Vulnerability Intelligence · All CVEs
Every Published CVE, Searchable.
Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status.
Synced hourly · figures as of Oct 20, 2026
40,425 vulnerabilities · newest first
- CVE-2026-103547Critical 9.2In ldapd in OpenBSD 7.8 before errata 057 and 7.9 before errata 021, delegated BSD authentication results are correlated only by the LDAP child process client file descriptor and LDAP message ID.Published Sep 30, 2026
- CVE-2026-100512Critical 9.8WordPress Nested Pages plugin <= 3.3.2 - PHP Object Injection vulnerabilityPublished Sep 30, 2026
- CVE-2026-103475Critical 9.3yii2-starter-kit through 4.2.0 Debug and Gii Module ExposurePublished Sep 30, 2026
- CVE-2026-103473Critical 9.2Deno 2.7.0 through 2.9.7 Command Injection via node:child_processPublished Sep 30, 2026
- CVE-2026-62308Critical 9.1Tugtainer: Authenticated SSRF via arbitrary notification URLs in test_notification endpointPublished Sep 30, 2026
- CVE-2026-55494Critical 9.8Tugtainer: Unauthenticated access to Tugtainer Agent Docker management APIs when AGENT_SECRET is unsetPublished Sep 30, 2026
- CVE-2026-55181Critical 9.4Tugtainer: OIDC login remains accessible when OIDC_ENABLED is falsePublished Sep 30, 2026
- CVE-2026-55176Critical 9.0Soft Machine: Cross-tenant workspace API auth bypass via shared CONTAINER_SHARED_SECRET bearer tokenPublished Sep 30, 2026
- CVE-2026-75969Critical 9.1PTZOptics Missing Authentication in Firmware UploadPublished Sep 30, 2026
- CVE-2026-103470Critical 9.3In Internet2 Grouper before 7.5.1 (in some configurations), a user who is allowed to create or edit rules in the User Interface can escalate privileges.Published Sep 30, 2026
- CVE-2026-102427Critical 10.0Joomla Extension - ordasoft.com - Unauthenticated Remote Code Execution in OrdaSoft Joomla CCK < 8.3.16 - site/uploader.php is reached through the component’s normal frontend routing (task=getContent), a task with no authentication or ACL…Published Sep 30, 2026
- CVE-2026-100273Critical 9.8In JetBrains YouTrack before 2026.2.19197 authorisation bypass in the scripts debugger allowed arbitrary code executionPublished Sep 30, 2026
- CVE-2026-100255Critical 9.8In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 administrator account takeover was possible via password resetPublished Sep 30, 2026
- CVE-2026-19445Critical 9.2Use-after-free of a server-side SSLContext when sni_callback switches contextsPublished Sep 30, 2026
- CVE-2026-76570Critical 10.0Joomla Extension - joomcode.com - Unauthenticated SQL injection in read and write queries in JCTables 1.21.1 - The front-end CRUD API controller performs no Joomla token validation and no authentication check on any task.Published Sep 30, 2026
- CVE-2026-18782Critical 9.8Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Trex Digital Smart Manufacturing Systems Inc.Published Sep 30, 2026
- CVE-2026-103395Critical 9.3LightLLM through 1.2.0 visual_only deployments expose an unauthenticated RPyC service with allow_pickle enabled that deserializes attacker-supplied arguments in the remote_infer_images method.Published Sep 30, 2026
- CVE-2026-93903Critical 9.4LiteSpeed Web Server (LSWS) before 6.3.7 build 1 mishandles internal redirect URL validation in a certain "corner case."Published Sep 30, 2026
- CVE-2026-82307Critical 9.8Multiple Vulnerabilities in Dolusoft Software's SOPLOGPublished Sep 30, 2026
- CVE-2026-76504Critical 9.8Cisco Catalyst SD-WAN Manager System Account Authorization Bypass VulnerabilityCisco · Catalyst SD-WAN ManagerPublished Sep 30, 2026
- CVE-2026-97274Critical 9.8WordPress OAuth Single Sign On – SSO (OAuth Client) plugin <= 7.1.2 - Bypass vulnerability vulnerabilityPublished Sep 30, 2026
- CVE-2026-97248Critical 9.8WordPress Booking Activities plugin <= 1.18.7.1 - PHP Object Injection vulnerabilityPublished Sep 30, 2026
- CVE-2026-96822Critical 9.3WordPress Books Gallery plugin <= 4.8.3 - SQL Injection vulnerabilityPublished Sep 30, 2026
- CVE-2026-96350Critical 9.8WordPress Estatik plugin <= 4.3.5 - Privilege Escalation vulnerabilityPublished Sep 30, 2026
- CVE-2026-96349Critical 10.0WordPress SiteSkite plugin <= 2.1.8 - Remote Code Execution (RCE) vulnerabilityPublished Sep 30, 2026
- CVE-2026-94389Critical 9.0WordPress AcyMailing SMTP Newsletter plugin <= 11.0.5 - Remote Code Execution (RCE) vulnerabilityPublished Sep 30, 2026
- CVE-2026-74865Critical 9.2Authentication Bypass in sogo_yhnPublished Sep 30, 2026
- CVE-2026-74864Critical 9.3Authentication Bypass in sogo_yhnPublished Sep 30, 2026
- CVE-2026-89238Critical 9.1Apache WSS4J: WSS4J EncryptedHeader child confusion causing wrong protected-header selectionPublished Sep 30, 2026
- CVE-2026-88920Critical 9.8Apache WSS4J: SAML Sender-Vouches Authentication BypassPublished Sep 30, 2026
- CVE-2026-87830Critical 9.1Apache WSS4J: Streaming WS-SecurityPolicy validation may skip element-protection checks.Published Sep 30, 2026
- CVE-2026-77185Critical 9.1Apache MINA SSHD: Asynchronous authentication can bypass signature verificationPublished Sep 30, 2026
- CVE-2026-94053Critical 9.1Apache MINA SSHD: LDAP injection in sshd-ldapPublished Sep 30, 2026
- CVE-2026-94052Critical 9.1Apache MINA SSHD: LDAP password authentication ineffectivePublished Sep 30, 2026
- CVE-2026-102458Critical 9.3DigiWin｜EasyFlow .NET - Missing AuthenticationPublished Sep 30, 2026
- CVE-2026-102455Critical 9.3DigiWin｜EasyFlow - Insecure DeserializationPublished Sep 30, 2026
- CVE-2026-102508Critical 9.2Apache PLC4X: OPC UA secure channel: integrity bypass, unverifiable server certificate, and silent downgradePublished Sep 30, 2026
- CVE-2026-97196Critical 9.1WordPress GiveWP plugin <= 4.16.9 - Broken Authentication vulnerabilityPublished Sep 30, 2026
- CVE-2026-75873Critical 9.8Zella Theme < 2.6.3 - Unauthenticated Arbitrary File UploadPublished Sep 30, 2026
- CVE-2026-102911Critical 9.4zosmaai pi-llm-wiki wiki_capture_source MCP tool index.ts os command injectionPublished Sep 30, 2026
- CVE-2026-103110Critical 9.8Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input validation that allows a remote attacker to execute code remotely as an unprivileged user on a Pexip Infinity Conferencing Node.Published Sep 30, 2026
- CVE-2026-103109Critical 9.4Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input validation in the media implementation that allows a remote attacker to trigger memory corruption or a software abort resulting in a denial of service.Published Sep 30, 2026
- CVE-2026-103056Critical 9.4AiSOC versions 7.2.0 before 12.0.0 contain a command injection vulnerability in the actions service that builds CrowdStrike Real Time Response command strings by interpolating unescaped action parameters in crowdstrike_rtr.py and…Published Sep 30, 2026
- CVE-2026-86131Critical 9.2A code injection vulnerability in WatchGuard Fireware OS's BOVPN Over TLS client configuration handling allows an attacker who controls the remote VPN server to execute arbitrary commands as root on the connecting Firebox.Published Sep 30, 2026
- CVE-2026-51862Critical 9.1DB-GPT 0.8.0 contains directory traversal in skill_upload (packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/agentic_data_api.py:40).Published Sep 30, 2026
- CVE-2026-51861Critical 9.8bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to Code Injection in src/backend/bisheng/api/v1/validate.py.Published Sep 30, 2026
- CVE-2026-51859Critical 9.1bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to directory traversal in save_download_file (src/backend/bisheng/core/cache/utils.py:290).Published Sep 30, 2026
- CVE-2026-51858Critical 9.8In camel-ai camel 0.2.91a1, v0.2.91a2 and v0.2.91a3, TerminalToolkit.shell_exec allows prompt-driven shell command execution without an approval boundary.Published Sep 30, 2026
- CVE-2026-51857Critical 9.8In camel-ai camel 0.2.91a1, v0.2.91a2 and v0.2.91a3, CodeExecutionToolkit can run model-produced Python code through SubprocessInterpreter without an approval boundary.Published Sep 30, 2026
- CVE-2026-51856Critical 9.8In agentscope 1.0.18, 1.0.19, and 1.0.19 when the RealtimeAgent session exposes execute_python_code as an available tool, a remote WebSocket user can prompt the agent to call that tool and run Python code in the service environment.Published Sep 30, 2026
| CVE | Title | Severity | Published |
|---|---|---|---|
| CVE-2026-103547 | In ldapd in OpenBSD 7.8 before errata 057 and 7.9 before errata 021, delegated BSD authentication results are correlated only by the LDAP child process client file descriptor and LDAP message ID. | Critical 9.2 | |
| CVE-2026-100512 | WordPress Nested Pages plugin <= 3.3.2 - PHP Object Injection vulnerability | Critical 9.8 | |
| CVE-2026-103475 | yii2-starter-kit through 4.2.0 Debug and Gii Module Exposure | Critical 9.3 | |
| CVE-2026-103473 | Deno 2.7.0 through 2.9.7 Command Injection via node:child_process | Critical 9.2 | |
| CVE-2026-62308 | Tugtainer: Authenticated SSRF via arbitrary notification URLs in test_notification endpoint | Critical 9.1 | |
| CVE-2026-55494 | Tugtainer: Unauthenticated access to Tugtainer Agent Docker management APIs when AGENT_SECRET is unset | Critical 9.8 | |
| CVE-2026-55181 | Tugtainer: OIDC login remains accessible when OIDC_ENABLED is false | Critical 9.4 | |
| CVE-2026-55176 | Soft Machine: Cross-tenant workspace API auth bypass via shared CONTAINER_SHARED_SECRET bearer token | Critical 9.0 | |
| CVE-2026-75969 | PTZOptics Missing Authentication in Firmware Upload | Critical 9.1 | |
| CVE-2026-103470 | In Internet2 Grouper before 7.5.1 (in some configurations), a user who is allowed to create or edit rules in the User Interface can escalate privileges. | Critical 9.3 | |
| CVE-2026-102427 | Joomla Extension - ordasoft.com - Unauthenticated Remote Code Execution in OrdaSoft Joomla CCK < 8.3.16 - site/uploader.php is reached through the component’s normal frontend routing (task=getContent), a task with no authentication or ACL… | Critical 10.0 | |
| CVE-2026-100273 | In JetBrains YouTrack before 2026.2.19197 authorisation bypass in the scripts debugger allowed arbitrary code execution | Critical 9.8 | |
| CVE-2026-100255 | In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 administrator account takeover was possible via password reset | Critical 9.8 | |
| CVE-2026-19445 | Use-after-free of a server-side SSLContext when sni_callback switches contexts | Critical 9.2 | |
| CVE-2026-76570 | Joomla Extension - joomcode.com - Unauthenticated SQL injection in read and write queries in JCTables 1.21.1 - The front-end CRUD API controller performs no Joomla token validation and no authentication check on any task. | Critical 10.0 | |
| CVE-2026-18782 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Trex Digital Smart Manufacturing Systems Inc. | Critical 9.8 | |
| CVE-2026-103395 | LightLLM through 1.2.0 visual_only deployments expose an unauthenticated RPyC service with allow_pickle enabled that deserializes attacker-supplied arguments in the remote_infer_images method. | Critical 9.3 | |
| CVE-2026-93903 | LiteSpeed Web Server (LSWS) before 6.3.7 build 1 mishandles internal redirect URL validation in a certain "corner case." | Critical 9.4 | |
| CVE-2026-82307 | Multiple Vulnerabilities in Dolusoft Software's SOPLOG | Critical 9.8 | |
| CVE-2026-76504 | Cisco Catalyst SD-WAN Manager System Account Authorization Bypass Vulnerability Cisco · Catalyst SD-WAN Manager | Critical 9.8 | |
| CVE-2026-97274 | WordPress OAuth Single Sign On – SSO (OAuth Client) plugin <= 7.1.2 - Bypass vulnerability vulnerability | Critical 9.8 | |
| CVE-2026-97248 | WordPress Booking Activities plugin <= 1.18.7.1 - PHP Object Injection vulnerability | Critical 9.8 | |
| CVE-2026-96822 | WordPress Books Gallery plugin <= 4.8.3 - SQL Injection vulnerability | Critical 9.3 | |
| CVE-2026-96350 | WordPress Estatik plugin <= 4.3.5 - Privilege Escalation vulnerability | Critical 9.8 | |
| CVE-2026-96349 | WordPress SiteSkite plugin <= 2.1.8 - Remote Code Execution (RCE) vulnerability | Critical 10.0 | |
| CVE-2026-94389 | WordPress AcyMailing SMTP Newsletter plugin <= 11.0.5 - Remote Code Execution (RCE) vulnerability | Critical 9.0 | |
| CVE-2026-74865 | Authentication Bypass in sogo_yhn | Critical 9.2 | |
| CVE-2026-74864 | Authentication Bypass in sogo_yhn | Critical 9.3 | |
| CVE-2026-89238 | Apache WSS4J: WSS4J EncryptedHeader child confusion causing wrong protected-header selection | Critical 9.1 | |
| CVE-2026-88920 | Apache WSS4J: SAML Sender-Vouches Authentication Bypass | Critical 9.8 | |
| CVE-2026-87830 | Apache WSS4J: Streaming WS-SecurityPolicy validation may skip element-protection checks. | Critical 9.1 | |
| CVE-2026-77185 | Apache MINA SSHD: Asynchronous authentication can bypass signature verification | Critical 9.1 | |
| CVE-2026-94053 | Apache MINA SSHD: LDAP injection in sshd-ldap | Critical 9.1 | |
| CVE-2026-94052 | Apache MINA SSHD: LDAP password authentication ineffective | Critical 9.1 | |
| CVE-2026-102458 | DigiWin｜EasyFlow .NET - Missing Authentication | Critical 9.3 | |
| CVE-2026-102455 | DigiWin｜EasyFlow - Insecure Deserialization | Critical 9.3 | |
| CVE-2026-102508 | Apache PLC4X: OPC UA secure channel: integrity bypass, unverifiable server certificate, and silent downgrade | Critical 9.2 | |
| CVE-2026-97196 | WordPress GiveWP plugin <= 4.16.9 - Broken Authentication vulnerability | Critical 9.1 | |
| CVE-2026-75873 | Zella Theme < 2.6.3 - Unauthenticated Arbitrary File Upload | Critical 9.8 | |
| CVE-2026-102911 | zosmaai pi-llm-wiki wiki_capture_source MCP tool index.ts os command injection | Critical 9.4 | |
| CVE-2026-103110 | Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input validation that allows a remote attacker to execute code remotely as an unprivileged user on a Pexip Infinity Conferencing Node. | Critical 9.8 | |
| CVE-2026-103109 | Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input validation in the media implementation that allows a remote attacker to trigger memory corruption or a software abort resulting in a denial of service. | Critical 9.4 | |
| CVE-2026-103056 | AiSOC versions 7.2.0 before 12.0.0 contain a command injection vulnerability in the actions service that builds CrowdStrike Real Time Response command strings by interpolating unescaped action parameters in crowdstrike_rtr.py and… | Critical 9.4 | |
| CVE-2026-86131 | A code injection vulnerability in WatchGuard Fireware OS's BOVPN Over TLS client configuration handling allows an attacker who controls the remote VPN server to execute arbitrary commands as root on the connecting Firebox. | Critical 9.2 | |
| CVE-2026-51862 | DB-GPT 0.8.0 contains directory traversal in skill_upload (packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/agentic_data_api.py:40). | Critical 9.1 | |
| CVE-2026-51861 | bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to Code Injection in src/backend/bisheng/api/v1/validate.py. | Critical 9.8 | |
| CVE-2026-51859 | bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to directory traversal in save_download_file (src/backend/bisheng/core/cache/utils.py:290). | Critical 9.1 | |
| CVE-2026-51858 | In camel-ai camel 0.2.91a1, v0.2.91a2 and v0.2.91a3, TerminalToolkit.shell_exec allows prompt-driven shell command execution without an approval boundary. | Critical 9.8 | |
| CVE-2026-51857 | In camel-ai camel 0.2.91a1, v0.2.91a2 and v0.2.91a3, CodeExecutionToolkit can run model-produced Python code through SubprocessInterpreter without an approval boundary. | Critical 9.8 | |
| CVE-2026-51856 | In agentscope 1.0.18, 1.0.19, and 1.0.19 when the RealtimeAgent session exposes execute_python_code as an available tool, a remote WebSocket user can prompt the agent to call that tool and run Python code in the service environment. | Critical 9.8 |
Showing 951–1,000 of 40,425. Narrow the filters to see the rest.
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status. Filter by severity and year here; the other filters work on the curated lists.