulnerability has been detected in TufayelLUS TikTok-Video-Downloader-PHP up to c4230497bb23dd9c1f81456fe8a982d951feac0d.Published Oct 19, 2026
- CVE-2026-112105Medium 6.3Such manipulation leads to improper certificate validation.Published Oct 19, 2026
- CVE-2026-112104Medium 6.9Executing a manipulation of the argument remoteEnabled can lead…Published Oct 19, 2026
- CVE-2026-112103Medium 6.3Such manipulation leads to improper certificate validation.Published Oct 19, 2026
- CVE-2026-112192Medium 5.3MISP contains a vulnerability in the handling of module plugin settings.Published Oct 19, 2026
- CVE-2026-112184Medium 4.8MISP contains a reflected cross-site scripting (XSS) vulnerability in the workflow module interface.Published Oct 19, 2026
- CVE-2026-112183Medium 4.8MISP contains a CSS injection vulnerability in the remote event preview feature.Published Oct 19, 2026
- CVE-2026-112102Medium 5.3A vulnerability was detected in AXA Group NLP.js 4.27.0.Published Oct 19, 2026
- CVE-2026-112101Medium 5.3A vulnerability was determined in BlackBeltTechnology pi-agent-dashboard up to 0.8.0.Published Oct 19, 2026
- CVE-2026-112100Medium 5.1A vulnerability was determined in DeepPavlov up to 1.7.0.Published Oct 19, 2026
- CVE-2026-111407Medium 6.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Tutor LMS tutor allows Stored XSS.This issue affects Tutor LMS: from n/a through 4.1.2.Published Oct 19, 2026
- CVE-2026-110898Medium 6.4Incorrect Privilege Assignment vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows Privilege Escalation.This issue affects Essential Addons for Elementor: from n/a through 6.8.5.Published Oct 19, 2026
- CVE-2026-112180Medium 5.1MISP contains a data integrity flaw in its event deletion logic.Published Oct 19, 2026
- CVE-2026-112179Medium 5.3In MISP, the event synchronization process contained a logic error in the preparation of event reports for remote push.Published Oct 19, 2026
- CVE-2026-112098Medium 5.3The manipulation results in code injection.Published Oct 19, 2026
- CVE-2026-112097Medium 5.1The manipulation of the…Published Oct 19, 2026
- CVE-2026-112096Medium 5.1The manipulation of…Published Oct 19, 2026
- CVE-2026-112095Medium 5.1Executing a manipulation of the argument…Published Oct 19, 2026
- CVE-2026-111438Medium 6.5在 openGauss-server 的 src/common/backend/libpq/hba.cpp 中，复制连接认证存在访问控制绕过。hba_getauthmethod() 在处理 HADR/SW 复制发送方时，不要求 is_node_internal_connection()，直接调用 check_hba_replication()。check_hba_replication() 仅按 replication 标记做弱匹配，缺少普通 check_hba()…Published Oct 19, 2026
- CVE-2026-104679Medium 6.9VOCALOID6 Editor provided by Yamaha Corporation improperly restricts XML external entity references.Published Oct 19, 2026
- CVE-2026-112094Medium 5.1A security vulnerability has been detected in michaelrsweet mxml 4.0.5/4.0.6.Published Oct 19, 2026
- CVE-2026-112093Medium 5.3The manipulation of the argument msg…Published Oct 19, 2026
- CVE-2026-112092Medium 5.3ExecutiPublished Oct 19, 2026
- CVE-2026-112091Medium 6.9A flaw has been found in Dav-ee dairy-management-system 31ace9692d1e1e6d64339a42c463b361319c615c/f31a584c3330c013b61f8b0306d9e0849c6d693d.Published Oct 19, 2026
- CVE-2026-112090Medium 5.3A vulnerability was detected in Dav-ee dairy-management-system 31ace9692d1e1e6d64339a42c463b361319c615c/f31a584c3330c013b61f8b0306d9e0849c6d693d.Published Oct 19, 2026
- CVE-2026-111439Medium 4.3在 openGauss-server的 src/common/backend/utils/adt/genfile.cpp 模块中，内置函数 pg_read_binary_file_blocks() 存在权限校验逻辑缺陷。该函数在入口处仅校验了起始块号（startBlockNum）和块数量（blockCount）的范围，随后直接调用底层文件读取例程 ReadBinaryFileBlocksFirstCall()。该底层例程仅执行了路径规范化检查以及针对 ..Published Oct 19, 2026
- CVE-2026-94294Medium 5.3The App Builder WordPress plugin before 5.7.1 does not require authentication or authorisation before writing attacker-supplied data to one of its options and, on a separate unauthenticated request, redirecting the visitor's browser to a…Published Oct 19, 2026
- CVE-2026-94272Medium 5.3The Snap Finance WordPress plugin before 3.12.0 does not verify that a request to change a WooCommerce order's status comes from an authorised source, allowing unauthenticated attackers to move any order into a paid state or force it to…Published Oct 19, 2026
- CVE-2026-94231Medium 5.3The TrueBooker WordPress plugin before 1.3.0 does not have authorisation checks in place in some of its functionality, allowing unauthenticated users to create and modify booking services and categories, including their prices.Published Oct 19, 2026
| CVE | Title | Severity | Published |
|---|---|---|---|
| CVE-2026-85315 | Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel gRPC component. | Medium 5.3 | |
| CVE-2026-85314 | Improper Input Validation vulnerability in Apache Camel Mail component. | Medium 6.5 | |
| CVE-2026-85313 | Permissive Cross-domain Policy with Untrusted Domains vulnerability in Apache Camel Jetty component. | Medium 4.3 | |
| CVE-2026-85312 | Improper Input Validation vulnerability in Apache Camel Core component. | Medium 4.8 | |
| CVE-2026-85301 | Improper Authentication vulnerability in Apache Camel Keycloak component. | Medium 4.8 | |
| CVE-2026-85300 | Incorrect Default Permissions vulnerability in Apache Camel PQC component. | Medium 5.5 | |
| CVE-2026-85296 | Exposure of Data Element to Wrong Session vulnerability in Apache Camel AS2 component. | Medium 6.5 | |
| CVE-2026-85260 | Insertion of Sensitive Information into Log File vulnerability in Apache Camel MLLP component. | Medium 5.5 | |
| CVE-2026-85257 | Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel CXF component. | Medium 5.3 | |
| CVE-2026-85254 | Improper Handling of Case Sensitivity vulnerability in Apache Camel Platform HTTP component. | Medium 6.5 | |
| CVE-2026-85249 | Improper Input Validation vulnerability in Apache Camel Tika component. | Medium 6.5 | |
| CVE-2026-85248 | Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Camel PQC component. | Medium 5.9 | |
| CVE-2026-85247 | Improper Certificate Validation vulnerability in Apache Camel Knative component. | Medium 5.9 | |
| CVE-2026-85246 | Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel Mina component. | Medium 5.3 | |
| CVE-2026-85245 | Exposure of Data Element to Wrong Session vulnerability in Apache Camel Thrift component. | Medium 5.9 | |
| CVE-2026-85243 | Improper Validation of Integrity Check Value vulnerability in Apache Camel Crypto PGP component. | Medium 5.9 | |
| CVE-2026-84181 | Improper Authentication vulnerability in Apache Camel Shiro component. | Medium 5.9 | |
| CVE-2026-84180 | Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel Knative component. | Medium 5.3 | |
| CVE-2026-84178 | Cross-Site Request Forgery (CSRF) vulnerability in Apache Camel OAuth component. | Medium 6.1 | |
| CVE-2026-84176 | Permissive Cross-domain Policy with Untrusted Domains vulnerability in Apache Camel Platform HTTP Vertx component. | Medium 6.5 | |
| CVE-2026-78163 | Server-Side Request Forgery (SSRF), Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') and Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel Docling… | Medium 5.9 | |
| CVE-2026-112106 | A security vulnerability has been detected in TufayelLUS TikTok-Video-Downloader-PHP up to c4230497bb23dd9c1f81456fe8a982d951feac0d. | Medium 6.3 | |
| CVE-2026-112105 | Such manipulation leads to improper certificate validation. | Medium 6.3 | |
| CVE-2026-112104 | Executing a manipulation of the argument remoteEnabled can lead… | Medium 6.9 | |
| CVE-2026-112103 | Such manipulation leads to improper certificate validation. | Medium 6.3 | |
| CVE-2026-112192 | MISP contains a vulnerability in the handling of module plugin settings. | Medium 5.3 | |
| CVE-2026-112184 | MISP contains a reflected cross-site scripting (XSS) vulnerability in the workflow module interface. | Medium 4.8 | |
| CVE-2026-112183 | MISP contains a CSS injection vulnerability in the remote event preview feature. | Medium 4.8 | |
| CVE-2026-112102 | A vulnerability was detected in AXA Group NLP.js 4.27.0. | Medium 5.3 | |
| CVE-2026-112101 | A vulnerability was determined in BlackBeltTechnology pi-agent-dashboard up to 0.8.0. | Medium 5.3 | |
| CVE-2026-112100 | A vulnerability was determined in DeepPavlov up to 1.7.0. | Medium 5.1 | |
| CVE-2026-111407 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Tutor LMS tutor allows Stored XSS.This issue affects Tutor LMS: from n/a through 4.1.2. | Medium 6.5 | |
| CVE-2026-110898 | Incorrect Privilege Assignment vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows Privilege Escalation.This issue affects Essential Addons for Elementor: from n/a through 6.8.5. | Medium 6.4 | |
| CVE-2026-112180 | MISP contains a data integrity flaw in its event deletion logic. | Medium 5.1 | |
| CVE-2026-112179 | In MISP, the event synchronization process contained a logic error in the preparation of event reports for remote push. | Medium 5.3 | |
| CVE-2026-112098 | The manipulation results in code injection. | Medium 5.3 | |
| CVE-2026-112097 | The manipulation of the… | Medium 5.1 | |
| CVE-2026-112096 | The manipulation of… | Medium 5.1 | |
| CVE-2026-112095 | Executing a manipulation of the argument… | Medium 5.1 | |
| CVE-2026-111438 | 在 openGauss-server 的 src/common/backend/libpq/hba.cpp 中，复制连接认证存在访问控制绕过。hba_getauthmethod() 在处理 HADR/SW 复制发送方时，不要求 is_node_internal_connection()，直接调用 check_hba_replication()。check_hba_replication() 仅按 replication 标记做弱匹配，缺少普通 check_hba()… | Medium 6.5 | |
| CVE-2026-104679 | VOCALOID6 Editor provided by Yamaha Corporation improperly restricts XML external entity references. | Medium 6.9 | |
| CVE-2026-112094 | A security vulnerability has been detected in michaelrsweet mxml 4.0.5/4.0.6. | Medium 5.1 | |
| CVE-2026-112093 | The manipulation of the argument msg… | Medium 5.3 | |
| CVE-2026-112092 | Executi | Medium 5.3 | |
| CVE-2026-112091 | A flaw has been found in Dav-ee dairy-management-system 31ace9692d1e1e6d64339a42c463b361319c615c/f31a584c3330c013b61f8b0306d9e0849c6d693d. | Medium 6.9 | |
| CVE-2026-112090 | A vulnerability was detected in Dav-ee dairy-management-system 31ace9692d1e1e6d64339a42c463b361319c615c/f31a584c3330c013b61f8b0306d9e0849c6d693d. | Medium 5.3 | |
| CVE-2026-111439 | 在 openGauss-server的 src/common/backend/utils/adt/genfile.cpp 模块中，内置函数 pg_read_binary_file_blocks() 存在权限校验逻辑缺陷。该函数在入口处仅校验了起始块号（startBlockNum）和块数量（blockCount）的范围，随后直接调用底层文件读取例程 ReadBinaryFileBlocksFirstCall()。该底层例程仅执行了路径规范化检查以及针对 .. | Medium 4.3 | |
| CVE-2026-94294 | The App Builder WordPress plugin before 5.7.1 does not require authentication or authorisation before writing attacker-supplied data to one of its options and, on a separate unauthenticated request, redirecting the visitor's browser to a… | Medium 5.3 | |
| CVE-2026-94272 | The Snap Finance WordPress plugin before 3.12.0 does not verify that a request to change a WooCommerce order's status comes from an authorised source, allowing unauthenticated attackers to move any order into a paid state or force it to… | Medium 5.3 | |
| CVE-2026-94231 | The TrueBooker WordPress plugin before 1.3.0 does not have authorisation checks in place in some of its functionality, allowing unauthenticated users to create and modify booking services and categories, including their prices. | Medium 5.3 |
Showing 51–100 of 138,360. Narrow the filters to see the rest.
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status. Filter by severity and year here; the other filters work on the curated lists.