Vulnerability Intelligence · All CVEs
Every Published CVE, Searchable.
Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status.
Synced hourly · figures as of Oct 19, 2026
40,398 vulnerabilities · newest first
- CVE-2026-101967Critical 9.3Junos OS Evolved: PTX Series: An attacker controlled DHCP response causes root-level compromise when zero-touch provisioning is usedPublished Oct 14, 2026
- CVE-2026-102068Critical 9.2Junos OS Evolved: Malformed TCP key-chain traffic causes a kernel panic when BGP or LDP key-chain authentication is usedPublished Oct 14, 2026
- CVE-2026-76519Critical 9.8Cisco Secure Email Gateway Arbitrary File Write VulnerabilityCisco · Secure Email GatewayPublished Oct 14, 2026
- CVE-2026-97205Critical 9.2NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module.microsoft · azl3 httpd 2.4.68-1Published Oct 14, 2026
- CVE-2026-93479Critical 9.2Alternatively, the same result could be achieved by using a non-cacheable variable in a string expression under certain conditions.microsoft · azl3 httpd 2.4.68-1Published Oct 14, 2026
- CVE-2026-59774Critical 9.8Gitea's Org-mode markup renderer processes INCLUDE directives supplied to the repository markup endpoint without preventing access to server-side files.Published Oct 14, 2026
- CVE-2026-15176Critical 9.2Alternatively, the same result could be achieved when the $request_filename variable is used in an access log format directive.microsoft · azl3 httpd 2.4.68-1Published Oct 14, 2026
- CVE-2026-110650Critical 9.3The thumbnail Python package through 1.5 contains an OS command injection vulnerability in generate_thumbnail() that allows attackers to execute commands by supplying shell metacharacters in file paths.Published Oct 14, 2026
- CVE-2026-110649Critical 9.3Stills before 25.24.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted media file paths.Published Oct 14, 2026
- CVE-2026-110646Critical 9.2Beganovich snappdf from 1.1.0 before 6.1.0 contains an OS command injection vulnerability on Windows that allows attackers to run commands by influencing the rendered URL.Published Oct 14, 2026
- CVE-2026-110645Critical 9.3Video-stitch before 2.0.0-beta.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying file names interpolated unquoted into shell-executed ffmpeg command lines.Published Oct 14, 2026
- CVE-2026-110644Critical 9.3nodejs-whisper through 0.3.1 contains an OS command injection vulnerability in convertToWavType() that allows attackers to execute commands by supplying crafted audio file paths.Published Oct 14, 2026
- CVE-2026-110643Critical 9.3transcribe2texts through 1.0.6 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted audioPath values to transcribeAudio().Published Oct 14, 2026
- CVE-2026-110640Critical 9.3Whisper-node through 1.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted filePath or whisperOptions.language values to whisper().Published Oct 14, 2026
- CVE-2026-110639Critical 9.3@mborne/extract before 0.2.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying shell metacharacters in archivePath or targetDir options.Published Oct 14, 2026
- CVE-2026-110638Critical 9.3doc-recog through 1.1.6 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted document paths to recog() or tag().Published Oct 14, 2026
- CVE-2026-110636Critical 9.3pypdftk through 0.5 contains an OS command injection vulnerability in fill_form(), dump_data_fields(), and pdftk_cmd_util() that builds shell commands from caller-supplied paths.Published Oct 14, 2026
- CVE-2026-110635Critical 9.3webp-converter before 3.0.0 contains an OS command injection vulnerability in src/webpconverter.js helpers that run libwebp binaries via execFile with shell enabled.Published Oct 14, 2026
- CVE-2026-110634Critical 9.3git-diff before 2.0.7 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted strings to the gitDiff API.Published Oct 14, 2026
- CVE-2026-110632Critical 9.2Report One MyReport Updater through 2.1.1 exposes an unauthenticated gRPC service on TCP port 9095 that allows remote attackers to redirect the SYSTEM updater by invoking the UpdateConfigReferent method.Published Oct 14, 2026
- CVE-2026-110631Critical 9.3Komodo through 2.3.3 contains an authentication bypass vulnerability in the Periphery agent that allows unauthenticated attackers to connect as a trusted Core because empty core_public_keys and passkeys lists fail open by default.Published Oct 14, 2026
- CVE-2026-110628Critical 9.2Kan 0.5.5 through 0.6.0 contains an unauthenticated server-side request forgery vulnerability in the /api/download/attatchment route due to an incomplete fix for CVE-2026-32255.Published Oct 14, 2026
- CVE-2026-110616Critical 9.2NullHub through 2026.5.29 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/* management API because the auth_token field defaults to null and is never assigned.Published Oct 14, 2026
- CVE-2026-110612Critical 9.3vlife through 2.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge JWTs using the hardcoded HS256 signing key in TokenUtil.Published Oct 14, 2026
- CVE-2020-37282Critical 9.3office-converter through 1.0.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying a crafted fileName to generatePdf() or generateHtml().Published Oct 14, 2026
- CVE-2020-37281Critical 9.2Gravitee API Management through 4.12.22 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to impersonate any user by forging JWTs signed with the shipped default jwt.secret.Published Oct 14, 2026
- CVE-2026-108065Critical 9.8Unauthenticated SQL Injection in Channel Software WebAlliance eCommercePublished Oct 14, 2026
- CVE-2026-16740Critical 9.8Missing Authentication for Critical Function in TR7 Cyber Defense's TR7 ASPPublished Oct 14, 2026
- CVE-2026-16741Critical 9.8OS Command in TR7 Cyber Defense's TR7 ASPPublished Oct 14, 2026
- CVE-2026-108291Critical 9.8WordPress Affiliates plugin <= 7.0.1 - PHP Object Injection vulnerabilityPublished Oct 14, 2026
- CVE-2026-107424Critical 9.8WordPress Frontend Dashboard plugin <= 3.0.7 - Privilege Escalation vulnerabilityPublished Oct 14, 2026
- CVE-2026-14851Critical 9.2Unauthorised disclosure of information on Copart’s online billing servicePublished Oct 14, 2026
- CVE-2026-104748Critical 9.8SimpleForm <= 3.10.0 - Unauthenticated Privilege Escalation to wp_capabilities Mass Assignment via simpleform_wp_registerPublished Oct 14, 2026
- CVE-2026-89310Critical 9.4SQL Command Injection Vulnerability in JTL-WMSPublished Oct 14, 2026
- CVE-2026-107594Critical 10.0File Upload to Order < 1.1.4 - Unauthenticated Arbitrary File DeletionPublished Oct 14, 2026
- CVE-2026-87855Critical 9.8JTL-Connector for WooCommerce <= 2.4.3 - Unauthenticated Arbitrary File Upload via 'image.push' MethodPublished Oct 14, 2026
- CVE-2026-104800Critical 9.8AGE-GATE <= 1.0 - Unauthenticated Remote Code Execution via PHP Code Injection via 'width'/'height' Parameters to Standalone admin.phpPublished Oct 14, 2026
- CVE-2026-110447Critical 9.2Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208.Published Oct 14, 2026
- CVE-2026-97657Critical 9.8Abandoned Cart Pro for WooCommerce <= 10.8.0 - Unauthenticated Authentication Bypass via Malleable Encryption and Bypassable HMAC via Recovery Link 'validate' ParameterPublished Oct 14, 2026
- CVE-2026-97668Critical 9.8Abandoned Cart Pro for WooCommerce <= 10.8.0 - Unauthenticated SQL Injection via Guest Persistent Cart meta_valuePublished Oct 14, 2026
- CVE-2026-110002Critical 9.8Snazzy Social Media Feed <= 2.5 - Unauthenticated Arbitrary File Upload via 'pluginURL' ParameterPublished Oct 14, 2026
- CVE-2026-93388Critical 9.8The Printcart Store (PCDesigner / NB Designer) plugin for WooCommerce is vulnerable to unauthenticated arbitrary file upload leading to remote code execution in all versions up to, and including, 2.9.1 The nbdesigner_copy_image_from_url…Published Oct 14, 2026
- CVE-2026-92097Critical 9.1The Click to Chat for WhatsApp plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 4.44 This is due to the greetings_dialog() function building the {url} template placeholder from a…Published Oct 14, 2026
- CVE-2026-110392Critical 9.8Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Samsung Open Source QA-Board allows : OS Command Injection.Published Oct 14, 2026
- CVE-2026-97381Critical 9.9Legacy Update 1.12.0 through 1.13.1 contains an origin validation error in the IsPermitted method of its ActiveX control.Published Oct 13, 2026
- CVE-2026-93909Critical 9.1IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 is vulnerable by an authentication bypass vulnerability when samlWeb-2.0 feature is enabled.Published Oct 13, 2026
- CVE-2026-93895Critical 9.1IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow an unauthenticated remote attacker to bypass access controls configured on gRPC service methods.Published Oct 13, 2026
- CVE-2026-90530Critical 9.3ColdFusion RDS is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read.Published Oct 13, 2026
- CVE-2026-110142Critical 9.6Use after free in FileSystem in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page.Published Oct 13, 2026
- CVE-2026-110159Critical 9.6Incorrect authorization in Updater in Google Chrome prior to 155.0.8059.79 allowed a local attacker to execute arbitrary code outside the sandbox via a local program.Published Oct 13, 2026
| CVE | Title | Severity | Published |
|---|---|---|---|
| CVE-2026-101967 | Junos OS Evolved: PTX Series: An attacker controlled DHCP response causes root-level compromise when zero-touch provisioning is used | Critical 9.3 | |
| CVE-2026-102068 | Junos OS Evolved: Malformed TCP key-chain traffic causes a kernel panic when BGP or LDP key-chain authentication is used | Critical 9.2 | |
| CVE-2026-76519 | Cisco Secure Email Gateway Arbitrary File Write Vulnerability Cisco · Secure Email Gateway | Critical 9.8 | |
| CVE-2026-97205 | NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module. microsoft · azl3 httpd 2.4.68-1 | Critical 9.2 | |
| CVE-2026-93479 | Alternatively, the same result could be achieved by using a non-cacheable variable in a string expression under certain conditions. microsoft · azl3 httpd 2.4.68-1 | Critical 9.2 | |
| CVE-2026-59774 | Gitea's Org-mode markup renderer processes INCLUDE directives supplied to the repository markup endpoint without preventing access to server-side files. | Critical 9.8 | |
| CVE-2026-15176 | Alternatively, the same result could be achieved when the $request_filename variable is used in an access log format directive. microsoft · azl3 httpd 2.4.68-1 | Critical 9.2 | |
| CVE-2026-110650 | The thumbnail Python package through 1.5 contains an OS command injection vulnerability in generate_thumbnail() that allows attackers to execute commands by supplying shell metacharacters in file paths. | Critical 9.3 | |
| CVE-2026-110649 | Stills before 25.24.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted media file paths. | Critical 9.3 | |
| CVE-2026-110646 | Beganovich snappdf from 1.1.0 before 6.1.0 contains an OS command injection vulnerability on Windows that allows attackers to run commands by influencing the rendered URL. | Critical 9.2 | |
| CVE-2026-110645 | Video-stitch before 2.0.0-beta.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying file names interpolated unquoted into shell-executed ffmpeg command lines. | Critical 9.3 | |
| CVE-2026-110644 | nodejs-whisper through 0.3.1 contains an OS command injection vulnerability in convertToWavType() that allows attackers to execute commands by supplying crafted audio file paths. | Critical 9.3 | |
| CVE-2026-110643 | transcribe2texts through 1.0.6 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted audioPath values to transcribeAudio(). | Critical 9.3 | |
| CVE-2026-110640 | Whisper-node through 1.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted filePath or whisperOptions.language values to whisper(). | Critical 9.3 | |
| CVE-2026-110639 | @mborne/extract before 0.2.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying shell metacharacters in archivePath or targetDir options. | Critical 9.3 | |
| CVE-2026-110638 | doc-recog through 1.1.6 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted document paths to recog() or tag(). | Critical 9.3 | |
| CVE-2026-110636 | pypdftk through 0.5 contains an OS command injection vulnerability in fill_form(), dump_data_fields(), and pdftk_cmd_util() that builds shell commands from caller-supplied paths. | Critical 9.3 | |
| CVE-2026-110635 | webp-converter before 3.0.0 contains an OS command injection vulnerability in src/webpconverter.js helpers that run libwebp binaries via execFile with shell enabled. | Critical 9.3 | |
| CVE-2026-110634 | git-diff before 2.0.7 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted strings to the gitDiff API. | Critical 9.3 | |
| CVE-2026-110632 | Report One MyReport Updater through 2.1.1 exposes an unauthenticated gRPC service on TCP port 9095 that allows remote attackers to redirect the SYSTEM updater by invoking the UpdateConfigReferent method. | Critical 9.2 | |
| CVE-2026-110631 | Komodo through 2.3.3 contains an authentication bypass vulnerability in the Periphery agent that allows unauthenticated attackers to connect as a trusted Core because empty core_public_keys and passkeys lists fail open by default. | Critical 9.3 | |
| CVE-2026-110628 | Kan 0.5.5 through 0.6.0 contains an unauthenticated server-side request forgery vulnerability in the /api/download/attatchment route due to an incomplete fix for CVE-2026-32255. | Critical 9.2 | |
| CVE-2026-110616 | NullHub through 2026.5.29 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/* management API because the auth_token field defaults to null and is never assigned. | Critical 9.2 | |
| CVE-2026-110612 | vlife through 2.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge JWTs using the hardcoded HS256 signing key in TokenUtil. | Critical 9.3 | |
| CVE-2020-37282 | office-converter through 1.0.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying a crafted fileName to generatePdf() or generateHtml(). | Critical 9.3 | |
| CVE-2020-37281 | Gravitee API Management through 4.12.22 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to impersonate any user by forging JWTs signed with the shipped default jwt.secret. | Critical 9.2 | |
| CVE-2026-108065 | Unauthenticated SQL Injection in Channel Software WebAlliance eCommerce | Critical 9.8 | |
| CVE-2026-16740 | Missing Authentication for Critical Function in TR7 Cyber Defense's TR7 ASP | Critical 9.8 | |
| CVE-2026-16741 | OS Command in TR7 Cyber Defense's TR7 ASP | Critical 9.8 | |
| CVE-2026-108291 | WordPress Affiliates plugin <= 7.0.1 - PHP Object Injection vulnerability | Critical 9.8 | |
| CVE-2026-107424 | WordPress Frontend Dashboard plugin <= 3.0.7 - Privilege Escalation vulnerability | Critical 9.8 | |
| CVE-2026-14851 | Unauthorised disclosure of information on Copart’s online billing service | Critical 9.2 | |
| CVE-2026-104748 | SimpleForm <= 3.10.0 - Unauthenticated Privilege Escalation to wp_capabilities Mass Assignment via simpleform_wp_register | Critical 9.8 | |
| CVE-2026-89310 | SQL Command Injection Vulnerability in JTL-WMS | Critical 9.4 | |
| CVE-2026-107594 | File Upload to Order < 1.1.4 - Unauthenticated Arbitrary File Deletion | Critical 10.0 | |
| CVE-2026-87855 | JTL-Connector for WooCommerce <= 2.4.3 - Unauthenticated Arbitrary File Upload via 'image.push' Method | Critical 9.8 | |
| CVE-2026-104800 | AGE-GATE <= 1.0 - Unauthenticated Remote Code Execution via PHP Code Injection via 'width'/'height' Parameters to Standalone admin.php | Critical 9.8 | |
| CVE-2026-110447 | Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. | Critical 9.2 | |
| CVE-2026-97657 | Abandoned Cart Pro for WooCommerce <= 10.8.0 - Unauthenticated Authentication Bypass via Malleable Encryption and Bypassable HMAC via Recovery Link 'validate' Parameter | Critical 9.8 | |
| CVE-2026-97668 | Abandoned Cart Pro for WooCommerce <= 10.8.0 - Unauthenticated SQL Injection via Guest Persistent Cart meta_value | Critical 9.8 | |
| CVE-2026-110002 | Snazzy Social Media Feed <= 2.5 - Unauthenticated Arbitrary File Upload via 'pluginURL' Parameter | Critical 9.8 | |
| CVE-2026-93388 | The Printcart Store (PCDesigner / NB Designer) plugin for WooCommerce is vulnerable to unauthenticated arbitrary file upload leading to remote code execution in all versions up to, and including, 2.9.1 The nbdesigner_copy_image_from_url… | Critical 9.8 | |
| CVE-2026-92097 | The Click to Chat for WhatsApp plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 4.44 This is due to the greetings_dialog() function building the {url} template placeholder from a… | Critical 9.1 | |
| CVE-2026-110392 | Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Samsung Open Source QA-Board allows : OS Command Injection. | Critical 9.8 | |
| CVE-2026-97381 | Legacy Update 1.12.0 through 1.13.1 contains an origin validation error in the IsPermitted method of its ActiveX control. | Critical 9.9 | |
| CVE-2026-93909 | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 is vulnerable by an authentication bypass vulnerability when samlWeb-2.0 feature is enabled. | Critical 9.1 | |
| CVE-2026-93895 | IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow an unauthenticated remote attacker to bypass access controls configured on gRPC service methods. | Critical 9.1 | |
| CVE-2026-90530 | ColdFusion RDS is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. | Critical 9.3 | |
| CVE-2026-110142 | Use after free in FileSystem in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. | Critical 9.6 | |
| CVE-2026-110159 | Incorrect authorization in Updater in Google Chrome prior to 155.0.8059.79 allowed a local attacker to execute arbitrary code outside the sandbox via a local program. | Critical 9.6 |
Showing 151–200 of 40,398. Narrow the filters to see the rest.
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status. Filter by severity and year here; the other filters work on the curated lists.