Vulnerability Intelligence · All CVEs
Every Published CVE, Searchable.
Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status.
Synced hourly · figures as of Oct 19, 2026
11,289 vulnerabilities · newest first
- CVE-2026-109564Low 2.3LearnHouse before 1.4.0 Missing Authorization via Playground Duplicate EndpointPublished Oct 12, 2026
- CVE-2026-109561Low 2.3goose from 1.28.0 before 1.44.0 Manual Approval Bypass via Read-Only Tool AnnotationsPublished Oct 12, 2026
- CVE-2026-104364Low 3.3IBM® Db2® Denial of ServicePublished Oct 12, 2026
- CVE-2026-42689Low 3.7WordPress Events Manager plugin <= 7.4.7 - Race Condition vulnerabilityPublished Oct 12, 2026
- CVE-2026-105274Low 2.1hex_core decompresses registry and Erlang term API responses without size limitsPublished Oct 12, 2026
- CVE-2026-109332Low 2.3Network-AI before 5.15.2 CORS Origin Validation Error in MCP SSE TransportPublished Oct 12, 2026
- CVE-2026-109307Low 2.1Craft CMS 5.0.0 before 5.10.14 DOM XSS via returnUrl in 2FA VerificationPublished Oct 12, 2026
- CVE-2026-109285Low 2.3Open WebUI 0.6.0 before 0.11.4 Improper Access Control via Stale File MetadataPublished Oct 12, 2026
- CVE-2026-109282Low 2.0ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Undefined Behavior in INFO, JSON and YAML EncodersPublished Oct 12, 2026
- CVE-2026-109280Low 2.0ImageMagick 7.1.0-20 before 7.1.2-32 Use After Free via -fx OptionPublished Oct 12, 2026
- CVE-2026-109279Low 2.0ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Heap Buffer Overflow via Concurrent Security Policy AccessPublished Oct 12, 2026
- CVE-2026-109274Low 2.0ImageMagick before 7.1.2-32 TOCTOU Symlink Race Path Policy Bypass via magick scriptPublished Oct 12, 2026
- CVE-2026-109258Low 2.0ImageMagick 7.1.0-20 before 7.1.2-32 Invalid Memory Free in FX OperationPublished Oct 12, 2026
- CVE-2026-109247Low 2.1FreeRDP before 3.32.0 Path Traversal via Clipboard cFileNamePublished Oct 12, 2026
- CVE-2026-109241Low 2.3FreeRDP before 3.32.0 NULL Dereference in Video Redirection ChannelPublished Oct 12, 2026
- CVE-2026-109240Low 2.3FreeRDP 3.11.0 before 3.32.1 Reachable Assertion DoS via urb_isoch_transferPublished Oct 12, 2026
- CVE-2026-81856Low 2.3Terminal escape sequence injection in Hex via unneutralized server-supplied outputPublished Oct 12, 2026
- CVE-2026-96618Low 2.1Hex exhausts memory and disk on oversized or compressed responses from an untrusted mirrorPublished Oct 12, 2026
- CVE-2026-109195Low 3.1Quay: repository auto-prune policy uuid idor in quay apiPublished Oct 12, 2026
- CVE-2026-109396Low 2.3Thelia before 3.1.2 and 3.2.x before 3.2.1 CSV Formula Injection via ExportsPublished Oct 12, 2026
- CVE-2026-103526Low 3.7CVE-2026-103526Published Oct 12, 2026
- CVE-2026-105081Low 2.0ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 does not properly account for symbolic links in the IsRightsAuthorizedByName security policy check, allowing configured policy restrictions to be bypassed.Published Oct 12, 2026
- CVE-2026-108830Low 2.3A weakness has been identified in meetecho janus-gateway up to 1.4.2.Published Oct 12, 2026
- CVE-2026-108828Low 2.1Affected by this vulnerability is the function eval of the file admin/configuration.php of the component Admin Panel.Published Oct 12, 2026
- CVE-2026-108827Low 2.1A vulnerability was determined in Zen Cart up to 2.2.2.Published Oct 12, 2026
- CVE-2026-108808Low 2.1A vulnerability was determined in Eleveo Call Recording Software up to 10.3.0.Published Oct 12, 2026
- CVE-2025-15703Low 3.5WP Job Openings < 4.0.0 - Admin+ Stored XSSPublished Oct 12, 2026
- CVE-2026-21131Low 2.1Incorrect default permission in Samsung Flow prior to version 4.9.22.4 allows local attackers to launch an arbitrary activity with Samsung Flow privileges on the connected device.Published Oct 12, 2026
- CVE-2026-108981Low 3.6ngx_cache_purge before 3.0.4 can allow file deletion via a symlink attack in certain situations where nginx and a served application (e.g., WordPress) run under the same user account.Published Oct 12, 2026
- CVE-2026-18418Low 3.4Out-of-bounds read when the zbus proxy agent IPC backend logs a rejected peer frame's channel namePublished Oct 11, 2026
- CVE-2026-108864Low 2.3iFlytek Astron Agent through 1.1.2 contains an insecure direct object reference vulnerability that allows authenticated applications to resume other applications' paused workflows by supplying their event_id to POST /workflow/v1/resume.Published Oct 11, 2026
- CVE-2026-108856Low 2.3UnicomAI Wanwu through 0.6.5 contains an authorization bypass vulnerability that allows authenticated users to mint AppKeys bound to other users' MCP servers via POST /v1/appspace/app/key.Published Oct 11, 2026
- CVE-2026-108852Low 2.1Deep Chat through 2.5.1 contains a cross-site scripting vulnerability that allows attackers to inject javascript: links because RemarkableConfig.createNew disables Remarkable link validation.Published Oct 11, 2026
- CVE-2026-108839Low 2.3thClaws through 0.141.0 contains a link-following vulnerability in the post_inputs handler of the v1 API POST /v1/inputs endpoint that allows writes outside the workspace by following symlinks.Published Oct 11, 2026
- CVE-2026-108752Low 2.3JupyterHub through 6.0.1 contains an identifier collision vulnerability that allows authenticated users to overwrite another user's named-server OAuth client by registering a hyphenated username.Published Oct 11, 2026
- CVE-2026-108747Low 2.3Lightdash through 2.556.0 contains an authorization bypass vulnerability that allows authenticated organization members to delete other users' personal access tokens by supplying their UUID.Published Oct 11, 2026
- CVE-2026-108745Low 2.3CloudBeaver through 25.3.5 contains a missing authorization vulnerability in WebSQLResultServlet that allows any web session holder to read other users' LOB export files from a shared folder.Published Oct 11, 2026
- CVE-2026-108741Low 2.3Shepherd (shepherd-ai) through 0.3.1 contains a server-side request forgery guard bypass in the citation-checker extra because the public_url guard validates a resolved address but fetch re-resolves the hostname at connect time.Published Oct 11, 2026
- CVE-2026-108738Low 2.3Traccar 5.7 through 6.16.0 contains a cross-site request forgery vulnerability that allows attackers to log victims into attacker-controlled accounts because the OpenID Connect callback never validates the OAuth state parameter.Published Oct 11, 2026
- CVE-2026-108723Low 2.0answer-me-with-html through 0.5.0 contains a link following vulnerability in the am CLI code block src= embedding, where localPath() checks only path text without resolving symlinks.Published Oct 11, 2026
- CVE-2026-108722Low 2.3open-computer-use through commit 610bac8 contains a stored cross-site scripting vulnerability in Logger.write_log_file in os_computer_use/logging.py, which writes transcript text into log.html without HTML escaping.Published Oct 11, 2026
- CVE-2026-107694Low 2.7Dokan < 5.2.0 - Vendor+ Cross-Vendor Commission Settings Disclosure via Commission REST EndpointPublished Oct 11, 2026
- CVE-2026-107507Low 2.7Squadeno < 1.12.0 - Trainer+ Section and Age Group Reassignment via Quick EditPublished Oct 11, 2026
- CVE-2026-104684Low 2.7Envira Gallery < 1.16.2 - Author+ IDOR via ShortcodePublished Oct 11, 2026
- CVE-2026-104682Low 2.7Envira Gallery < 1.16.2 - Contributor Missing Authorization via Convert Gallery REST RoutePublished Oct 11, 2026
- CVE-2026-104681Low 2.7Envira Gallery < 1.16.2 - Author+ Non-Public Post Title and Excerpt Disclosure via Gallery REST FieldPublished Oct 11, 2026
- CVE-2026-108594Low 2.3Mealie 3.26.0 through 3.28.0 SSRF via OIDC Picture Claim Avatar FetchPublished Oct 10, 2026
- CVE-2026-108583Low 2.3zotero-mcp 0.10.0 through 0.14.1 SSRF via zotero_add_by_url ToolPublished Oct 10, 2026
- CVE-2026-108579Low 2.3OpenPanel through 2.3.0 CSV Formula Injection via Cohort Member ExportPublished Oct 10, 2026
- CVE-2026-108555Low 2.3PairDrop through 1.11.2 IP Spoofing via cf-connecting-ip HeaderPublished Oct 10, 2026
| CVE | Title | Severity | Published |
|---|---|---|---|
| CVE-2026-109564 | LearnHouse before 1.4.0 Missing Authorization via Playground Duplicate Endpoint | Low 2.3 | |
| CVE-2026-109561 | goose from 1.28.0 before 1.44.0 Manual Approval Bypass via Read-Only Tool Annotations | Low 2.3 | |
| CVE-2026-104364 | IBM® Db2® Denial of Service | Low 3.3 | |
| CVE-2026-42689 | WordPress Events Manager plugin <= 7.4.7 - Race Condition vulnerability | Low 3.7 | |
| CVE-2026-105274 | hex_core decompresses registry and Erlang term API responses without size limits | Low 2.1 | |
| CVE-2026-109332 | Network-AI before 5.15.2 CORS Origin Validation Error in MCP SSE Transport | Low 2.3 | |
| CVE-2026-109307 | Craft CMS 5.0.0 before 5.10.14 DOM XSS via returnUrl in 2FA Verification | Low 2.1 | |
| CVE-2026-109285 | Open WebUI 0.6.0 before 0.11.4 Improper Access Control via Stale File Metadata | Low 2.3 | |
| CVE-2026-109282 | ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Undefined Behavior in INFO, JSON and YAML Encoders | Low 2.0 | |
| CVE-2026-109280 | ImageMagick 7.1.0-20 before 7.1.2-32 Use After Free via -fx Option | Low 2.0 | |
| CVE-2026-109279 | ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Heap Buffer Overflow via Concurrent Security Policy Access | Low 2.0 | |
| CVE-2026-109274 | ImageMagick before 7.1.2-32 TOCTOU Symlink Race Path Policy Bypass via magick script | Low 2.0 | |
| CVE-2026-109258 | ImageMagick 7.1.0-20 before 7.1.2-32 Invalid Memory Free in FX Operation | Low 2.0 | |
| CVE-2026-109247 | FreeRDP before 3.32.0 Path Traversal via Clipboard cFileName | Low 2.1 | |
| CVE-2026-109241 | FreeRDP before 3.32.0 NULL Dereference in Video Redirection Channel | Low 2.3 | |
| CVE-2026-109240 | FreeRDP 3.11.0 before 3.32.1 Reachable Assertion DoS via urb_isoch_transfer | Low 2.3 | |
| CVE-2026-81856 | Terminal escape sequence injection in Hex via unneutralized server-supplied output | Low 2.3 | |
| CVE-2026-96618 | Hex exhausts memory and disk on oversized or compressed responses from an untrusted mirror | Low 2.1 | |
| CVE-2026-109195 | Quay: repository auto-prune policy uuid idor in quay api | Low 3.1 | |
| CVE-2026-109396 | Thelia before 3.1.2 and 3.2.x before 3.2.1 CSV Formula Injection via Exports | Low 2.3 | |
| CVE-2026-103526 | CVE-2026-103526 | Low 3.7 | |
| CVE-2026-105081 | ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 does not properly account for symbolic links in the IsRightsAuthorizedByName security policy check, allowing configured policy restrictions to be bypassed. | Low 2.0 | |
| CVE-2026-108830 | A weakness has been identified in meetecho janus-gateway up to 1.4.2. | Low 2.3 | |
| CVE-2026-108828 | Affected by this vulnerability is the function eval of the file admin/configuration.php of the component Admin Panel. | Low 2.1 | |
| CVE-2026-108827 | A vulnerability was determined in Zen Cart up to 2.2.2. | Low 2.1 | |
| CVE-2026-108808 | A vulnerability was determined in Eleveo Call Recording Software up to 10.3.0. | Low 2.1 | |
| CVE-2025-15703 | WP Job Openings < 4.0.0 - Admin+ Stored XSS | Low 3.5 | |
| CVE-2026-21131 | Incorrect default permission in Samsung Flow prior to version 4.9.22.4 allows local attackers to launch an arbitrary activity with Samsung Flow privileges on the connected device. | Low 2.1 | |
| CVE-2026-108981 | ngx_cache_purge before 3.0.4 can allow file deletion via a symlink attack in certain situations where nginx and a served application (e.g., WordPress) run under the same user account. | Low 3.6 | |
| CVE-2026-18418 | Out-of-bounds read when the zbus proxy agent IPC backend logs a rejected peer frame's channel name | Low 3.4 | |
| CVE-2026-108864 | iFlytek Astron Agent through 1.1.2 contains an insecure direct object reference vulnerability that allows authenticated applications to resume other applications' paused workflows by supplying their event_id to POST /workflow/v1/resume. | Low 2.3 | |
| CVE-2026-108856 | UnicomAI Wanwu through 0.6.5 contains an authorization bypass vulnerability that allows authenticated users to mint AppKeys bound to other users' MCP servers via POST /v1/appspace/app/key. | Low 2.3 | |
| CVE-2026-108852 | Deep Chat through 2.5.1 contains a cross-site scripting vulnerability that allows attackers to inject javascript: links because RemarkableConfig.createNew disables Remarkable link validation. | Low 2.1 | |
| CVE-2026-108839 | thClaws through 0.141.0 contains a link-following vulnerability in the post_inputs handler of the v1 API POST /v1/inputs endpoint that allows writes outside the workspace by following symlinks. | Low 2.3 | |
| CVE-2026-108752 | JupyterHub through 6.0.1 contains an identifier collision vulnerability that allows authenticated users to overwrite another user's named-server OAuth client by registering a hyphenated username. | Low 2.3 | |
| CVE-2026-108747 | Lightdash through 2.556.0 contains an authorization bypass vulnerability that allows authenticated organization members to delete other users' personal access tokens by supplying their UUID. | Low 2.3 | |
| CVE-2026-108745 | CloudBeaver through 25.3.5 contains a missing authorization vulnerability in WebSQLResultServlet that allows any web session holder to read other users' LOB export files from a shared folder. | Low 2.3 | |
| CVE-2026-108741 | Shepherd (shepherd-ai) through 0.3.1 contains a server-side request forgery guard bypass in the citation-checker extra because the public_url guard validates a resolved address but fetch re-resolves the hostname at connect time. | Low 2.3 | |
| CVE-2026-108738 | Traccar 5.7 through 6.16.0 contains a cross-site request forgery vulnerability that allows attackers to log victims into attacker-controlled accounts because the OpenID Connect callback never validates the OAuth state parameter. | Low 2.3 | |
| CVE-2026-108723 | answer-me-with-html through 0.5.0 contains a link following vulnerability in the am CLI code block src= embedding, where localPath() checks only path text without resolving symlinks. | Low 2.0 | |
| CVE-2026-108722 | open-computer-use through commit 610bac8 contains a stored cross-site scripting vulnerability in Logger.write_log_file in os_computer_use/logging.py, which writes transcript text into log.html without HTML escaping. | Low 2.3 | |
| CVE-2026-107694 | Dokan < 5.2.0 - Vendor+ Cross-Vendor Commission Settings Disclosure via Commission REST Endpoint | Low 2.7 | |
| CVE-2026-107507 | Squadeno < 1.12.0 - Trainer+ Section and Age Group Reassignment via Quick Edit | Low 2.7 | |
| CVE-2026-104684 | Envira Gallery < 1.16.2 - Author+ IDOR via Shortcode | Low 2.7 | |
| CVE-2026-104682 | Envira Gallery < 1.16.2 - Contributor Missing Authorization via Convert Gallery REST Route | Low 2.7 | |
| CVE-2026-104681 | Envira Gallery < 1.16.2 - Author+ Non-Public Post Title and Excerpt Disclosure via Gallery REST Field | Low 2.7 | |
| CVE-2026-108594 | Mealie 3.26.0 through 3.28.0 SSRF via OIDC Picture Claim Avatar Fetch | Low 2.3 | |
| CVE-2026-108583 | zotero-mcp 0.10.0 through 0.14.1 SSRF via zotero_add_by_url Tool | Low 2.3 | |
| CVE-2026-108579 | OpenPanel through 2.3.0 CSV Formula Injection via Cohort Member Export | Low 2.3 | |
| CVE-2026-108555 | PairDrop through 1.11.2 IP Spoofing via cf-connecting-ip Header | Low 2.3 |
Showing 101–150 of 11,289. Narrow the filters to see the rest.
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status. Filter by severity and year here; the other filters work on the curated lists.