Vulnerability Intelligence · All CVEs
Every Published CVE, Searchable.
Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status.
Synced hourly · figures as of Oct 19, 2026
126,301 vulnerabilities · newest first
- CVE-2026-111613High 8.7AllData through 0.7.1 Unauthenticated JDBC Injection via /jobJdbcDatasource/testPublished Oct 16, 2026
- CVE-2026-111612High 8.7netdisk-fast-download through 0.4.8 Credential Disclosure via /v2/randomAuthPublished Oct 16, 2026
- CVE-2026-111607High 7.1Jeepay through 3.2.9 IDOR via POST /api/mch/payConfigsPublished Oct 16, 2026
- CVE-2026-111606High 8.6Huly Platform through 0.7.432 Account Takeover via mergeSpecifiedPersons RPCPublished Oct 16, 2026
- CVE-2026-111605High 8.6Jpom through 2.11.12 Cross-Workspace Authorization Bypass via SshFileControllerPublished Oct 16, 2026
- CVE-2026-102552High 8.2Improper verification of the source of a communication channel in FreeRTOS-Plus-TCP DNS resolverPublished Oct 16, 2026
- CVE-2026-86009High 8.2Prior to f05aeb8322e2f61096af6b089d61ba6f40587d96, domain managers can enable spoofing for hosted domains they do not control.Published Oct 16, 2026
- CVE-2026-86008High 7.2Prior to 8577c929b4ade04d3cd4210cf036601abd793556, a domain manager targeting an administrative account or another domain manager with greater privileges can reset passwords or…Published Oct 16, 2026
- CVE-2026-77474High 7.1Prior to 0.6.6, nested or unclosed substitutions are recursively rescanned after an inner scan returns…Published Oct 16, 2026
- CVE-2026-96424High 7.8Incorrect DBus policy for lomiri-upload-manager (part of lomiri-download-manager) allows arbitrary user to read arbitrary file as root over DBusPublished Oct 16, 2026
- CVE-2026-95859High 8.7Prior to 0.49.5, Gossipsub GRAFT control-message handling unconditionally adds attacker-supplied topic hashes to connected_peer.topics without…Published Oct 16, 2026
- CVE-2026-92263High 7.2Prior to 1.6.0, the api/admin/backup/restore endpoint interpolates an uploaded filename into a shell command.Published Oct 16, 2026
- CVE-2026-77630High 7.5Prior to 22.0.4, parse_hostport in upnp/src/genlib/net/uri/uri.c synchronously calls getaddrinfo while parse_uri is processing attacker-supplied hostnames from…Published Oct 16, 2026
- CVE-2026-68907High 8.2Prior to 1.6.2, checkDataSetAccess reverses the source and destination arguments to…Published Oct 16, 2026
- CVE-2026-68906High 8.7Prior to 1.6.2, parseUserInformation in src/mms/iso_acse/acse.c checks len for zero before…Published Oct 16, 2026
- CVE-2026-57488High 7.1Prior to 2.0.2, raw_to_int in upnp/src/genlib/net/http/httpparser.c parses Content-Length with strtol and casts the resulting long to a 32-bit int before the…Published Oct 16, 2026
- CVE-2026-57487High 7.5Prior to 2.0.2, Transfer-Encoding: chunked causes the HTTP parser in upnp/src/genlib/net/http/httpparser.c to leave parser->content_length at zero while…Published Oct 16, 2026
- CVE-2026-57486High 7.5Prior to 2.0.2, ixmlNode_compare in ixml/src/node.c passes the nullable nodeValue, namespaceURI, prefix, and localName fields directly to strcmp.Published Oct 16, 2026
- CVE-2026-48741High 7.5Prior to 1.6.2, alternateArrayAccess in src/mms/iso_mms/server/mms_read_service.c does not validate…Published Oct 16, 2026
- CVE-2026-48503High 7.5Prior to 1.6.2, the MMS file service in src/mms/iso_mms/server/mms_file_service.c accepts an…Published Oct 16, 2026
- CVE-2026-46472High 7.5While parsing an MP4 file, the isomp4 plugin's qtdemux_parse_chnl function may read past the end of a global array, potentially leading to information disclosure.Published Oct 16, 2026
- CVE-2026-42270High 7.5Prior to 24.05.50 and 25.03.44, star-rating/images/ and dashboards/images/screenshots/ are among public image and screenshot routes using the local fs…Published Oct 16, 2026
- CVE-2026-42269High 8.1Prior to 24.05.50 and 25.03.44, the authenticated data-migration deletion route in plugins/data_migration/api/api.js passes the user-controlled exportid to…Published Oct 16, 2026
- CVE-2026-41582High 7.5Prior to 24.05.50 and 25.03.44, public image and screenshot routes implemented in frontend/express/app.js, plugins/star-rating/frontend/app.js, and…Published Oct 16, 2026
- CVE-2026-102941High 7.5gomarkdown/markdown IsSafeURL panics on short URLsPublished Oct 16, 2026
- CVE-2026-97851High 8.8The storage status-change REST service allows location records still associated with DICOM instances to be changed to deletion-related states.Published Oct 16, 2026
- CVE-2026-88755High 7.8Z.ai ZCode v3.11.2.6792 was discovered to automatically establish connections with MCP servers declared inside a repository's workspace configuration, possibly allowing attackers to execute arbitrary code via opening a crafted repository.Published Oct 16, 2026
- CVE-2026-106705High 8.8ELADMIN (eladmin-mp) up to 2.7 contains an improper access control vulnerability in the role management module.Published Oct 16, 2026
- CVE-2026-92798High 8.1User Registration & Membership <= 5.2.8 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Referer Header via 'referrer_url' Smart TagPublished Oct 16, 2026
- CVE-2026-96660High 7.2User Registration & Membership <= 5.2.8 - Unauthenticated Stored Cross-Site Scripting via Checkbox Field ValuePublished Oct 16, 2026
- CVE-2026-107777High 7.1Thermo Fisher Torrent Suite Software Path TraversalPublished Oct 16, 2026
- CVE-2026-108123High 7.5WP Booking System <= 2.1.0.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'wpbs_action=email_logs' ActionPublished Oct 16, 2026
- CVE-2026-103899High 7.2EU VAT Assistant for WooCommerce <= 2.1.30.260413 - Unauthenticated Stored Cross-Site Scripting via 'vat_number' ParameterPublished Oct 16, 2026
- CVE-2026-105667High 8.7J4Care dcm4che Missing Authentication for Critical FunctionPublished Oct 16, 2026
- CVE-2026-109208High 7.2LearnPress <= 4.4.10 - Unauthenticated Stored Cross-Site Scripting via 'quantity' and 'order_comments' ParametersPublished Oct 16, 2026
- CVE-2026-101021High 8.7J4Care dcm4che Inefficient Algorithmic ComplexityPublished Oct 16, 2026
- CVE-2026-107762High 7.5Kirki <= 6.3.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via Context Smuggling via 'context' ParameterPublished Oct 16, 2026
- CVE-2026-104734High 7.2Kirki <= 6.3.2 - Authenticated (Administrator+) PHP Object Injection via Deserialization of Untrusted Input via ZIP Template ImportPublished Oct 16, 2026
- CVE-2026-105273High 8.7J4Care dcm4che Loop with Unreachable Exit ConditionPublished Oct 16, 2026
- CVE-2026-107621High 8.7J4Care dcm4che Loop with Unreachable Exit ConditionPublished Oct 16, 2026
- CVE-2026-111413High 8.8WordPress aThemeArt theme Helper plugin <= 1.0.8 - Cross Site Request Forgery (CSRF) vulnerabilityPublished Oct 16, 2026
- CVE-2026-107564High 8.7gocsaf/csaf: csaf_provider prone to uncontrolled resource consumptionPublished Oct 16, 2026
- CVE-2026-111396High 7.1WordPress Advanced Post Manager plugin <= 4.5.6 - Broken Access Control vulnerabilityPublished Oct 16, 2026
- CVE-2026-111399High 8.5WordPress MapSVG plugin <= 8.16.1 - SQL Injection vulnerabilityPublished Oct 16, 2026
- CVE-2026-105958High 7.5Spice-server: spice: heap oob read/write via unchecked migration data offsetsPublished Oct 16, 2026
- CVE-2026-68571High 8.8Apache Kylin: JDBC URL Whitelist Verification BypassPublished Oct 16, 2026
- CVE-2026-63618High 7.5Apache Kylin: Low-Privilege Config ExposurePublished Oct 16, 2026
- CVE-2026-105959High 7.5Spice-server: spice: heap buffer overflow via glz dictionary max_encoders integer truncationPublished Oct 16, 2026
- CVE-2026-107648High 7.2WP Sessions Time Monitoring Full Automatic <= 1.1.5 - Unauthenticated Stored Cross-Site Scripting via 'action' GET ParameterPublished Oct 16, 2026
- CVE-2026-109119High 8.8Missing Authorization in rdiffwebPublished Oct 16, 2026
| CVE | Title | Severity | Published |
|---|---|---|---|
| CVE-2026-111613 | AllData through 0.7.1 Unauthenticated JDBC Injection via /jobJdbcDatasource/test | High 8.7 | |
| CVE-2026-111612 | netdisk-fast-download through 0.4.8 Credential Disclosure via /v2/randomAuth | High 8.7 | |
| CVE-2026-111607 | Jeepay through 3.2.9 IDOR via POST /api/mch/payConfigs | High 7.1 | |
| CVE-2026-111606 | Huly Platform through 0.7.432 Account Takeover via mergeSpecifiedPersons RPC | High 8.6 | |
| CVE-2026-111605 | Jpom through 2.11.12 Cross-Workspace Authorization Bypass via SshFileController | High 8.6 | |
| CVE-2026-102552 | Improper verification of the source of a communication channel in FreeRTOS-Plus-TCP DNS resolver | High 8.2 | |
| CVE-2026-86009 | Prior to f05aeb8322e2f61096af6b089d61ba6f40587d96, domain managers can enable spoofing for hosted domains they do not control. | High 8.2 | |
| CVE-2026-86008 | Prior to 8577c929b4ade04d3cd4210cf036601abd793556, a domain manager targeting an administrative account or another domain manager with greater privileges can reset passwords or… | High 7.2 | |
| CVE-2026-77474 | Prior to 0.6.6, nested or unclosed substitutions are recursively rescanned after an inner scan returns… | High 7.1 | |
| CVE-2026-96424 | Incorrect DBus policy for lomiri-upload-manager (part of lomiri-download-manager) allows arbitrary user to read arbitrary file as root over DBus | High 7.8 | |
| CVE-2026-95859 | Prior to 0.49.5, Gossipsub GRAFT control-message handling unconditionally adds attacker-supplied topic hashes to connected_peer.topics without… | High 8.7 | |
| CVE-2026-92263 | Prior to 1.6.0, the api/admin/backup/restore endpoint interpolates an uploaded filename into a shell command. | High 7.2 | |
| CVE-2026-77630 | Prior to 22.0.4, parse_hostport in upnp/src/genlib/net/uri/uri.c synchronously calls getaddrinfo while parse_uri is processing attacker-supplied hostnames from… | High 7.5 | |
| CVE-2026-68907 | Prior to 1.6.2, checkDataSetAccess reverses the source and destination arguments to… | High 8.2 | |
| CVE-2026-68906 | Prior to 1.6.2, parseUserInformation in src/mms/iso_acse/acse.c checks len for zero before… | High 8.7 | |
| CVE-2026-57488 | Prior to 2.0.2, raw_to_int in upnp/src/genlib/net/http/httpparser.c parses Content-Length with strtol and casts the resulting long to a 32-bit int before the… | High 7.1 | |
| CVE-2026-57487 | Prior to 2.0.2, Transfer-Encoding: chunked causes the HTTP parser in upnp/src/genlib/net/http/httpparser.c to leave parser->content_length at zero while… | High 7.5 | |
| CVE-2026-57486 | Prior to 2.0.2, ixmlNode_compare in ixml/src/node.c passes the nullable nodeValue, namespaceURI, prefix, and localName fields directly to strcmp. | High 7.5 | |
| CVE-2026-48741 | Prior to 1.6.2, alternateArrayAccess in src/mms/iso_mms/server/mms_read_service.c does not validate… | High 7.5 | |
| CVE-2026-48503 | Prior to 1.6.2, the MMS file service in src/mms/iso_mms/server/mms_file_service.c accepts an… | High 7.5 | |
| CVE-2026-46472 | While parsing an MP4 file, the isomp4 plugin's qtdemux_parse_chnl function may read past the end of a global array, potentially leading to information disclosure. | High 7.5 | |
| CVE-2026-42270 | Prior to 24.05.50 and 25.03.44, star-rating/images/ and dashboards/images/screenshots/ are among public image and screenshot routes using the local fs… | High 7.5 | |
| CVE-2026-42269 | Prior to 24.05.50 and 25.03.44, the authenticated data-migration deletion route in plugins/data_migration/api/api.js passes the user-controlled exportid to… | High 8.1 | |
| CVE-2026-41582 | Prior to 24.05.50 and 25.03.44, public image and screenshot routes implemented in frontend/express/app.js, plugins/star-rating/frontend/app.js, and… | High 7.5 | |
| CVE-2026-102941 | gomarkdown/markdown IsSafeURL panics on short URLs | High 7.5 | |
| CVE-2026-97851 | The storage status-change REST service allows location records still associated with DICOM instances to be changed to deletion-related states. | High 8.8 | |
| CVE-2026-88755 | Z.ai ZCode v3.11.2.6792 was discovered to automatically establish connections with MCP servers declared inside a repository's workspace configuration, possibly allowing attackers to execute arbitrary code via opening a crafted repository. | High 7.8 | |
| CVE-2026-106705 | ELADMIN (eladmin-mp) up to 2.7 contains an improper access control vulnerability in the role management module. | High 8.8 | |
| CVE-2026-92798 | User Registration & Membership <= 5.2.8 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Referer Header via 'referrer_url' Smart Tag | High 8.1 | |
| CVE-2026-96660 | User Registration & Membership <= 5.2.8 - Unauthenticated Stored Cross-Site Scripting via Checkbox Field Value | High 7.2 | |
| CVE-2026-107777 | Thermo Fisher Torrent Suite Software Path Traversal | High 7.1 | |
| CVE-2026-108123 | WP Booking System <= 2.1.0.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'wpbs_action=email_logs' Action | High 7.5 | |
| CVE-2026-103899 | EU VAT Assistant for WooCommerce <= 2.1.30.260413 - Unauthenticated Stored Cross-Site Scripting via 'vat_number' Parameter | High 7.2 | |
| CVE-2026-105667 | J4Care dcm4che Missing Authentication for Critical Function | High 8.7 | |
| CVE-2026-109208 | LearnPress <= 4.4.10 - Unauthenticated Stored Cross-Site Scripting via 'quantity' and 'order_comments' Parameters | High 7.2 | |
| CVE-2026-101021 | J4Care dcm4che Inefficient Algorithmic Complexity | High 8.7 | |
| CVE-2026-107762 | Kirki <= 6.3.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via Context Smuggling via 'context' Parameter | High 7.5 | |
| CVE-2026-104734 | Kirki <= 6.3.2 - Authenticated (Administrator+) PHP Object Injection via Deserialization of Untrusted Input via ZIP Template Import | High 7.2 | |
| CVE-2026-105273 | J4Care dcm4che Loop with Unreachable Exit Condition | High 8.7 | |
| CVE-2026-107621 | J4Care dcm4che Loop with Unreachable Exit Condition | High 8.7 | |
| CVE-2026-111413 | WordPress aThemeArt theme Helper plugin <= 1.0.8 - Cross Site Request Forgery (CSRF) vulnerability | High 8.8 | |
| CVE-2026-107564 | gocsaf/csaf: csaf_provider prone to uncontrolled resource consumption | High 8.7 | |
| CVE-2026-111396 | WordPress Advanced Post Manager plugin <= 4.5.6 - Broken Access Control vulnerability | High 7.1 | |
| CVE-2026-111399 | WordPress MapSVG plugin <= 8.16.1 - SQL Injection vulnerability | High 8.5 | |
| CVE-2026-105958 | Spice-server: spice: heap oob read/write via unchecked migration data offsets | High 7.5 | |
| CVE-2026-68571 | Apache Kylin: JDBC URL Whitelist Verification Bypass | High 8.8 | |
| CVE-2026-63618 | Apache Kylin: Low-Privilege Config Exposure | High 7.5 | |
| CVE-2026-105959 | Spice-server: spice: heap buffer overflow via glz dictionary max_encoders integer truncation | High 7.5 | |
| CVE-2026-107648 | WP Sessions Time Monitoring Full Automatic <= 1.1.5 - Unauthenticated Stored Cross-Site Scripting via 'action' GET Parameter | High 7.2 | |
| CVE-2026-109119 | Missing Authorization in rdiffweb | High 8.8 |
Showing 151–200 of 126,301. Narrow the filters to see the rest.
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status. Filter by severity and year here; the other filters work on the curated lists.