Vulnerability Intelligence · All CVEs
Every Published CVE, Searchable.
Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status.
Synced hourly · figures as of Oct 20, 2026
126,419 vulnerabilities · newest first
- CVE-2026-83592High 7.2Contact Form DB for Enfold <= 2.0.2 - Unauthenticated Stored Cross-Site Scripting via Contact Form Field ValuesPublished Oct 14, 2026
- CVE-2026-95816High 7.2Smart Forms <= 2.6.104 - Unauthenticated Stored Cross-Site Scripting via 'formString' ParameterPublished Oct 14, 2026
- CVE-2026-78193High 7.5JTL-Connector for WooCommerce <= 2.4.3 - Unauthenticated SQL InjectionPublished Oct 14, 2026
- CVE-2026-94377High 7.2Verified Reviews (Avis Vérifiés) <= 2.4.6 - Unauthenticated Stored Cross-Site Scripting via 'moderation' Parameter (discussion.commentaire)Published Oct 14, 2026
- CVE-2026-93885High 7.2Cryptocurrency Donation Box <= 2.2.13 - Unauthenticated Stored Cross-Site Scripting via data_object ParameterPublished Oct 14, 2026
- CVE-2026-77114High 7.2Document Gallery <= 5.1.1 - Unauthenticated Stored Cross-Site ScriptingPublished Oct 14, 2026
- CVE-2026-96661High 7.5Gmedia Photo Gallery <= 1.25.1 - Unauthenticated SQL Injection via 'gmediain' ParameterPublished Oct 14, 2026
- CVE-2026-110445High 8.6TEAMPLUS TECHNOLOGY｜TeamPlus Messenger - Code InjectionPublished Oct 14, 2026
- CVE-2026-110444High 8.6TEAMPLUS TECHNOLOGY｜TeamPlus Messenger - Code InjectionPublished Oct 14, 2026
- CVE-2026-14765High 7.7Epic Games Unreal Engine Insecure Default URL Scheme Allowance in LaunchURLPublished Oct 14, 2026
- CVE-2026-103422High 7.2AnyComment <= 0.3.6 - Unauthenticated Stored Cross-Site Scripting via 'email' ParameterPublished Oct 14, 2026
- CVE-2026-102251High 7.5Abandoned Cart Pro for WooCommerce <= 10.8.0 - Unauthenticated SQL Injection via AES-CTR Ciphertext Forgery in 'validate' ParameterPublished Oct 14, 2026
- CVE-2026-82715High 7.9Insecure Temporary File vulnerability in Hitachi Disk Array Driver for AIX and Hitachi Disk Array Driver for Virtual I/O Server.Published Oct 14, 2026
- CVE-2026-17092High 8.1The Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 8.10.2.1.Published Oct 14, 2026
- CVE-2026-104995High 8.1BP Profile Search <= 5.9 - Unauthenticated Local File Inclusion to Remote Code Execution via 'bps_directory' Cookie 'ajax_template' ValuePublished Oct 14, 2026
- CVE-2026-104767High 7.5Membership & User Roles for WooCommerce (Automatic Role Changer) <= 20260828 - Authenticated (Subscriber+) Privilege Escalation to Stale Foreign Role CachePublished Oct 14, 2026
- CVE-2026-104749High 7.5Bit integrations <= 2.10.6 - Unauthenticated Privilege Escalation via Identity-Confused Log Re-execution to Account Takeover via Log Re-execution of Anonymous-Captured Field DataPublished Oct 14, 2026
- CVE-2026-103423High 7.5Booking Package <= 1.7.29 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'mode=sendBooking' with nonexistent 'timeKey' and 'public=0'Published Oct 14, 2026
- CVE-2026-110385High 8.7A remote code execution vulnerability in ONLYOFFICE Document Server versions before10.0.0 allows an authenticated attacker with a valid Inbox-compatible JWT to execute arbitrary operating system commands as the ds service account.Published Oct 14, 2026
- CVE-2026-110359High 7.8Hyland Desktop Host for Windows before 25.1.1 is vulnerable to local privilege escalation.Published Oct 14, 2026
- CVE-2026-108473High 8.7Multiple Kasa devices contain an improper authentication vulnerability in the local device-management protocol.Published Oct 14, 2026
- CVE-2026-92817High 8.7The Ignition Perspective module does not properly validate session privileges when determining Designer-level access.Published Oct 14, 2026
- CVE-2026-50218High 8.5Akamai GPA (Guardicore Platform Agent) client on all platforms before 7.4 improperly validates JWT tokens used for seeding.Published Oct 14, 2026
- CVE-2026-88964High 7.1An integer underflow in OpenVPN version 2.7_alpha3 through 2.7.7 on Windows and Android allows remote authenticated servers to cause a denial of service or memory disclosure via crafted domain search…Published Oct 13, 2026
- CVE-2026-95634High 8.6CAI Content Credentials is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation.Published Oct 13, 2026
- CVE-2026-95633High 7.5CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass.Published Oct 13, 2026
- CVE-2026-95632High 7.5CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass.Published Oct 13, 2026
- CVE-2026-94453High 7.5Libreswan's pluto daemon has a use-after-free vulnerability when a client connecting using IKE over TCP closes the connection and another packet (retransmit or malicious) is received for the same tuple.Published Oct 13, 2026
- CVE-2026-84790High 7.6OpenVPN 2.7_alpha1 through 2.7.7 allows remote authenticated users to impersonate others via a crafted certificate subject fieldPublished Oct 13, 2026
- CVE-2026-77207High 7.5Null Pointer Dereference in PKCS#7 bundle with no certificatesPublished Oct 13, 2026
- CVE-2026-77206High 7.5IKEv2 pre-authentication Null Pointer Dereference in EAP codePublished Oct 13, 2026
- CVE-2026-100119High 7.5CAI Content Credentials | Improper Input Validation (CWE-20)Published Oct 13, 2026
- CVE-2026-100114High 7.5CAI Content Credentials | Improper Access Control (CWE-284)Published Oct 13, 2026
- CVE-2026-100136High 7.5CAI Content Credentials | Integer Overflow or Wraparound (CWE-190)Published Oct 13, 2026
- CVE-2026-100139High 7.5CAI Content Credentials | Uncontrolled Resource Consumption (CWE-400)Published Oct 13, 2026
- CVE-2026-104345High 7.5CAI Content Credentials | Improper Input Validation (CWE-20)Published Oct 13, 2026
- CVE-2026-105902High 7.5CAI Content Credentials | Uncontrolled Resource Consumption (CWE-400)Published Oct 13, 2026
- CVE-2026-103297High 7.5CAI Content Credentials | Improper Verification of Cryptographic Signature (CWE-347)Published Oct 13, 2026
- CVE-2026-103296High 7.5CAI Content Credentials | Improper Verification of Cryptographic Signature (CWE-347)Published Oct 13, 2026
- CVE-2026-100123High 7.5CAI Content Credentials | Improper Certificate Validation (CWE-295)Published Oct 13, 2026
- CVE-2026-100122High 7.5CAI Content Credentials | Improper Certificate Validation (CWE-295)Published Oct 13, 2026
- CVE-2026-100121High 7.5CAI Content Credentials | Improper Certificate Validation (CWE-295)Published Oct 13, 2026
- CVE-2026-100120High 7.5CAI Content Credentials | Improper Input Validation (CWE-20)Published Oct 13, 2026
- CVE-2026-100115High 7.5CAI Content Credentials | Improper Access Control (CWE-284)Published Oct 13, 2026
- CVE-2026-100137High 7.5CAI Content Credentials | Uncontrolled Resource Consumption (CWE-400)Published Oct 13, 2026
- CVE-2026-100117High 7.5CAI Content Credentials | Improper Input Validation (CWE-20)Published Oct 13, 2026
- CVE-2026-100135High 7.5CAI Content Credentials | Improper Input Validation (CWE-20)Published Oct 13, 2026
- CVE-2026-100118High 7.5CAI Content Credentials | Improper Certificate Validation (CWE-295)Published Oct 13, 2026
- CVE-2026-100113High 7.5CAI Content Credentials | Improper Input Validation (CWE-20)Published Oct 13, 2026
- CVE-2026-100124High 7.5CAI Content Credentials | Improper Input Validation (CWE-20)Published Oct 13, 2026
| CVE | Title | Severity | Published |
|---|---|---|---|
| CVE-2026-83592 | Contact Form DB for Enfold <= 2.0.2 - Unauthenticated Stored Cross-Site Scripting via Contact Form Field Values | High 7.2 | |
| CVE-2026-95816 | Smart Forms <= 2.6.104 - Unauthenticated Stored Cross-Site Scripting via 'formString' Parameter | High 7.2 | |
| CVE-2026-78193 | JTL-Connector for WooCommerce <= 2.4.3 - Unauthenticated SQL Injection | High 7.5 | |
| CVE-2026-94377 | Verified Reviews (Avis Vérifiés) <= 2.4.6 - Unauthenticated Stored Cross-Site Scripting via 'moderation' Parameter (discussion.commentaire) | High 7.2 | |
| CVE-2026-93885 | Cryptocurrency Donation Box <= 2.2.13 - Unauthenticated Stored Cross-Site Scripting via data_object Parameter | High 7.2 | |
| CVE-2026-77114 | Document Gallery <= 5.1.1 - Unauthenticated Stored Cross-Site Scripting | High 7.2 | |
| CVE-2026-96661 | Gmedia Photo Gallery <= 1.25.1 - Unauthenticated SQL Injection via 'gmediain' Parameter | High 7.5 | |
| CVE-2026-110445 | TEAMPLUS TECHNOLOGY｜TeamPlus Messenger - Code Injection | High 8.6 | |
| CVE-2026-110444 | TEAMPLUS TECHNOLOGY｜TeamPlus Messenger - Code Injection | High 8.6 | |
| CVE-2026-14765 | Epic Games Unreal Engine Insecure Default URL Scheme Allowance in LaunchURL | High 7.7 | |
| CVE-2026-103422 | AnyComment <= 0.3.6 - Unauthenticated Stored Cross-Site Scripting via 'email' Parameter | High 7.2 | |
| CVE-2026-102251 | Abandoned Cart Pro for WooCommerce <= 10.8.0 - Unauthenticated SQL Injection via AES-CTR Ciphertext Forgery in 'validate' Parameter | High 7.5 | |
| CVE-2026-82715 | Insecure Temporary File vulnerability in Hitachi Disk Array Driver for AIX and Hitachi Disk Array Driver for Virtual I/O Server. | High 7.9 | |
| CVE-2026-17092 | The Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 8.10.2.1. | High 8.1 | |
| CVE-2026-104995 | BP Profile Search <= 5.9 - Unauthenticated Local File Inclusion to Remote Code Execution via 'bps_directory' Cookie 'ajax_template' Value | High 8.1 | |
| CVE-2026-104767 | Membership & User Roles for WooCommerce (Automatic Role Changer) <= 20260828 - Authenticated (Subscriber+) Privilege Escalation to Stale Foreign Role Cache | High 7.5 | |
| CVE-2026-104749 | Bit integrations <= 2.10.6 - Unauthenticated Privilege Escalation via Identity-Confused Log Re-execution to Account Takeover via Log Re-execution of Anonymous-Captured Field Data | High 7.5 | |
| CVE-2026-103423 | Booking Package <= 1.7.29 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'mode=sendBooking' with nonexistent 'timeKey' and 'public=0' | High 7.5 | |
| CVE-2026-110385 | A remote code execution vulnerability in ONLYOFFICE Document Server versions before10.0.0 allows an authenticated attacker with a valid Inbox-compatible JWT to execute arbitrary operating system commands as the ds service account. | High 8.7 | |
| CVE-2026-110359 | Hyland Desktop Host for Windows before 25.1.1 is vulnerable to local privilege escalation. | High 7.8 | |
| CVE-2026-108473 | Multiple Kasa devices contain an improper authentication vulnerability in the local device-management protocol. | High 8.7 | |
| CVE-2026-92817 | The Ignition Perspective module does not properly validate session privileges when determining Designer-level access. | High 8.7 | |
| CVE-2026-50218 | Akamai GPA (Guardicore Platform Agent) client on all platforms before 7.4 improperly validates JWT tokens used for seeding. | High 8.5 | |
| CVE-2026-88964 | An integer underflow in OpenVPN version 2.7_alpha3 through 2.7.7 on Windows and Android allows remote authenticated servers to cause a denial of service or memory disclosure via crafted domain search… | High 7.1 | |
| CVE-2026-95634 | CAI Content Credentials is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. | High 8.6 | |
| CVE-2026-95633 | CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass. | High 7.5 | |
| CVE-2026-95632 | CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass. | High 7.5 | |
| CVE-2026-94453 | Libreswan's pluto daemon has a use-after-free vulnerability when a client connecting using IKE over TCP closes the connection and another packet (retransmit or malicious) is received for the same tuple. | High 7.5 | |
| CVE-2026-84790 | OpenVPN 2.7_alpha1 through 2.7.7 allows remote authenticated users to impersonate others via a crafted certificate subject field | High 7.6 | |
| CVE-2026-77207 | Null Pointer Dereference in PKCS#7 bundle with no certificates | High 7.5 | |
| CVE-2026-77206 | IKEv2 pre-authentication Null Pointer Dereference in EAP code | High 7.5 | |
| CVE-2026-100119 | CAI Content Credentials | Improper Input Validation (CWE-20) | High 7.5 | |
| CVE-2026-100114 | CAI Content Credentials | Improper Access Control (CWE-284) | High 7.5 | |
| CVE-2026-100136 | CAI Content Credentials | Integer Overflow or Wraparound (CWE-190) | High 7.5 | |
| CVE-2026-100139 | CAI Content Credentials | Uncontrolled Resource Consumption (CWE-400) | High 7.5 | |
| CVE-2026-104345 | CAI Content Credentials | Improper Input Validation (CWE-20) | High 7.5 | |
| CVE-2026-105902 | CAI Content Credentials | Uncontrolled Resource Consumption (CWE-400) | High 7.5 | |
| CVE-2026-103297 | CAI Content Credentials | Improper Verification of Cryptographic Signature (CWE-347) | High 7.5 | |
| CVE-2026-103296 | CAI Content Credentials | Improper Verification of Cryptographic Signature (CWE-347) | High 7.5 | |
| CVE-2026-100123 | CAI Content Credentials | Improper Certificate Validation (CWE-295) | High 7.5 | |
| CVE-2026-100122 | CAI Content Credentials | Improper Certificate Validation (CWE-295) | High 7.5 | |
| CVE-2026-100121 | CAI Content Credentials | Improper Certificate Validation (CWE-295) | High 7.5 | |
| CVE-2026-100120 | CAI Content Credentials | Improper Input Validation (CWE-20) | High 7.5 | |
| CVE-2026-100115 | CAI Content Credentials | Improper Access Control (CWE-284) | High 7.5 | |
| CVE-2026-100137 | CAI Content Credentials | Uncontrolled Resource Consumption (CWE-400) | High 7.5 | |
| CVE-2026-100117 | CAI Content Credentials | Improper Input Validation (CWE-20) | High 7.5 | |
| CVE-2026-100135 | CAI Content Credentials | Improper Input Validation (CWE-20) | High 7.5 | |
| CVE-2026-100118 | CAI Content Credentials | Improper Certificate Validation (CWE-295) | High 7.5 | |
| CVE-2026-100113 | CAI Content Credentials | Improper Input Validation (CWE-20) | High 7.5 | |
| CVE-2026-100124 | CAI Content Credentials | Improper Input Validation (CWE-20) | High 7.5 |
Showing 951–1,000 of 126,419. Narrow the filters to see the rest.
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status. Filter by severity and year here; the other filters work on the curated lists.