Vulnerability Intelligence · All CVEs
Every Published CVE, Searchable.
Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status.
Synced hourly · figures as of Oct 19, 2026
138,367 vulnerabilities · newest first
- CVE-2026-112092Medium 5.3ExecutiPublished Oct 19, 2026
- CVE-2026-112091Medium 6.9A flaw has been found in Dav-ee dairy-management-system 31ace9692d1e1e6d64339a42c463b361319c615c/f31a584c3330c013b61f8b0306d9e0849c6d693d.Published Oct 19, 2026
- CVE-2026-112090Medium 5.3A vulnerability was detected in Dav-ee dairy-management-system 31ace9692d1e1e6d64339a42c463b361319c615c/f31a584c3330c013b61f8b0306d9e0849c6d693d.Published Oct 19, 2026
- CVE-2026-111439Medium 4.3在 openGauss-server的 src/common/backend/utils/adt/genfile.cpp 模块中，内置函数 pg_read_binary_file_blocks() 存在权限校验逻辑缺陷。该函数在入口处仅校验了起始块号（startBlockNum）和块数量（blockCount）的范围，随后直接调用底层文件读取例程 ReadBinaryFileBlocksFirstCall()。该底层例程仅执行了路径规范化检查以及针对 ..Published Oct 19, 2026
- CVE-2026-94294Medium 5.3The App Builder WordPress plugin before 5.7.1 does not require authentication or authorisation before writing attacker-supplied data to one of its options and, on a separate unauthenticated request, redirecting the visitor's browser to a…Published Oct 19, 2026
- CVE-2026-94272Medium 5.3The Snap Finance WordPress plugin before 3.12.0 does not verify that a request to change a WooCommerce order's status comes from an authorised source, allowing unauthenticated attackers to move any order into a paid state or force it to…Published Oct 19, 2026
- CVE-2026-94231Medium 5.3The TrueBooker WordPress plugin before 1.3.0 does not have authorisation checks in place in some of its functionality, allowing unauthenticated users to create and modify booking services and categories, including their prices.Published Oct 19, 2026
- CVE-2026-94230Medium 5.3The TrueBooker WordPress plugin before 1.3.0 does not have authorisation checks in some of its AJAX actions, and does not validate the submitted service price server-side, allowing unauthenticated users to create bookings at a price of…Published Oct 19, 2026
- CVE-2026-94229Medium 5.3The TrueBooker WordPress plugin before 1.3.0 does not verify that the requester owns a booking before rendering its confirmation summary, allowing unauthenticated attackers to enumerate booking identifiers and retrieve the personal…Published Oct 19, 2026
- CVE-2026-94228Medium 5.3The TrueBooker WordPress plugin before 1.3.0 does not perform any capability check on one of its setup handlers, and the token it does check is issued to unauthenticated visitors, allowing anyone to overwrite the plugin's entire…Published Oct 19, 2026
- CVE-2026-86791Medium 5.3The iPOSpays Payment Gateway for WooCommerce WordPress plugin before 1.4.7 does not verify that a payment was actually completed before recording an order as paid, allowing unauthenticated users to mark any unpaid order as paid and to…Published Oct 19, 2026
- CVE-2026-74922Medium 5.3The Document Gallery WordPress plugin through 5.1.1 does not verify the signature on one of its unauthenticated webhook endpoints when no shared secret has been configured, which is the default state, allowing unauthenticated users to…Published Oct 19, 2026
- CVE-2026-74921Medium 6.8The Document Gallery WordPress plugin through 5.1.1 does not sanitise or escape several gallery shortcode attributes before embedding them in a single-quoted HTML attribute in the rendered gallery markup, allowing users with the…Published Oct 19, 2026
- CVE-2026-112089Medium 5.1A security vulnerability has been detected in Dav-ee dairy-management-system 31ace9692d1e1e6d64339a42c463b361319c615c/f31a584c3330c013b61f8b0306d9e0849c6d693d.Published Oct 19, 2026
- CVE-2026-112088Medium 5.3A weakness has been identified in Dav-ee dairy-management-system 31ace9692d1e1e6d64339a42c463b361319c615c/f31a584c3330c013b61f8b0306d9e0849c6d693d.Published Oct 19, 2026
- CVE-2026-112087Medium 5.3A weakness has been identified in itsourcecode Online Cake Ordering System 1.0.Published Oct 19, 2026
- CVE-2026-106010Medium 5.3The BDM Digital Payment Gateway WordPress plugin through 1.3.12 does not verify the credentials on its public payment-status update route and treats unset credentials as valid, allowing unauthenticated attackers to mark arbitrary…Published Oct 19, 2026
- CVE-2026-103311Medium 5.3The Coinbase Commerce Payment Gateway for WooCommerce WordPress plugin through 1.4.1 does not verify the authenticity of incoming payment webhook notifications, because the shared secret used to validate the request signature is empty by…Published Oct 19, 2026
- CVE-2026-94273Medium 5.3The Snap Finance WordPress plugin through 3.11.0 does not verify that the payment provider's response actually confirms a completed, approved transaction before marking a WooCommerce order as paid, allowing unauthenticated attackers to…Published Oct 19, 2026
- CVE-2026-91047Medium 5.3The ElementsReady Addons for Elementor WordPress plugin through 6.7.2 does not properly restrict access to protected WooCommerce product downloads, allowing unauthenticated users to bypass the payment requirement and retrieve any…Published Oct 19, 2026
- CVE-2026-91046Medium 4.3The ElementsReady Addons for Elementor WordPress plugin through 6.7.2 does not perform authorization checks that halt execution in several of its settings-save handlers, allowing users with subscriber-level access and above to overwrite…Published Oct 19, 2026
- CVE-2026-89286Medium 5.3The FormFlow for GoHighLevel (GHL) WordPress plugin through 1.0.0 does not restrict access to a log file it writes inside the publicly accessible uploads directory, allowing unauthenticated attackers to read its contents, which include…Published Oct 19, 2026
- CVE-2026-76739Medium 4.3A potential security vulnerability in HPE Compute Scale-up Server 3200 and 3250 platforms and Superdome Flex server could be remotely exploited to list and modify RMC filesystem.Published Oct 19, 2026
- CVE-2026-112086Medium 5.3The manipulation of the argument _target_ results…Published Oct 19, 2026
- CVE-2026-112083Medium 6.9A security flaw has been discovered in sgl-project SGLang up to 0.5.19.Published Oct 19, 2026
- CVE-2026-112081Medium 5.3A vulnerability was determined in hankcs HanLP up to 2.1.0-beta.64.Published Oct 19, 2026
- CVE-2026-108121Medium 6.9Brian Mariani from DigitalCanion SA has discovered a vulnerability in the domain creation functionality of koozali's SME Server version 11.0rc1-215, allowing an attacker with high privileges to inject reserved Apache configuration…Published Oct 19, 2026
- CVE-2026-106933Medium 6.8The Blaze Demo Importer WordPress plugin before 1.0.17 does not sanitize uploaded SVG files and registers the SVG MIME type for the WordPress media library unconditionally, allowing authenticated users with the Author role or higher to…Published Oct 19, 2026
- CVE-2026-106028Medium 5.3The ActiveTrail for WooCommerce WordPress plugin through 1.2.6 does not perform any authorization check before creating WooCommerce coupons, allowing unauthenticated attackers to create arbitrary coupons, including 100%-off and…Published Oct 19, 2026
- CVE-2026-106014Medium 5.3The Gateway for Vantiv on WC WordPress plugin through 1.0.1 does not verify the authenticity of the payment notification received on its hosted-payment return handler, allowing unauthenticated attackers to mark orders as paid without…Published Oct 19, 2026
- CVE-2026-112080Medium 5.3A vulnerability was found in LlamaChinese Llama-Chinese up to 6fa0fffb0dd82fe3cfaa1449ee54a5806d26ae9b.Published Oct 19, 2026
- CVE-2026-112079Medium 5.3The manipulation of the argument vectors.vocab leads to…Published Oct 19, 2026
- CVE-2026-112078Medium 5.3Executing a manipulation of the argument ckpt_path can lead to code injection.Published Oct 19, 2026
- CVE-2026-112077Medium 6.3A vulnerability was detected in radareorg radare2 6.2.0/6.2.2.Published Oct 19, 2026
- CVE-2026-112076Medium 6.3A security vulnerability has been detected in alexta69 MeTube up to 2026.09.28.Published Oct 19, 2026
- CVE-2026-112075Medium 5.3A weakness has been identified in unslothai unsloth up to 0.1.501-beta.Published Oct 19, 2026
- CVE-2026-112074Medium 5.3Affected by this issue is the function ncnn::yuv420sp2rgb of the file src/mat_pixel.cpp of the component Conversion API.Published Oct 19, 2026
- CVE-2026-112073Medium 5.3Affected by this vulnerability is the function matmul_transb of the file src/layer/matmul.cpp of the component MatMul.Published Oct 19, 2026
- CVE-2026-112045Medium 5.3A vulnerability was detected in donetick up to 0.1.82.Published Oct 19, 2026
- CVE-2026-112044Medium 6.9A security vulnerability has been detected in dotnet eShop up to 913acea66708a59595351174cee9b29f37179d29.Published Oct 19, 2026
- CVE-2026-112043Medium 5.3A weakness has been identified in calcom cal.com and cal.diy up to 6.2.0.Published Oct 19, 2026
- CVE-2026-112042Medium 5.1A security flaw has been discovered in diem-project diem up to 116974edfb9a5b8bd69cb13586dc62bcdbb485ad.Published Oct 19, 2026
- CVE-2026-112041Medium 6.3Such manipulation leads to…Published Oct 19, 2026
- CVE-2026-112040Medium 5.3A vulnerability was determined in diem-project diem up to 116974edfb9a5b8bd69cb13586dc62bcdbb485ad.Published Oct 19, 2026
- CVE-2026-112039Medium 4.8Affected by this issue is the function append of the file dmAdminPlugin/modules/dmConsole/actions/actions.class.php of the component…Published Oct 19, 2026
- CVE-2026-112038Medium 4.8Affected by this vulnerability is the function html of the file dmAdminPlugin/web/js/dmAdminCtrl.js of the component Version Check Service.Published Oct 19, 2026
- CVE-2026-112037Medium 6.3Executing a…Published Oct 19, 2026
- CVE-2026-112036Medium 5.3A vulnerability was detected in Artifex MuPDF up to 1.28.5.Published Oct 19, 2026
- CVE-2026-112035Medium 5.3A security vulnerability has been detected in aircheng-org iWebShop-5 up to 5.16.Published Oct 19, 2026
- CVE-2026-112034Medium 5.3A weakness has been identified in aircheng-org iWebShop-5 up to 5.16.Published Oct 19, 2026
| CVE | Title | Severity | Published |
|---|---|---|---|
| CVE-2026-112092 | Executi | Medium 5.3 | |
| CVE-2026-112091 | A flaw has been found in Dav-ee dairy-management-system 31ace9692d1e1e6d64339a42c463b361319c615c/f31a584c3330c013b61f8b0306d9e0849c6d693d. | Medium 6.9 | |
| CVE-2026-112090 | A vulnerability was detected in Dav-ee dairy-management-system 31ace9692d1e1e6d64339a42c463b361319c615c/f31a584c3330c013b61f8b0306d9e0849c6d693d. | Medium 5.3 | |
| CVE-2026-111439 | 在 openGauss-server的 src/common/backend/utils/adt/genfile.cpp 模块中，内置函数 pg_read_binary_file_blocks() 存在权限校验逻辑缺陷。该函数在入口处仅校验了起始块号（startBlockNum）和块数量（blockCount）的范围，随后直接调用底层文件读取例程 ReadBinaryFileBlocksFirstCall()。该底层例程仅执行了路径规范化检查以及针对 .. | Medium 4.3 | |
| CVE-2026-94294 | The App Builder WordPress plugin before 5.7.1 does not require authentication or authorisation before writing attacker-supplied data to one of its options and, on a separate unauthenticated request, redirecting the visitor's browser to a… | Medium 5.3 | |
| CVE-2026-94272 | The Snap Finance WordPress plugin before 3.12.0 does not verify that a request to change a WooCommerce order's status comes from an authorised source, allowing unauthenticated attackers to move any order into a paid state or force it to… | Medium 5.3 | |
| CVE-2026-94231 | The TrueBooker WordPress plugin before 1.3.0 does not have authorisation checks in place in some of its functionality, allowing unauthenticated users to create and modify booking services and categories, including their prices. | Medium 5.3 | |
| CVE-2026-94230 | The TrueBooker WordPress plugin before 1.3.0 does not have authorisation checks in some of its AJAX actions, and does not validate the submitted service price server-side, allowing unauthenticated users to create bookings at a price of… | Medium 5.3 | |
| CVE-2026-94229 | The TrueBooker WordPress plugin before 1.3.0 does not verify that the requester owns a booking before rendering its confirmation summary, allowing unauthenticated attackers to enumerate booking identifiers and retrieve the personal… | Medium 5.3 | |
| CVE-2026-94228 | The TrueBooker WordPress plugin before 1.3.0 does not perform any capability check on one of its setup handlers, and the token it does check is issued to unauthenticated visitors, allowing anyone to overwrite the plugin's entire… | Medium 5.3 | |
| CVE-2026-86791 | The iPOSpays Payment Gateway for WooCommerce WordPress plugin before 1.4.7 does not verify that a payment was actually completed before recording an order as paid, allowing unauthenticated users to mark any unpaid order as paid and to… | Medium 5.3 | |
| CVE-2026-74922 | The Document Gallery WordPress plugin through 5.1.1 does not verify the signature on one of its unauthenticated webhook endpoints when no shared secret has been configured, which is the default state, allowing unauthenticated users to… | Medium 5.3 | |
| CVE-2026-74921 | The Document Gallery WordPress plugin through 5.1.1 does not sanitise or escape several gallery shortcode attributes before embedding them in a single-quoted HTML attribute in the rendered gallery markup, allowing users with the… | Medium 6.8 | |
| CVE-2026-112089 | A security vulnerability has been detected in Dav-ee dairy-management-system 31ace9692d1e1e6d64339a42c463b361319c615c/f31a584c3330c013b61f8b0306d9e0849c6d693d. | Medium 5.1 | |
| CVE-2026-112088 | A weakness has been identified in Dav-ee dairy-management-system 31ace9692d1e1e6d64339a42c463b361319c615c/f31a584c3330c013b61f8b0306d9e0849c6d693d. | Medium 5.3 | |
| CVE-2026-112087 | A weakness has been identified in itsourcecode Online Cake Ordering System 1.0. | Medium 5.3 | |
| CVE-2026-106010 | The BDM Digital Payment Gateway WordPress plugin through 1.3.12 does not verify the credentials on its public payment-status update route and treats unset credentials as valid, allowing unauthenticated attackers to mark arbitrary… | Medium 5.3 | |
| CVE-2026-103311 | The Coinbase Commerce Payment Gateway for WooCommerce WordPress plugin through 1.4.1 does not verify the authenticity of incoming payment webhook notifications, because the shared secret used to validate the request signature is empty by… | Medium 5.3 | |
| CVE-2026-94273 | The Snap Finance WordPress plugin through 3.11.0 does not verify that the payment provider's response actually confirms a completed, approved transaction before marking a WooCommerce order as paid, allowing unauthenticated attackers to… | Medium 5.3 | |
| CVE-2026-91047 | The ElementsReady Addons for Elementor WordPress plugin through 6.7.2 does not properly restrict access to protected WooCommerce product downloads, allowing unauthenticated users to bypass the payment requirement and retrieve any… | Medium 5.3 | |
| CVE-2026-91046 | The ElementsReady Addons for Elementor WordPress plugin through 6.7.2 does not perform authorization checks that halt execution in several of its settings-save handlers, allowing users with subscriber-level access and above to overwrite… | Medium 4.3 | |
| CVE-2026-89286 | The FormFlow for GoHighLevel (GHL) WordPress plugin through 1.0.0 does not restrict access to a log file it writes inside the publicly accessible uploads directory, allowing unauthenticated attackers to read its contents, which include… | Medium 5.3 | |
| CVE-2026-76739 | A potential security vulnerability in HPE Compute Scale-up Server 3200 and 3250 platforms and Superdome Flex server could be remotely exploited to list and modify RMC filesystem. | Medium 4.3 | |
| CVE-2026-112086 | The manipulation of the argument _target_ results… | Medium 5.3 | |
| CVE-2026-112083 | A security flaw has been discovered in sgl-project SGLang up to 0.5.19. | Medium 6.9 | |
| CVE-2026-112081 | A vulnerability was determined in hankcs HanLP up to 2.1.0-beta.64. | Medium 5.3 | |
| CVE-2026-108121 | Brian Mariani from DigitalCanion SA has discovered a vulnerability in the domain creation functionality of koozali's SME Server version 11.0rc1-215, allowing an attacker with high privileges to inject reserved Apache configuration… | Medium 6.9 | |
| CVE-2026-106933 | The Blaze Demo Importer WordPress plugin before 1.0.17 does not sanitize uploaded SVG files and registers the SVG MIME type for the WordPress media library unconditionally, allowing authenticated users with the Author role or higher to… | Medium 6.8 | |
| CVE-2026-106028 | The ActiveTrail for WooCommerce WordPress plugin through 1.2.6 does not perform any authorization check before creating WooCommerce coupons, allowing unauthenticated attackers to create arbitrary coupons, including 100%-off and… | Medium 5.3 | |
| CVE-2026-106014 | The Gateway for Vantiv on WC WordPress plugin through 1.0.1 does not verify the authenticity of the payment notification received on its hosted-payment return handler, allowing unauthenticated attackers to mark orders as paid without… | Medium 5.3 | |
| CVE-2026-112080 | A vulnerability was found in LlamaChinese Llama-Chinese up to 6fa0fffb0dd82fe3cfaa1449ee54a5806d26ae9b. | Medium 5.3 | |
| CVE-2026-112079 | The manipulation of the argument vectors.vocab leads to… | Medium 5.3 | |
| CVE-2026-112078 | Executing a manipulation of the argument ckpt_path can lead to code injection. | Medium 5.3 | |
| CVE-2026-112077 | A vulnerability was detected in radareorg radare2 6.2.0/6.2.2. | Medium 6.3 | |
| CVE-2026-112076 | A security vulnerability has been detected in alexta69 MeTube up to 2026.09.28. | Medium 6.3 | |
| CVE-2026-112075 | A weakness has been identified in unslothai unsloth up to 0.1.501-beta. | Medium 5.3 | |
| CVE-2026-112074 | Affected by this issue is the function ncnn::yuv420sp2rgb of the file src/mat_pixel.cpp of the component Conversion API. | Medium 5.3 | |
| CVE-2026-112073 | Affected by this vulnerability is the function matmul_transb of the file src/layer/matmul.cpp of the component MatMul. | Medium 5.3 | |
| CVE-2026-112045 | A vulnerability was detected in donetick up to 0.1.82. | Medium 5.3 | |
| CVE-2026-112044 | A security vulnerability has been detected in dotnet eShop up to 913acea66708a59595351174cee9b29f37179d29. | Medium 6.9 | |
| CVE-2026-112043 | A weakness has been identified in calcom cal.com and cal.diy up to 6.2.0. | Medium 5.3 | |
| CVE-2026-112042 | A security flaw has been discovered in diem-project diem up to 116974edfb9a5b8bd69cb13586dc62bcdbb485ad. | Medium 5.1 | |
| CVE-2026-112041 | Such manipulation leads to… | Medium 6.3 | |
| CVE-2026-112040 | A vulnerability was determined in diem-project diem up to 116974edfb9a5b8bd69cb13586dc62bcdbb485ad. | Medium 5.3 | |
| CVE-2026-112039 | Affected by this issue is the function append of the file dmAdminPlugin/modules/dmConsole/actions/actions.class.php of the component… | Medium 4.8 | |
| CVE-2026-112038 | Affected by this vulnerability is the function html of the file dmAdminPlugin/web/js/dmAdminCtrl.js of the component Version Check Service. | Medium 4.8 | |
| CVE-2026-112037 | Executing a… | Medium 6.3 | |
| CVE-2026-112036 | A vulnerability was detected in Artifex MuPDF up to 1.28.5. | Medium 5.3 | |
| CVE-2026-112035 | A security vulnerability has been detected in aircheng-org iWebShop-5 up to 5.16. | Medium 5.3 | |
| CVE-2026-112034 | A weakness has been identified in aircheng-org iWebShop-5 up to 5.16. | Medium 5.3 |
Showing 101–150 of 138,367. Narrow the filters to see the rest.
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status. Filter by severity and year here; the other filters work on the curated lists.