Vulnerability Intelligence · All CVEs
Every Published CVE, Searchable.
Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status.
Synced hourly · figures as of Oct 19, 2026
40,398 vulnerabilities · newest first
- CVE-2026-93483Critical 9.5In Znuny through 7.3.6, an attacker can bypass specific standard login procedures and gain unauthorized access to sensitive system functions by manipulating a specific HTTP request header.Published Oct 15, 2026
- CVE-2026-110911Critical 9.8Wheels 1.1.8 through 4.1.1 allows SQL injection when caller-supplied quoted values are parsed again as SQL by dynamic finders (such as findOneByEmail), the query builder's where(property, value) and where(property, operator, value),…Published Oct 15, 2026
- CVE-2026-110867Critical 9.0Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repositories to set restricted environment variables by placing env inside a shared preset.Published Oct 14, 2026
- CVE-2026-110864Critical 9.1Better Auth from 1.5.0-beta.12 before 1.7.7 contains an authentication bypass vulnerability in the OAuth Proxy plugin that allows unauthenticated attackers to sign in as other users by forging encrypted profiles.Published Oct 14, 2026
- CVE-2026-110862Critical 9.3Better Auth from 1.4.0-beta.18 before 1.7.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to sign in as other users by reusing OAuth state values as Magic Link tokens.Published Oct 14, 2026
- CVE-2026-110858Critical 9.2GitPython from 3.1.30 before 3.2.0 contains a remote code execution vulnerability in Remote.pull() whose unsafe-option guard inspects only keyword arguments, not the positional refspec.Published Oct 14, 2026
- CVE-2026-108336Critical 9.1When the default self-signed certificate is used, an attacker could gain administrative access to the application.Published Oct 14, 2026
- CVE-2026-108335Critical 9.1When the password reset functionality is enabled, and email is configured, an attacker could take over any account using a brute-force attack.Published Oct 14, 2026
- CVE-2026-55684Critical 9.8Prior to 3.8.6, the unauthenticated web/html/socio/sistema/cadastro_cobrancas_geracao.php endpoint accepts form-encoded POST data through extract($_REQUEST) and interpolates codigo,…Published Oct 14, 2026
- CVE-2026-55683Critical 9.8Prior to 3.8.6, the unauthenticated web/html/socio/sistema/cadastro_cobranca.php endpoint accepts POST input through extract($_REQUEST) and directly incorporates valor, valor_pago,…Published Oct 14, 2026
- CVE-2026-55680Critical 9.8Prior to 3.8.6, unauthenticated POST requests to web/html/socio/sistema/cadastro_cobranca.php can place a quoted SQL expression in the codigo parameter, which extract($_REQUEST) passes…Published Oct 14, 2026
- CVE-2026-85714Critical 9.1Prior to 2.13.2, an authenticated administrator using the default H2 database and security mode can upload a crafted SQL file to POST…Published Oct 14, 2026
- CVE-2026-110770Critical 9.2Databasus 3.7.0 through 3.61.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to brute-force password reset codes via POST /api/v1/users/reset-password.Published Oct 14, 2026
- CVE-2026-110536Critical 10.0A vulnerability was determined in D-Link DIR-868L 2.01b05.Published Oct 14, 2026
- CVE-2026-102748Critical 9.2Prior to 25.4.0, Dgraph Zero registers administrative HTTP routes on port 6080 without authentication when the administrative interface is enabled.Published Oct 14, 2026
- CVE-2026-92152Critical 9.3From 4.1.0 until 4.2.0, Svc::GenericHub output-port dispatch is vulnerable because the deserialized port field is…Published Oct 14, 2026
- CVE-2026-77371Critical 9.3From 26.0.0 until 26.9.0, the DuckDB query runner's _connect() path in redash/query_runner/duckdb.py created connections with enable_external_access left at its default value of true.Published Oct 14, 2026
- CVE-2026-55573Critical 9.8Prior to 2.3.7, install.php decodes the attacker-controlled previous_steps POST parameter and passes it to unserialize() at file scope and again in the e_install constructor without restricting…Published Oct 14, 2026
- CVE-2026-55572Critical 10.0Prior to 2.3.7, the bundled alt_auth plugin's otherdb and e107db authentication backends interpolate the submitted login username directly into SQL in e107_plugins/alt_auth/otherdb_auth.php and…Published Oct 14, 2026
- CVE-2026-108390Critical 9.9From version 1.9.7 through 1.10.4, update_object_value() in func/main.sh does not escape single quotes when writing a custom document-root value to a…Published Oct 14, 2026
- CVE-2026-103415Critical 9.3When a TLS 1.3 client processes a HelloRetryRequest, it copies the server's cookie into its second ClientHello without checking that the cookie fits in the outgoing packet.Published Oct 14, 2026
- CVE-2026-102476Critical 9.1In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x HTTP client relies on an SSL context for efficiency purpose, the key of this cache should reflect entirely the SSL semantics of the desired SSL…Published Oct 14, 2026
- CVE-2026-101983Critical 9.3A Stack-based Buffer Overflow vulnerability in the httpd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network attacker to cause remote code execution and denial of service via a J-Web virtual-domain…Published Oct 14, 2026
- CVE-2026-101982Critical 9.3A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP/EVPN peer to cause root code execution on Junos OS or an rpd crash on Junos OS…Published Oct 14, 2026
- CVE-2026-101954Critical 9.3An Improper Authentication vulnerability in the J-Web management interface and its NETCONF session handling of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network attacker to obtain root-level device…Published Oct 14, 2026
- CVE-2026-33796Critical 9.3Junos OS and Junos OS Evolved: An attacker causes remote root command execution when BMP route monitoring is enabledPublished Oct 14, 2026
- CVE-2026-33792Critical 9.3Junos OS: SRX Series: An attacker causes remote code execution and denial of service when a GRE tunnel is configuredPublished Oct 14, 2026
- CVE-2026-33789Critical 9.2Junos OS and Junos OS Evolved: With BGP Monitoring Protocol is enabled, receipt of a specifically crafted BGP route update results in denial of servicePublished Oct 14, 2026
- CVE-2026-102182Critical 9.3Junos OS: MX Series: Certificate-based IKE packets cause root-level code executionPublished Oct 14, 2026
- CVE-2026-102178Critical 9.3Junos OS and Junos OS Evolved: When BGP update-threading is enabled a specifically malformed flowspec NLRI causes routing-engine compromisePublished Oct 14, 2026
- CVE-2026-102175Critical 9.3Junos OS and Junos OS Evolved: An attacker causes remote code execution or denial of service when service-deployment processing is usedPublished Oct 14, 2026
- CVE-2026-102037Critical 9.2Junos OS: SRX Series: An attacker causes arbitrary configuration commit when the custom URL-feed feature is usedPublished Oct 14, 2026
- CVE-2026-102031Critical 9.3Junos OS Evolved: A low-privileged TACACS+ user causes root command execution when authorization refresh is enabledPublished Oct 14, 2026
- CVE-2026-109439Critical 9.3Lantronix XPress-DR 8.1.0.0 Unauthenticated Configuration Write via UDP 30718Published Oct 14, 2026
- CVE-2026-101990Critical 9.3Junos OS and Junos OS Evolved: A BGP peer causes an rpd crash when flow-spec routes are re-advertisedPublished Oct 14, 2026
- CVE-2026-101950Critical 9.3Junos OS: SRX Series: Malformed IPv4 packets cause packet-forwarding process crash when Secure Vector Routing is enabledPublished Oct 14, 2026
- CVE-2026-101955Critical 9.2Junos OS: SRX Series: Malformed DNS packet causes service disruption when UTM Anti-Spam SBL is usedPublished Oct 14, 2026
- CVE-2026-101997Critical 9.2Junos OS: SRX Series: A network-based attacker causes Remote Code Execution when Security Intelligence is used without a tls-profile authenticationPublished Oct 14, 2026
- CVE-2026-102062Critical 9.2Junos OS: SRX Series: An compromised HTTPS feed server can cause remote code execution when Security Intelligence is usedPublished Oct 14, 2026
- CVE-2026-102084Critical 9.2Junos OS: SRX Series: In an ADVPN scenario a malformed message from a peer causes Remote Code ExecutionPublished Oct 14, 2026
- CVE-2026-101986Critical 9.3Junos OS and Junos OS Evolved: J-Web permits pre-authentication CGI executionPublished Oct 14, 2026
- CVE-2026-101956Critical 9.3Junos OS: Unauthorized root command execution when J-Web is enabledPublished Oct 14, 2026
- CVE-2026-91881Critical 9.0Dell Terraform Provider for Redfish, versions prior to 1.6.2, contains an Improper Certificate Validation vulnerability in the HTTP transport component.Published Oct 14, 2026
- CVE-2026-89073Critical 9.8Insufficient Session Expiration vulnerability in Progress MOVEit Transfer.Published Oct 14, 2026
- CVE-2026-89068Critical 9.8Missing critical step in authentication vulnerability in Progress MOVEit Transfer (LDAP module).Published Oct 14, 2026
- CVE-2026-86002Critical 9.0In Dokku versions before 0.38.25, a user with app-level Dokku access and remote SSH access to execute docker-options commands can store arbitrary strings through the docker-options plugin,…Published Oct 14, 2026
- CVE-2026-101980Critical 9.3Junos OS: Malformed Extended Echo requests cause a Routing Engine reboot when Extended Echo is enabledPublished Oct 14, 2026
- CVE-2026-102893Critical 9.1In Zulip Server versions through 12.1, GenericOpenIdConnectBackend matches the identity provider email claim to an active account's delivery_email without rejecting an explicitly false…Published Oct 14, 2026
- CVE-2026-102070Critical 9.2Junos OS: A remote TWAMP peer causes rmopd service disruption when TWAMP-Control is usedPublished Oct 14, 2026
- CVE-2026-77524Critical 9.9KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthenticationPublished Oct 14, 2026
| CVE | Title | Severity | Published |
|---|---|---|---|
| CVE-2026-93483 | In Znuny through 7.3.6, an attacker can bypass specific standard login procedures and gain unauthorized access to sensitive system functions by manipulating a specific HTTP request header. | Critical 9.5 | |
| CVE-2026-110911 | Wheels 1.1.8 through 4.1.1 allows SQL injection when caller-supplied quoted values are parsed again as SQL by dynamic finders (such as findOneByEmail), the query builder's where(property, value) and where(property, operator, value),… | Critical 9.8 | |
| CVE-2026-110867 | Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repositories to set restricted environment variables by placing env inside a shared preset. | Critical 9.0 | |
| CVE-2026-110864 | Better Auth from 1.5.0-beta.12 before 1.7.7 contains an authentication bypass vulnerability in the OAuth Proxy plugin that allows unauthenticated attackers to sign in as other users by forging encrypted profiles. | Critical 9.1 | |
| CVE-2026-110862 | Better Auth from 1.4.0-beta.18 before 1.7.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to sign in as other users by reusing OAuth state values as Magic Link tokens. | Critical 9.3 | |
| CVE-2026-110858 | GitPython from 3.1.30 before 3.2.0 contains a remote code execution vulnerability in Remote.pull() whose unsafe-option guard inspects only keyword arguments, not the positional refspec. | Critical 9.2 | |
| CVE-2026-108336 | When the default self-signed certificate is used, an attacker could gain administrative access to the application. | Critical 9.1 | |
| CVE-2026-108335 | When the password reset functionality is enabled, and email is configured, an attacker could take over any account using a brute-force attack. | Critical 9.1 | |
| CVE-2026-55684 | Prior to 3.8.6, the unauthenticated web/html/socio/sistema/cadastro_cobrancas_geracao.php endpoint accepts form-encoded POST data through extract($_REQUEST) and interpolates codigo,… | Critical 9.8 | |
| CVE-2026-55683 | Prior to 3.8.6, the unauthenticated web/html/socio/sistema/cadastro_cobranca.php endpoint accepts POST input through extract($_REQUEST) and directly incorporates valor, valor_pago,… | Critical 9.8 | |
| CVE-2026-55680 | Prior to 3.8.6, unauthenticated POST requests to web/html/socio/sistema/cadastro_cobranca.php can place a quoted SQL expression in the codigo parameter, which extract($_REQUEST) passes… | Critical 9.8 | |
| CVE-2026-85714 | Prior to 2.13.2, an authenticated administrator using the default H2 database and security mode can upload a crafted SQL file to POST… | Critical 9.1 | |
| CVE-2026-110770 | Databasus 3.7.0 through 3.61.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to brute-force password reset codes via POST /api/v1/users/reset-password. | Critical 9.2 | |
| CVE-2026-110536 | A vulnerability was determined in D-Link DIR-868L 2.01b05. | Critical 10.0 | |
| CVE-2026-102748 | Prior to 25.4.0, Dgraph Zero registers administrative HTTP routes on port 6080 without authentication when the administrative interface is enabled. | Critical 9.2 | |
| CVE-2026-92152 | From 4.1.0 until 4.2.0, Svc::GenericHub output-port dispatch is vulnerable because the deserialized port field is… | Critical 9.3 | |
| CVE-2026-77371 | From 26.0.0 until 26.9.0, the DuckDB query runner's _connect() path in redash/query_runner/duckdb.py created connections with enable_external_access left at its default value of true. | Critical 9.3 | |
| CVE-2026-55573 | Prior to 2.3.7, install.php decodes the attacker-controlled previous_steps POST parameter and passes it to unserialize() at file scope and again in the e_install constructor without restricting… | Critical 9.8 | |
| CVE-2026-55572 | Prior to 2.3.7, the bundled alt_auth plugin's otherdb and e107db authentication backends interpolate the submitted login username directly into SQL in e107_plugins/alt_auth/otherdb_auth.php and… | Critical 10.0 | |
| CVE-2026-108390 | From version 1.9.7 through 1.10.4, update_object_value() in func/main.sh does not escape single quotes when writing a custom document-root value to a… | Critical 9.9 | |
| CVE-2026-103415 | When a TLS 1.3 client processes a HelloRetryRequest, it copies the server's cookie into its second ClientHello without checking that the cookie fits in the outgoing packet. | Critical 9.3 | |
| CVE-2026-102476 | In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x HTTP client relies on an SSL context for efficiency purpose, the key of this cache should reflect entirely the SSL semantics of the desired SSL… | Critical 9.1 | |
| CVE-2026-101983 | A Stack-based Buffer Overflow vulnerability in the httpd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network attacker to cause remote code execution and denial of service via a J-Web virtual-domain… | Critical 9.3 | |
| CVE-2026-101982 | A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP/EVPN peer to cause root code execution on Junos OS or an rpd crash on Junos OS… | Critical 9.3 | |
| CVE-2026-101954 | An Improper Authentication vulnerability in the J-Web management interface and its NETCONF session handling of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network attacker to obtain root-level device… | Critical 9.3 | |
| CVE-2026-33796 | Junos OS and Junos OS Evolved: An attacker causes remote root command execution when BMP route monitoring is enabled | Critical 9.3 | |
| CVE-2026-33792 | Junos OS: SRX Series: An attacker causes remote code execution and denial of service when a GRE tunnel is configured | Critical 9.3 | |
| CVE-2026-33789 | Junos OS and Junos OS Evolved: With BGP Monitoring Protocol is enabled, receipt of a specifically crafted BGP route update results in denial of service | Critical 9.2 | |
| CVE-2026-102182 | Junos OS: MX Series: Certificate-based IKE packets cause root-level code execution | Critical 9.3 | |
| CVE-2026-102178 | Junos OS and Junos OS Evolved: When BGP update-threading is enabled a specifically malformed flowspec NLRI causes routing-engine compromise | Critical 9.3 | |
| CVE-2026-102175 | Junos OS and Junos OS Evolved: An attacker causes remote code execution or denial of service when service-deployment processing is used | Critical 9.3 | |
| CVE-2026-102037 | Junos OS: SRX Series: An attacker causes arbitrary configuration commit when the custom URL-feed feature is used | Critical 9.2 | |
| CVE-2026-102031 | Junos OS Evolved: A low-privileged TACACS+ user causes root command execution when authorization refresh is enabled | Critical 9.3 | |
| CVE-2026-109439 | Lantronix XPress-DR 8.1.0.0 Unauthenticated Configuration Write via UDP 30718 | Critical 9.3 | |
| CVE-2026-101990 | Junos OS and Junos OS Evolved: A BGP peer causes an rpd crash when flow-spec routes are re-advertised | Critical 9.3 | |
| CVE-2026-101950 | Junos OS: SRX Series: Malformed IPv4 packets cause packet-forwarding process crash when Secure Vector Routing is enabled | Critical 9.3 | |
| CVE-2026-101955 | Junos OS: SRX Series: Malformed DNS packet causes service disruption when UTM Anti-Spam SBL is used | Critical 9.2 | |
| CVE-2026-101997 | Junos OS: SRX Series: A network-based attacker causes Remote Code Execution when Security Intelligence is used without a tls-profile authentication | Critical 9.2 | |
| CVE-2026-102062 | Junos OS: SRX Series: An compromised HTTPS feed server can cause remote code execution when Security Intelligence is used | Critical 9.2 | |
| CVE-2026-102084 | Junos OS: SRX Series: In an ADVPN scenario a malformed message from a peer causes Remote Code Execution | Critical 9.2 | |
| CVE-2026-101986 | Junos OS and Junos OS Evolved: J-Web permits pre-authentication CGI execution | Critical 9.3 | |
| CVE-2026-101956 | Junos OS: Unauthorized root command execution when J-Web is enabled | Critical 9.3 | |
| CVE-2026-91881 | Dell Terraform Provider for Redfish, versions prior to 1.6.2, contains an Improper Certificate Validation vulnerability in the HTTP transport component. | Critical 9.0 | |
| CVE-2026-89073 | Insufficient Session Expiration vulnerability in Progress MOVEit Transfer. | Critical 9.8 | |
| CVE-2026-89068 | Missing critical step in authentication vulnerability in Progress MOVEit Transfer (LDAP module). | Critical 9.8 | |
| CVE-2026-86002 | In Dokku versions before 0.38.25, a user with app-level Dokku access and remote SSH access to execute docker-options commands can store arbitrary strings through the docker-options plugin,… | Critical 9.0 | |
| CVE-2026-101980 | Junos OS: Malformed Extended Echo requests cause a Routing Engine reboot when Extended Echo is enabled | Critical 9.3 | |
| CVE-2026-102893 | In Zulip Server versions through 12.1, GenericOpenIdConnectBackend matches the identity provider email claim to an active account's delivery_email without rejecting an explicitly false… | Critical 9.1 | |
| CVE-2026-102070 | Junos OS: A remote TWAMP peer causes rmopd service disruption when TWAMP-Control is used | Critical 9.2 | |
| CVE-2026-77524 | KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthentication | Critical 9.9 |
Showing 101–150 of 40,398. Narrow the filters to see the rest.
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status. Filter by severity and year here; the other filters work on the curated lists.