Vulnerability Intelligence · All CVEs
Every Published CVE, Searchable.
Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status.
Synced hourly · figures as of Oct 20, 2026
11,320 vulnerabilities · newest first
- CVE-2026-11617Low 3.1Tanium addressed a compression bomb vulnerability in Findings.Published Aug 19, 2026
- CVE-2026-61712Low 2.3Prior to 0.31.1, BuildKit read attacker-controlled /etc/passwd and /etc/group files without an upper bound while…Published Aug 19, 2026
- CVE-2026-16891Low 3.3IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to obtain sensitive information due to an out-of-bounds read.Published Aug 19, 2026
- CVE-2026-16890Low 3.6IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to obtain sensitive information or cause a denial of service due to an integer overflow.Published Aug 19, 2026
- CVE-2026-16888Low 3.7IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to obtain sensitive information due to a path traversal vulnerability.Published Aug 19, 2026
- CVE-2026-75583Low 2.3keeper.sh's calendar module version prior to 2.18.14 contains a server-side request forgery (SSRF) guard bypass vulnerability that allows authenticated attackers to reach private network addresses by exploiting a DNS rebinding attack…Published Aug 19, 2026
- CVE-2026-62670Low 2.3Grav Flex Objects Plugin allows you to build custom collections of objects.Published Aug 19, 2026
- CVE-2026-65610Low 2.4nnn stores homelen variable as uchar_t, which can only represent values in the range 0-255.Published Aug 19, 2026
- CVE-2026-65609Low 2.4nnn is vulnerable to Out-of-Bound write vulnerability.Published Aug 19, 2026
- CVE-2026-49423Low 3.3When building the iovec array for a received TLS 1.2 CBC record, ktls_ocf_tls_cbc_decrypt() incremented the iovec index for every mbuf in the chain, including mbufs that were skipped because they contained only TLS header bytes.Published Aug 19, 2026
- CVE-2026-49431Low 3.3The ZFS_IOC_SET_PROP ioctl, used by zfs-set(8), incorrectly validated the calling user such that an unprivileged user is able to set metadata on a dataset indicating that the dataset has received properties from a zfs-recv(8)…Published Aug 19, 2026
- CVE-2026-49426Low 3.3When auditing a system call executed via ptrace(PT_SC_REMOTE), the kernel passed the return value of an internal setup function to AUDIT_SYSCALL_EXIT() rather than the actual result of the executed system call.Published Aug 19, 2026
- CVE-2026-19406Low 2.7The Easy Appointments WordPress plugin before 4.0.1 does not restrict one of its appointment-listing REST endpoints to the records belonging to the requesting user, allowing users with contributor-level access to read all bookings on the…Published Aug 19, 2026
- CVE-2026-14826Low 2.7The Quiz and Survey Master (QSM) WordPress plugin before 11.2.4 does not perform a per-object ownership check on the REST routes that return a quiz's email-notification and results-page configuration, allowing users with…Published Aug 19, 2026
- CVE-2026-14825Low 2.7The Quiz and Survey Master (QSM) WordPress plugin before 11.2.4 does not perform a per-object ownership check before saving a quiz's front-end text settings, allowing users with contributor-level access and above to modify the text…Published Aug 19, 2026
- CVE-2026-13173Low 2.7The Eventin WordPress plugin before 4.1.21 does not verify the current user's permission to edit other users before assigning roles and updating user metadata during speaker creation, allowing users with contributor-level access and…Published Aug 19, 2026
- CVE-2026-76042Low 3.1Use of uninitialized resource in GPU in Google Chrome prior to 151.0.7922.169 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page.Published Aug 18, 2026
- CVE-2026-73923Low 3.7The supported version that is affected is 1.4.20.Published Aug 18, 2026
- CVE-2026-71146Low 1.9The supported version that is affected is 11.2.25.0.000.Published Aug 18, 2026
- CVE-2026-71144Low 3.0The supported version that is affected is 11.2.25.0.000.Published Aug 18, 2026
- CVE-2026-71140Low 3.4The supported version that is affected is 7.2.14.Published Aug 18, 2026
- CVE-2026-71089Low 3.3The supported version that is affected is 3.6.Published Aug 18, 2026
- CVE-2026-71083Low 1.8The supported version that is affected is 3.6.Published Aug 18, 2026
- CVE-2026-71082Low 2.5The supported version that is affected is 3.6.Published Aug 18, 2026
- CVE-2026-71081Low 1.9The supported version that is affected is 3.6.Published Aug 18, 2026
- CVE-2026-71080Low 3.7The supported version that is affected is 3.6.Published Aug 18, 2026
- CVE-2026-71072Low 3.3The supported version that is affected is 3.6.Published Aug 18, 2026
- CVE-2026-70962Low 3.3The supported version that is affected is 11.2.25.0.000.Published Aug 18, 2026
- CVE-2026-70919Low 2.5The supported version that is affected is 11.2.25.0.000.Published Aug 18, 2026
- CVE-2026-70853Low 3.3The supported version that is affected is 11.2.25.0.000.Published Aug 18, 2026
- CVE-2026-70851Low 3.1The supported version that is affected is 11.2.25.0.000.Published Aug 18, 2026
- CVE-2026-70850Low 3.0The supported version that is affected is 11.2.25.0.000.Published Aug 18, 2026
- CVE-2026-70848Low 3.7The supported version that is affected is 11.2.25.0.000.Published Aug 18, 2026
- CVE-2026-70785Low 3.7The supported version that is affected is 11.2.25.0.000.Published Aug 18, 2026
- CVE-2026-70776Low 2.6The supported version that is affected is 11.2.25.0.000.Published Aug 18, 2026
- CVE-2026-70711Low 3.6The supported version that is affected is 11.2.25.0.000.Published Aug 18, 2026
- CVE-2026-70682Low 3.7The supported version that is affected is 11.2.25.0.000.Published Aug 18, 2026
- CVE-2026-67442Low 2.0Prior to 1.3.3, DELETE /api/roles removes role definitions through server/runtime/users/usrstorage.js but does not remove the deleted role identifier from each…Published Aug 18, 2026
- CVE-2026-62606Low 3.1The supported version that is affected is 11.2.25.0.000.Published Aug 18, 2026
- CVE-2026-62604Low 3.1The supported version that is affected is 11.2.25.0.000.Published Aug 18, 2026
- CVE-2026-62583Low 3.0The supported version that is affected is 11.2.25.0.000.Published Aug 18, 2026
- CVE-2026-62580Low 2.6The supported version that is affected is 11.2.25.0.000.Published Aug 18, 2026
- CVE-2026-62577Low 3.3The supported version that is affected is 11.2.25.0.000.Published Aug 18, 2026
- CVE-2026-62570Low 3.0The supported version that is affected is 11.2.25.0.000.Published Aug 18, 2026
- CVE-2026-62569Low 3.4The supported version that is affected is 11.2.25.0.000.Published Aug 18, 2026
- CVE-2026-62533Low 3.7The supported version that is affected is 11.2.25.0.000.Published Aug 18, 2026
- CVE-2026-62532Low 3.8The supported version that is affected is 11.2.25.0.000.Published Aug 18, 2026
- CVE-2026-62529Low 3.5The supported version that is affected is 11.2.25.0.000.Published Aug 18, 2026
- CVE-2026-62526Low 3.3The supported version that is affected is 11.2.25.0.000.Published Aug 18, 2026
- CVE-2026-62511Low 3.0The supported version that is affected is 11.2.25.0.000.Published Aug 18, 2026
| CVE | Title | Severity | Published |
|---|---|---|---|
| CVE-2026-11617 | Tanium addressed a compression bomb vulnerability in Findings. | Low 3.1 | |
| CVE-2026-61712 | Prior to 0.31.1, BuildKit read attacker-controlled /etc/passwd and /etc/group files without an upper bound while… | Low 2.3 | |
| CVE-2026-16891 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to obtain sensitive information due to an out-of-bounds read. | Low 3.3 | |
| CVE-2026-16890 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to obtain sensitive information or cause a denial of service due to an integer overflow. | Low 3.6 | |
| CVE-2026-16888 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to obtain sensitive information due to a path traversal vulnerability. | Low 3.7 | |
| CVE-2026-75583 | keeper.sh's calendar module version prior to 2.18.14 contains a server-side request forgery (SSRF) guard bypass vulnerability that allows authenticated attackers to reach private network addresses by exploiting a DNS rebinding attack… | Low 2.3 | |
| CVE-2026-62670 | Grav Flex Objects Plugin allows you to build custom collections of objects. | Low 2.3 | |
| CVE-2026-65610 | nnn stores homelen variable as uchar_t, which can only represent values in the range 0-255. | Low 2.4 | |
| CVE-2026-65609 | nnn is vulnerable to Out-of-Bound write vulnerability. | Low 2.4 | |
| CVE-2026-49423 | When building the iovec array for a received TLS 1.2 CBC record, ktls_ocf_tls_cbc_decrypt() incremented the iovec index for every mbuf in the chain, including mbufs that were skipped because they contained only TLS header bytes. | Low 3.3 | |
| CVE-2026-49431 | The ZFS_IOC_SET_PROP ioctl, used by zfs-set(8), incorrectly validated the calling user such that an unprivileged user is able to set metadata on a dataset indicating that the dataset has received properties from a zfs-recv(8)… | Low 3.3 | |
| CVE-2026-49426 | When auditing a system call executed via ptrace(PT_SC_REMOTE), the kernel passed the return value of an internal setup function to AUDIT_SYSCALL_EXIT() rather than the actual result of the executed system call. | Low 3.3 | |
| CVE-2026-19406 | The Easy Appointments WordPress plugin before 4.0.1 does not restrict one of its appointment-listing REST endpoints to the records belonging to the requesting user, allowing users with contributor-level access to read all bookings on the… | Low 2.7 | |
| CVE-2026-14826 | The Quiz and Survey Master (QSM) WordPress plugin before 11.2.4 does not perform a per-object ownership check on the REST routes that return a quiz's email-notification and results-page configuration, allowing users with… | Low 2.7 | |
| CVE-2026-14825 | The Quiz and Survey Master (QSM) WordPress plugin before 11.2.4 does not perform a per-object ownership check before saving a quiz's front-end text settings, allowing users with contributor-level access and above to modify the text… | Low 2.7 | |
| CVE-2026-13173 | The Eventin WordPress plugin before 4.1.21 does not verify the current user's permission to edit other users before assigning roles and updating user metadata during speaker creation, allowing users with contributor-level access and… | Low 2.7 | |
| CVE-2026-76042 | Use of uninitialized resource in GPU in Google Chrome prior to 151.0.7922.169 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. | Low 3.1 | |
| CVE-2026-73923 | The supported version that is affected is 1.4.20. | Low 3.7 | |
| CVE-2026-71146 | The supported version that is affected is 11.2.25.0.000. | Low 1.9 | |
| CVE-2026-71144 | The supported version that is affected is 11.2.25.0.000. | Low 3.0 | |
| CVE-2026-71140 | The supported version that is affected is 7.2.14. | Low 3.4 | |
| CVE-2026-71089 | The supported version that is affected is 3.6. | Low 3.3 | |
| CVE-2026-71083 | The supported version that is affected is 3.6. | Low 1.8 | |
| CVE-2026-71082 | The supported version that is affected is 3.6. | Low 2.5 | |
| CVE-2026-71081 | The supported version that is affected is 3.6. | Low 1.9 | |
| CVE-2026-71080 | The supported version that is affected is 3.6. | Low 3.7 | |
| CVE-2026-71072 | The supported version that is affected is 3.6. | Low 3.3 | |
| CVE-2026-70962 | The supported version that is affected is 11.2.25.0.000. | Low 3.3 | |
| CVE-2026-70919 | The supported version that is affected is 11.2.25.0.000. | Low 2.5 | |
| CVE-2026-70853 | The supported version that is affected is 11.2.25.0.000. | Low 3.3 | |
| CVE-2026-70851 | The supported version that is affected is 11.2.25.0.000. | Low 3.1 | |
| CVE-2026-70850 | The supported version that is affected is 11.2.25.0.000. | Low 3.0 | |
| CVE-2026-70848 | The supported version that is affected is 11.2.25.0.000. | Low 3.7 | |
| CVE-2026-70785 | The supported version that is affected is 11.2.25.0.000. | Low 3.7 | |
| CVE-2026-70776 | The supported version that is affected is 11.2.25.0.000. | Low 2.6 | |
| CVE-2026-70711 | The supported version that is affected is 11.2.25.0.000. | Low 3.6 | |
| CVE-2026-70682 | The supported version that is affected is 11.2.25.0.000. | Low 3.7 | |
| CVE-2026-67442 | Prior to 1.3.3, DELETE /api/roles removes role definitions through server/runtime/users/usrstorage.js but does not remove the deleted role identifier from each… | Low 2.0 | |
| CVE-2026-62606 | The supported version that is affected is 11.2.25.0.000. | Low 3.1 | |
| CVE-2026-62604 | The supported version that is affected is 11.2.25.0.000. | Low 3.1 | |
| CVE-2026-62583 | The supported version that is affected is 11.2.25.0.000. | Low 3.0 | |
| CVE-2026-62580 | The supported version that is affected is 11.2.25.0.000. | Low 2.6 | |
| CVE-2026-62577 | The supported version that is affected is 11.2.25.0.000. | Low 3.3 | |
| CVE-2026-62570 | The supported version that is affected is 11.2.25.0.000. | Low 3.0 | |
| CVE-2026-62569 | The supported version that is affected is 11.2.25.0.000. | Low 3.4 | |
| CVE-2026-62533 | The supported version that is affected is 11.2.25.0.000. | Low 3.7 | |
| CVE-2026-62532 | The supported version that is affected is 11.2.25.0.000. | Low 3.8 | |
| CVE-2026-62529 | The supported version that is affected is 11.2.25.0.000. | Low 3.5 | |
| CVE-2026-62526 | The supported version that is affected is 11.2.25.0.000. | Low 3.3 | |
| CVE-2026-62511 | The supported version that is affected is 11.2.25.0.000. | Low 3.0 |
Showing 951–1,000 of 11,320. Narrow the filters to see the rest.
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status. Filter by severity and year here; the other filters work on the curated lists.