Vulnerability Intelligence · All CVEs
Every Published CVE, Searchable.
Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status.
Synced hourly · figures as of Oct 20, 2026
138,429 vulnerabilities · newest first
- CVE-2026-110611Medium 6.0REBUILD through 4.5.0 contains an authorization bypass vulnerability in AiBot2Controller /aibot2 endpoints that act on a caller-supplied chatid without verifying ownership.Published Oct 14, 2026
- CVE-2026-110610Medium 5.3ruoyi-vue-pro through 2026.09 contains a server-side request forgery vulnerability in the yudao-module-ai image service that allows authenticated users to make the server fetch arbitrary URLs by supplying referImageUrl to the midjourney…Published Oct 14, 2026
- CVE-2026-110608Medium 5.3BizSpring Shop through commit cf22d39daaf1 contains an insecure direct object reference vulnerability in the OrderController cancel and receive handlers that allows authenticated members to act on other members' orders by supplying their…Published Oct 14, 2026
- CVE-2026-110606Medium 4.8LibreCAD libdxfrw through LC2.2.0 (LibreCAD through 2.2.1.5) contains a stack-based out-of-bounds read vulnerability in dwgReader18::readFileHeader() caused by calling strlen on non-NUL-terminated buffers.Published Oct 14, 2026
- CVE-2026-110605Medium 6.8libschrift through 0.10.2 contains a divide by zero vulnerability that allows attackers to crash applications by supplying a font with unitsPerEm of 0 in the head table.Published Oct 14, 2026
- CVE-2026-110603Medium 5.8LASzip through 3.5.0 contains an invalid free vulnerability in laszip_read_header() that allows attackers to free uninitialized heap pointers via truncated variable length record data.Published Oct 14, 2026
- CVE-2026-110602Medium 5.8libmspack through 0.11alpha contains an uninitialized pointer free vulnerability in kwajd_open() in mspack/kwajd.c that frees unzeroed filename and extra pointers on header read errors.Published Oct 14, 2026
- CVE-2026-110601Medium 5.8libsixel before 1.8.7-r1 and 1.9.0 through 1.10.5 contains a heap out-of-bounds write vulnerability in gif_init_frame() in src/fromgif.c, which never checks the GIF transparent color index against the palette size.Published Oct 14, 2026
- CVE-2026-110600Medium 6.8xlsxio through 0.2.37 contains a NULL pointer dereference vulnerability in main_sheet_get_sheetfile_expat_callback_element_start() in lib/xlsxio_read.c that allows attackers to crash applications via crafted files.Published Oct 14, 2026
- CVE-2026-110599Medium 6.9L-SMASH through 2.14.5 contains a double free vulnerability in hevc_setup_first_summary() and h264_setup_first_summary() in importer/nalu_imp.c that frees borrowed codec-specific objects on error paths.Published Oct 14, 2026
- CVE-2026-110598Medium 6.9Libyal libpff through 20260926 contains an integer underflow in libpff_record_entry_get_multi_value() that allows attackers to trigger heap out-of-bounds reads via non-monotonic multi-value offsets.Published Oct 14, 2026
- CVE-2026-110597Medium 6.9Tinyexr through 3.2.0 contains a heap out-of-bounds read vulnerability in ParseEXRMultipartHeaderFromMemory() that allows attackers to read beyond buffers due to a stale remaining-size value.Published Oct 14, 2026
- CVE-2026-110596Medium 6.8quirc through 1.2 contains an excessive-iteration vulnerability in find_alignment_pattern() in lib/identify.c that allows attackers to hang quirc_end() with a crafted image.Published Oct 14, 2026
- CVE-2026-110595Medium 5.3BottleCRM 0.45 through 1.14.5 contains an uncontrolled memory allocation vulnerability in _read_upload() that reads entire CSV uploads before enforcing the 5 MB limit.Published Oct 14, 2026
- CVE-2026-110594Medium 6.9BottleCRM 0.43 through 1.14.5 contains a regular expression denial of service vulnerability that allows authenticated organization administrators to block web workers via unbounded routing rule regex patterns.Published Oct 14, 2026
- CVE-2026-110593Medium 5.3BottleCRM through 1.14.5 contains a server-side template injection vulnerability in the send_email Celery task, which compiles the user-supplied AccountEmail message_body with django.template.Template().Published Oct 14, 2026
- CVE-2026-110592Medium 5.1BottleCRM 0.30 through 1.14.5 contains an HTML injection vulnerability in render_invoice_template() that allows authenticated organization members to inject markup into custom-template invoice PDFs.Published Oct 14, 2026
- CVE-2026-110591Medium 6.8OW2 ASM 1.4.3 before 9.11 contains an excessive resource consumption vulnerability in Analyzer.analyze() that allows attackers to exhaust memory and CPU via crafted class files.Published Oct 14, 2026
- CVE-2026-110270Medium 6.8OW2 ASM 3.0 before 9.11 contains an uncontrolled memory allocation vulnerability in the asm-commons JSRInlinerAdapter that inlines JSR/RET subroutines without memory or work limits.Published Oct 14, 2026
- CVE-2026-110263Medium 6.8OW2 ASM 3.0 before 9.11 contains an uncontrolled recursion vulnerability in SignatureReader.parseType() that allows attackers to exhaust the stack via deeply nested generic type signatures.Published Oct 14, 2026
- CVE-2026-110262Medium 4.8OW2 ASM 3.1 before 9.11 contains an excessive memory allocation vulnerability in the asm-commons AdviceAdapter that allows attackers to exhaust memory by supplying crafted class files.Published Oct 14, 2026
- CVE-2026-110261Medium 6.8OW2 ASM 3.0 before 9.11 contains a denial of service vulnerability that allows attackers to exhaust CPU by supplying crafted class files processed with ClassWriter.COMPUTE_FRAMES.Published Oct 14, 2026
- CVE-2026-110260Medium 6.8OW2 ASM 3.0 before 9.11 contains a quadratic memory allocation vulnerability in MethodWriter.computeMaxStackAndLocal() and computeAllFrames() when using COMPUTE_MAXS or COMPUTE_FRAMES.Published Oct 14, 2026
- CVE-2026-110259Medium 6.8OW2 ASM 3.0 before 9.11 contains an uncontrolled recursion vulnerability in ClassWriter.replaceAsmInstructions() that allows attackers to cause denial of service through crafted class files.Published Oct 14, 2026
- CVE-2026-110258Medium 6.8OW2 ASM 3.0 before 9.11 contains an excessive memory allocation vulnerability in Label.addSubroutineRetSuccessors() that fails to enforce the single-RET-per-JSR rule.Published Oct 14, 2026
- CVE-2026-110257Medium 6.8OW2 ASM 5.0 before 9.11 contains an excessive memory allocation vulnerability in ClassReader.readBootstrapMethodsAttribute() that sizes an int array from num_bootstrap_methods without validating attribute_length.Published Oct 14, 2026
- CVE-2026-101025Medium 6.9NGINX JavaScript (njs) has a vulnerability where the built-in njs engine leaks a libxml2 parser context when xml.parse() fails.Published Oct 14, 2026
- CVE-2024-58392Medium 4.8PhysicsFS through 3.2.0 contains an out-of-bounds read vulnerability in PHYSFS_utf8codepoint() that allows attackers to read past name buffers via an off-by-one cursor advance on six-octet UTF-8 sequences.Published Oct 14, 2026
- CVE-2026-35161Medium 5.3Dell PowerScale InsightIQ, versions 5.2.0 through 6.3.0, contains an Overly Restrictive Account Lockout Mechanism vulnerability.Published Oct 14, 2026
- CVE-2026-104086Medium 6.87-Zip before 26.03 contains an uninitialized memory disclosure vulnerability in the SquashFS v4 archive handler (SquashfsHandler.cpp) that allows attackers to leak heap memory by crafting a malicious archive where the superblock’s no_ids…Published Oct 14, 2026
- CVE-2016-20099Medium 6.8L-SMASH through 2.14.5 Infinite Loop in VC-1 Importer ProbePublished Oct 14, 2026
- CVE-2026-94348Medium 6.1Dell PowerScale InsightIQ, versions 5.2.0 through 6.3.0, contains an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability.Published Oct 14, 2026
- CVE-2026-101215Medium 6.6Dell Unisphere for PowerMax vApp, version(s) 9.2.4.x, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability.Published Oct 14, 2026
- CVE-2026-101217Medium 6.5Dell Unisphere for PowerMax vApp, version(s) 9.2.4.x, contain(s) an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability.Published Oct 14, 2026
- CVE-2026-101216Medium 6.6Dell Unisphere for PowerMax vApp, version(s) 9.2.4.x, contain(s) an Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability.Published Oct 14, 2026
- CVE-2026-107417Medium 6.5Missing Authorization vulnerability in Muralidharan Ramasamy Push Notification for Post and BuddyPress push-notification-for-post-and-buddypress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects…Published Oct 14, 2026
- CVE-2026-110652Medium 6.3ONLYOFFICE DocumentServer before 10.0.0 SSRF via downloadfile isInJwtToken BypassPublished Oct 14, 2026
- CVE-2026-109968Medium 5.5Clevis: clevis: pkcs#11 luks passphrase logged in plaintext to world-readable filePublished Oct 14, 2026
- CVE-2026-107425Medium 6.5WordPress Bus Ticket Booking with Seat Reservation plugin <= 5.9.7 - Broken Access Control vulnerabilityPublished Oct 14, 2026
- CVE-2026-107422Medium 6.5WordPress WP w3all phpBB plugin <= 3.1.0 - Cross Site Scripting (XSS) vulnerabilityPublished Oct 14, 2026
- CVE-2026-107433Medium 6.5WordPress WP OAuth Server plugin <= 6.4.0 - Broken Access Control vulnerabilityPublished Oct 14, 2026
- CVE-2026-73797Medium 5.3HPE NonStop TSQLFIL - Memory corruption vulnerabilityPublished Oct 14, 2026
- CVE-2026-73796Medium 4.4A security vulnerability in HPE NonStop TSQLEXE may cause application crash via a crafted SQL query.Published Oct 14, 2026
- CVE-2026-108072Medium 5.4Vulnerability due to incorrect permissions in TSplus Remote Access shared login scripts.Published Oct 14, 2026
- CVE-2026-97315Medium 5.4Responsive Blocks < 2.3.0 - Unauthenticated HTML Injection in Form Notification EmailPublished Oct 14, 2026
- CVE-2026-88998Medium 5.3Tickera < 3.6.0.4 - Unauthenticated Order Payment Bypass via 2Checkout IPNPublished Oct 14, 2026
- CVE-2026-82844Medium 5.3WPForms Lite 1.10.0.1 - 2.0.2.1 - Unauthenticated Payment Bypass via PayPal CommercePublished Oct 14, 2026
- CVE-2026-103308Medium 6.5Visma Pay for WooCommerce < 1.2.2 - Unauthenticated Payment Bypass and Order Data Disclosure via Gateway Return EndpointPublished Oct 14, 2026
- CVE-2026-101301Medium 5.3WPCode 2.0.0 - 2.3.9 - Unauthenticated Snippet Suppression via Safe Mode BypassPublished Oct 14, 2026
- CVE-2026-73795Medium 6.4HPE NonStop TMF Auditread2 - Denial of Service vulnerabilityPublished Oct 14, 2026
| CVE | Title | Severity | Published |
|---|---|---|---|
| CVE-2026-110611 | REBUILD through 4.5.0 contains an authorization bypass vulnerability in AiBot2Controller /aibot2 endpoints that act on a caller-supplied chatid without verifying ownership. | Medium 6.0 | |
| CVE-2026-110610 | ruoyi-vue-pro through 2026.09 contains a server-side request forgery vulnerability in the yudao-module-ai image service that allows authenticated users to make the server fetch arbitrary URLs by supplying referImageUrl to the midjourney… | Medium 5.3 | |
| CVE-2026-110608 | BizSpring Shop through commit cf22d39daaf1 contains an insecure direct object reference vulnerability in the OrderController cancel and receive handlers that allows authenticated members to act on other members' orders by supplying their… | Medium 5.3 | |
| CVE-2026-110606 | LibreCAD libdxfrw through LC2.2.0 (LibreCAD through 2.2.1.5) contains a stack-based out-of-bounds read vulnerability in dwgReader18::readFileHeader() caused by calling strlen on non-NUL-terminated buffers. | Medium 4.8 | |
| CVE-2026-110605 | libschrift through 0.10.2 contains a divide by zero vulnerability that allows attackers to crash applications by supplying a font with unitsPerEm of 0 in the head table. | Medium 6.8 | |
| CVE-2026-110603 | LASzip through 3.5.0 contains an invalid free vulnerability in laszip_read_header() that allows attackers to free uninitialized heap pointers via truncated variable length record data. | Medium 5.8 | |
| CVE-2026-110602 | libmspack through 0.11alpha contains an uninitialized pointer free vulnerability in kwajd_open() in mspack/kwajd.c that frees unzeroed filename and extra pointers on header read errors. | Medium 5.8 | |
| CVE-2026-110601 | libsixel before 1.8.7-r1 and 1.9.0 through 1.10.5 contains a heap out-of-bounds write vulnerability in gif_init_frame() in src/fromgif.c, which never checks the GIF transparent color index against the palette size. | Medium 5.8 | |
| CVE-2026-110600 | xlsxio through 0.2.37 contains a NULL pointer dereference vulnerability in main_sheet_get_sheetfile_expat_callback_element_start() in lib/xlsxio_read.c that allows attackers to crash applications via crafted files. | Medium 6.8 | |
| CVE-2026-110599 | L-SMASH through 2.14.5 contains a double free vulnerability in hevc_setup_first_summary() and h264_setup_first_summary() in importer/nalu_imp.c that frees borrowed codec-specific objects on error paths. | Medium 6.9 | |
| CVE-2026-110598 | Libyal libpff through 20260926 contains an integer underflow in libpff_record_entry_get_multi_value() that allows attackers to trigger heap out-of-bounds reads via non-monotonic multi-value offsets. | Medium 6.9 | |
| CVE-2026-110597 | Tinyexr through 3.2.0 contains a heap out-of-bounds read vulnerability in ParseEXRMultipartHeaderFromMemory() that allows attackers to read beyond buffers due to a stale remaining-size value. | Medium 6.9 | |
| CVE-2026-110596 | quirc through 1.2 contains an excessive-iteration vulnerability in find_alignment_pattern() in lib/identify.c that allows attackers to hang quirc_end() with a crafted image. | Medium 6.8 | |
| CVE-2026-110595 | BottleCRM 0.45 through 1.14.5 contains an uncontrolled memory allocation vulnerability in _read_upload() that reads entire CSV uploads before enforcing the 5 MB limit. | Medium 5.3 | |
| CVE-2026-110594 | BottleCRM 0.43 through 1.14.5 contains a regular expression denial of service vulnerability that allows authenticated organization administrators to block web workers via unbounded routing rule regex patterns. | Medium 6.9 | |
| CVE-2026-110593 | BottleCRM through 1.14.5 contains a server-side template injection vulnerability in the send_email Celery task, which compiles the user-supplied AccountEmail message_body with django.template.Template(). | Medium 5.3 | |
| CVE-2026-110592 | BottleCRM 0.30 through 1.14.5 contains an HTML injection vulnerability in render_invoice_template() that allows authenticated organization members to inject markup into custom-template invoice PDFs. | Medium 5.1 | |
| CVE-2026-110591 | OW2 ASM 1.4.3 before 9.11 contains an excessive resource consumption vulnerability in Analyzer.analyze() that allows attackers to exhaust memory and CPU via crafted class files. | Medium 6.8 | |
| CVE-2026-110270 | OW2 ASM 3.0 before 9.11 contains an uncontrolled memory allocation vulnerability in the asm-commons JSRInlinerAdapter that inlines JSR/RET subroutines without memory or work limits. | Medium 6.8 | |
| CVE-2026-110263 | OW2 ASM 3.0 before 9.11 contains an uncontrolled recursion vulnerability in SignatureReader.parseType() that allows attackers to exhaust the stack via deeply nested generic type signatures. | Medium 6.8 | |
| CVE-2026-110262 | OW2 ASM 3.1 before 9.11 contains an excessive memory allocation vulnerability in the asm-commons AdviceAdapter that allows attackers to exhaust memory by supplying crafted class files. | Medium 4.8 | |
| CVE-2026-110261 | OW2 ASM 3.0 before 9.11 contains a denial of service vulnerability that allows attackers to exhaust CPU by supplying crafted class files processed with ClassWriter.COMPUTE_FRAMES. | Medium 6.8 | |
| CVE-2026-110260 | OW2 ASM 3.0 before 9.11 contains a quadratic memory allocation vulnerability in MethodWriter.computeMaxStackAndLocal() and computeAllFrames() when using COMPUTE_MAXS or COMPUTE_FRAMES. | Medium 6.8 | |
| CVE-2026-110259 | OW2 ASM 3.0 before 9.11 contains an uncontrolled recursion vulnerability in ClassWriter.replaceAsmInstructions() that allows attackers to cause denial of service through crafted class files. | Medium 6.8 | |
| CVE-2026-110258 | OW2 ASM 3.0 before 9.11 contains an excessive memory allocation vulnerability in Label.addSubroutineRetSuccessors() that fails to enforce the single-RET-per-JSR rule. | Medium 6.8 | |
| CVE-2026-110257 | OW2 ASM 5.0 before 9.11 contains an excessive memory allocation vulnerability in ClassReader.readBootstrapMethodsAttribute() that sizes an int array from num_bootstrap_methods without validating attribute_length. | Medium 6.8 | |
| CVE-2026-101025 | NGINX JavaScript (njs) has a vulnerability where the built-in njs engine leaks a libxml2 parser context when xml.parse() fails. | Medium 6.9 | |
| CVE-2024-58392 | PhysicsFS through 3.2.0 contains an out-of-bounds read vulnerability in PHYSFS_utf8codepoint() that allows attackers to read past name buffers via an off-by-one cursor advance on six-octet UTF-8 sequences. | Medium 4.8 | |
| CVE-2026-35161 | Dell PowerScale InsightIQ, versions 5.2.0 through 6.3.0, contains an Overly Restrictive Account Lockout Mechanism vulnerability. | Medium 5.3 | |
| CVE-2026-104086 | 7-Zip before 26.03 contains an uninitialized memory disclosure vulnerability in the SquashFS v4 archive handler (SquashfsHandler.cpp) that allows attackers to leak heap memory by crafting a malicious archive where the superblock’s no_ids… | Medium 6.8 | |
| CVE-2016-20099 | L-SMASH through 2.14.5 Infinite Loop in VC-1 Importer Probe | Medium 6.8 | |
| CVE-2026-94348 | Dell PowerScale InsightIQ, versions 5.2.0 through 6.3.0, contains an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. | Medium 6.1 | |
| CVE-2026-101215 | Dell Unisphere for PowerMax vApp, version(s) 9.2.4.x, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. | Medium 6.6 | |
| CVE-2026-101217 | Dell Unisphere for PowerMax vApp, version(s) 9.2.4.x, contain(s) an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. | Medium 6.5 | |
| CVE-2026-101216 | Dell Unisphere for PowerMax vApp, version(s) 9.2.4.x, contain(s) an Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability. | Medium 6.6 | |
| CVE-2026-107417 | Missing Authorization vulnerability in Muralidharan Ramasamy Push Notification for Post and BuddyPress push-notification-for-post-and-buddypress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… | Medium 6.5 | |
| CVE-2026-110652 | ONLYOFFICE DocumentServer before 10.0.0 SSRF via downloadfile isInJwtToken Bypass | Medium 6.3 | |
| CVE-2026-109968 | Clevis: clevis: pkcs#11 luks passphrase logged in plaintext to world-readable file | Medium 5.5 | |
| CVE-2026-107425 | WordPress Bus Ticket Booking with Seat Reservation plugin <= 5.9.7 - Broken Access Control vulnerability | Medium 6.5 | |
| CVE-2026-107422 | WordPress WP w3all phpBB plugin <= 3.1.0 - Cross Site Scripting (XSS) vulnerability | Medium 6.5 | |
| CVE-2026-107433 | WordPress WP OAuth Server plugin <= 6.4.0 - Broken Access Control vulnerability | Medium 6.5 | |
| CVE-2026-73797 | HPE NonStop TSQLFIL - Memory corruption vulnerability | Medium 5.3 | |
| CVE-2026-73796 | A security vulnerability in HPE NonStop TSQLEXE may cause application crash via a crafted SQL query. | Medium 4.4 | |
| CVE-2026-108072 | Vulnerability due to incorrect permissions in TSplus Remote Access shared login scripts. | Medium 5.4 | |
| CVE-2026-97315 | Responsive Blocks < 2.3.0 - Unauthenticated HTML Injection in Form Notification Email | Medium 5.4 | |
| CVE-2026-88998 | Tickera < 3.6.0.4 - Unauthenticated Order Payment Bypass via 2Checkout IPN | Medium 5.3 | |
| CVE-2026-82844 | WPForms Lite 1.10.0.1 - 2.0.2.1 - Unauthenticated Payment Bypass via PayPal Commerce | Medium 5.3 | |
| CVE-2026-103308 | Visma Pay for WooCommerce < 1.2.2 - Unauthenticated Payment Bypass and Order Data Disclosure via Gateway Return Endpoint | Medium 6.5 | |
| CVE-2026-101301 | WPCode 2.0.0 - 2.3.9 - Unauthenticated Snippet Suppression via Safe Mode Bypass | Medium 5.3 | |
| CVE-2026-73795 | HPE NonStop TMF Auditread2 - Denial of Service vulnerability | Medium 6.4 |
Showing 951–1,000 of 138,429. Narrow the filters to see the rest.
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status. Filter by severity and year here; the other filters work on the curated lists.