Vulnerability Intelligence · All CVEs
Every Published CVE, Searchable.
Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status.
Synced hourly · figures as of Oct 19, 2026
11,291 vulnerabilities · newest first
- CVE-2026-78243Low 2.1Apache YuniKorn: LDAP Group provider panics on lowercase attribute namePublished Oct 7, 2026
- CVE-2026-92393Low 2.0Apache YuniKorn: Admission control bypass via workload UPDATE operationPublished Oct 7, 2026
- CVE-2026-104678Low 2.7CP Media Player < 1.3.4 - Contributor+ Media Player Settings UpdatePublished Oct 7, 2026
- CVE-2026-106589Low 2.9In sshd in OpenSSH through 10.6, in certain environments such as QNX 6 and SCO OpenServer 5, sshd-session can unexpectedly have root privileges.Published Oct 6, 2026
- CVE-2026-106588Low 3.1In sshd in OpenSSH through 10.6, use of the macOS 27 (or later) SDK has the side effect of loss of sandboxing, which is potentially unexpected.Published Oct 6, 2026
- CVE-2026-106587Low 3.3In sshd in OpenSSH before 10.6, the value "none" for a configuration option is sometimes interpreted as a filename but was intended to mean that a feature is disabled.Published Oct 6, 2026
- CVE-2026-106493Low 3.0Backstage: Cloud storage catalog locations may cross configured storage boundariesPublished Oct 6, 2026
- CVE-2026-106584Low 3.3In ssh-keygen in OpenSSH before 10.6, certificates could have incorrect expiration times because of Daylight Saving mishandling.Published Oct 6, 2026
- CVE-2026-106487Low 3.5Backstage: Unsupported catalog cluster authentication mode in kubernetes backendPublished Oct 6, 2026
- CVE-2026-106582Low 3.7In sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can be used even though this is contraindicated by the arXiv 2609.07709 "Crossing the Streams" findings.Published Oct 6, 2026
- CVE-2026-106449Low 3.7yawkat LZ4 Java: LZ4BlockInputStream with stopOnEmptyBlock=false recurses once per empty block, causing StackOverflowErrorPublished Oct 6, 2026
- CVE-2026-105111Low 2.3Apache Commons BCEL: Class2HTML emits unescaped class strings, enabling stored XSSPublished Oct 6, 2026
- CVE-2026-102164Low 2.3Security Advisory 0196Published Oct 6, 2026
- CVE-2026-106339Low 3.1Use of released resource in Core in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to potentially obtain cross-origin data via a crafted HTML page.Published Oct 6, 2026
- CVE-2026-106399Low 3.3Out of bounds read in Skia in Google Chrome prior to 155.0.8059.39 allowed a local attacker leveraging social engineering to potentially read memory via a crafted file.Published Oct 6, 2026
- CVE-2026-106210Low 3.1Observable discrepancy in Scroll in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a crafted Chrome extension.Published Oct 6, 2026
- CVE-2026-106180Low 3.1Observable discrepancy in Animation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially obtain cross-origin data via a crafted HTML page.Published Oct 6, 2026
- CVE-2026-106224Low 3.1Missing authorization in Google Lens in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data via a crafted HTML page.Published Oct 6, 2026
- CVE-2026-106101Low 3.1Prior to 2.32.2, the openURL() utility in ui/src/utils/open-url/open-url.js trusted window.SafariViewController whenever that global existed in an iOS…Published Oct 6, 2026
- CVE-2026-105800Low 3.7i18next-http-backend incomplete URL validation permits SSRFPublished Oct 6, 2026
- CVE-2026-105799Low 2.3LangChain: RediSearch Filter Injection via Unescaped Tag/Text ValuesPublished Oct 6, 2026
- CVE-2026-105795Low 3.1Kiota: Unsafe oauth_card_path references in Kiota-generated API plugin manifestsPublished Oct 6, 2026
- CVE-2026-56596Low 3.5HCL BigFix Service Management is affected by an Improper Input Validation vulnerability, which could allow an attacker to supply unexpected or malformed data, enabling processing errors, business logic bypasses, and unintended application…Published Oct 6, 2026
- CVE-2026-75820Low 1.8Integer Truncation Leading to Heap Corruption in GNU AspellPublished Oct 6, 2026
- CVE-2026-75819Low 1.8Out-of-bounds Read in GNU AspellPublished Oct 6, 2026
- CVE-2026-75818Low 1.8Heap Buffer Overflow in GNU Aspell's prezip utilityPublished Oct 6, 2026
- CVE-2026-105752Low 3.1vLLM: Harmony tool continuations drop cache_salt — restoring a cross-tenant prefix-cache membership oraclePublished Oct 5, 2026
- CVE-2026-103546Low 2.3Improper validation of Ops Manager configuration in MongoDB Kubernetes OperatorPublished Oct 5, 2026
- CVE-2026-105767Low 2.1Improper Neutralization of Special Elements used in an OS Command in the integrate-platform-docs composite GitHub Action of Chainguard Academy (edu) from commit 7375a80caabcc31c33ec90f29687ed78c13d16ff before commit…Published Oct 5, 2026
- CVE-2026-105766Low 2.3Use of the backend-facing $scheme variable in the trailing-slash directory redirect in nginx.conf of Chainguard Academy (edu) from commit 0b75ff98057f69b044a3e7194e428066ac5ad0d4 before commit 93dc0e50739c225f5aee2e803800a47fc0feb906…Published Oct 5, 2026
- CVE-2026-105652Low 2.3From 0.7.2 until 6.64.0, any staff-level user was able to determine the relative ordering of other staff users' hashed passwords.Published Oct 5, 2026
- CVE-2026-104029Low 3.3A local attacker can exploit this vulnerability by sending a specially crafted request to the autofs responder UNIX socket.Published Oct 5, 2026
- CVE-2026-105326Low 2.5Cups: cups: argument injection in mailto notifier via notify-recipient-uriPublished Oct 5, 2026
- CVE-2026-105712Low 3.6gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive.Published Oct 5, 2026
- CVE-2026-58856Low 3.3In returnOutputBufferLocked of DeprecatedCamera3StreamSplitter.cpp, there is a possible out-of-bounds read due to a missing bounds check.Published Oct 5, 2026
- CVE-2026-77803Low 3.6Front-end Desynchronization Vulnerability in Progress® Telerik® Fiddler® ClassicPublished Oct 5, 2026
- CVE-2026-59783Low 2.3The Zabbix Server/Proxy has a vulnerability where binary items can crash the Server/Proxy on certain NULL byte input leading to potential loss of availability.Published Oct 5, 2026
- CVE-2026-104808Low 1.9Mitel MiVoice Office 400 stored Cross-Site ScriptingPublished Oct 5, 2026
- CVE-2026-104807Low 1.9Mitel MiVoice Office 400 stored Cross-Site ScriptingPublished Oct 5, 2026
- CVE-2026-105249Low 2.4A weakness has been identified in vgmstream up to r2117.Published Oct 5, 2026
- CVE-2026-105217Low 2.3Cockpit CMS 2.12.0 before 2.14.1 Disabled TLS Verification via cron.phpPublished Oct 4, 2026
- CVE-2026-105214Low 2.3Zitadel before 4.16.2 contains a server-side request forgery vulnerability that allows attackers to make the server request internal resources through organization domain HTTP verification.Published Oct 4, 2026
- CVE-2026-105137Low 2.3Laradock Build Process Dockerfile code downloadPublished Oct 4, 2026
- CVE-2026-104119Low 3.5Simple Shopping Cart < 5.2.6 - Admin+ Stored XSS via PayPal API CredentialsPublished Oct 4, 2026
- CVE-2026-105118Low 2.3OpenAM before 16.1.3 contains an open redirect vulnerability that allows unauthenticated attackers to redirect users by supplying an unverified id_token_hint to the /oauth2/connect/endSession endpoint.Published Oct 3, 2026
- CVE-2026-96962Low 3.7Pie Register < 3.8.4.14 - Unauthenticated User Email Disclosure via Invitation CodePublished Oct 3, 2026
- CVE-2026-86834Low 3.7MetForm 2.2.1 - 4.3.0 - Unauthenticated Debug File Disclosure via HubSpot Forms IntegrationPublished Oct 3, 2026
- CVE-2026-80518Low 3.7WP Ultimate CSV Importer < 9.2 - Unauthenticated Imported Data Disclosure via Predictable Log PathPublished Oct 3, 2026
- CVE-2026-80517Low 3.5WP Ultimate CSV Importer 7.17 - 9.1 - Admin+ Stored XSS via ZIP Import SVG UploadPublished Oct 3, 2026
- CVE-2026-105083Low 1.8ImageMagick before 7.1.2-32 and 6.9.13-57 Security Policy Bypass via policy.xml DOCTYPEPublished Oct 3, 2026
| CVE | Title | Severity | Published |
|---|---|---|---|
| CVE-2026-78243 | Apache YuniKorn: LDAP Group provider panics on lowercase attribute name | Low 2.1 | |
| CVE-2026-92393 | Apache YuniKorn: Admission control bypass via workload UPDATE operation | Low 2.0 | |
| CVE-2026-104678 | CP Media Player < 1.3.4 - Contributor+ Media Player Settings Update | Low 2.7 | |
| CVE-2026-106589 | In sshd in OpenSSH through 10.6, in certain environments such as QNX 6 and SCO OpenServer 5, sshd-session can unexpectedly have root privileges. | Low 2.9 | |
| CVE-2026-106588 | In sshd in OpenSSH through 10.6, use of the macOS 27 (or later) SDK has the side effect of loss of sandboxing, which is potentially unexpected. | Low 3.1 | |
| CVE-2026-106587 | In sshd in OpenSSH before 10.6, the value "none" for a configuration option is sometimes interpreted as a filename but was intended to mean that a feature is disabled. | Low 3.3 | |
| CVE-2026-106493 | Backstage: Cloud storage catalog locations may cross configured storage boundaries | Low 3.0 | |
| CVE-2026-106584 | In ssh-keygen in OpenSSH before 10.6, certificates could have incorrect expiration times because of Daylight Saving mishandling. | Low 3.3 | |
| CVE-2026-106487 | Backstage: Unsupported catalog cluster authentication mode in kubernetes backend | Low 3.5 | |
| CVE-2026-106582 | In sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can be used even though this is contraindicated by the arXiv 2609.07709 "Crossing the Streams" findings. | Low 3.7 | |
| CVE-2026-106449 | yawkat LZ4 Java: LZ4BlockInputStream with stopOnEmptyBlock=false recurses once per empty block, causing StackOverflowError | Low 3.7 | |
| CVE-2026-105111 | Apache Commons BCEL: Class2HTML emits unescaped class strings, enabling stored XSS | Low 2.3 | |
| CVE-2026-102164 | Security Advisory 0196 | Low 2.3 | |
| CVE-2026-106339 | Use of released resource in Core in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to potentially obtain cross-origin data via a crafted HTML page. | Low 3.1 | |
| CVE-2026-106399 | Out of bounds read in Skia in Google Chrome prior to 155.0.8059.39 allowed a local attacker leveraging social engineering to potentially read memory via a crafted file. | Low 3.3 | |
| CVE-2026-106210 | Observable discrepancy in Scroll in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a crafted Chrome extension. | Low 3.1 | |
| CVE-2026-106180 | Observable discrepancy in Animation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially obtain cross-origin data via a crafted HTML page. | Low 3.1 | |
| CVE-2026-106224 | Missing authorization in Google Lens in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data via a crafted HTML page. | Low 3.1 | |
| CVE-2026-106101 | Prior to 2.32.2, the openURL() utility in ui/src/utils/open-url/open-url.js trusted window.SafariViewController whenever that global existed in an iOS… | Low 3.1 | |
| CVE-2026-105800 | i18next-http-backend incomplete URL validation permits SSRF | Low 3.7 | |
| CVE-2026-105799 | LangChain: RediSearch Filter Injection via Unescaped Tag/Text Values | Low 2.3 | |
| CVE-2026-105795 | Kiota: Unsafe oauth_card_path references in Kiota-generated API plugin manifests | Low 3.1 | |
| CVE-2026-56596 | HCL BigFix Service Management is affected by an Improper Input Validation vulnerability, which could allow an attacker to supply unexpected or malformed data, enabling processing errors, business logic bypasses, and unintended application… | Low 3.5 | |
| CVE-2026-75820 | Integer Truncation Leading to Heap Corruption in GNU Aspell | Low 1.8 | |
| CVE-2026-75819 | Out-of-bounds Read in GNU Aspell | Low 1.8 | |
| CVE-2026-75818 | Heap Buffer Overflow in GNU Aspell's prezip utility | Low 1.8 | |
| CVE-2026-105752 | vLLM: Harmony tool continuations drop cache_salt — restoring a cross-tenant prefix-cache membership oracle | Low 3.1 | |
| CVE-2026-103546 | Improper validation of Ops Manager configuration in MongoDB Kubernetes Operator | Low 2.3 | |
| CVE-2026-105767 | Improper Neutralization of Special Elements used in an OS Command in the integrate-platform-docs composite GitHub Action of Chainguard Academy (edu) from commit 7375a80caabcc31c33ec90f29687ed78c13d16ff before commit… | Low 2.1 | |
| CVE-2026-105766 | Use of the backend-facing $scheme variable in the trailing-slash directory redirect in nginx.conf of Chainguard Academy (edu) from commit 0b75ff98057f69b044a3e7194e428066ac5ad0d4 before commit 93dc0e50739c225f5aee2e803800a47fc0feb906… | Low 2.3 | |
| CVE-2026-105652 | From 0.7.2 until 6.64.0, any staff-level user was able to determine the relative ordering of other staff users' hashed passwords. | Low 2.3 | |
| CVE-2026-104029 | A local attacker can exploit this vulnerability by sending a specially crafted request to the autofs responder UNIX socket. | Low 3.3 | |
| CVE-2026-105326 | Cups: cups: argument injection in mailto notifier via notify-recipient-uri | Low 2.5 | |
| CVE-2026-105712 | gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive. | Low 3.6 | |
| CVE-2026-58856 | In returnOutputBufferLocked of DeprecatedCamera3StreamSplitter.cpp, there is a possible out-of-bounds read due to a missing bounds check. | Low 3.3 | |
| CVE-2026-77803 | Front-end Desynchronization Vulnerability in Progress® Telerik® Fiddler® Classic | Low 3.6 | |
| CVE-2026-59783 | The Zabbix Server/Proxy has a vulnerability where binary items can crash the Server/Proxy on certain NULL byte input leading to potential loss of availability. | Low 2.3 | |
| CVE-2026-104808 | Mitel MiVoice Office 400 stored Cross-Site Scripting | Low 1.9 | |
| CVE-2026-104807 | Mitel MiVoice Office 400 stored Cross-Site Scripting | Low 1.9 | |
| CVE-2026-105249 | A weakness has been identified in vgmstream up to r2117. | Low 2.4 | |
| CVE-2026-105217 | Cockpit CMS 2.12.0 before 2.14.1 Disabled TLS Verification via cron.php | Low 2.3 | |
| CVE-2026-105214 | Zitadel before 4.16.2 contains a server-side request forgery vulnerability that allows attackers to make the server request internal resources through organization domain HTTP verification. | Low 2.3 | |
| CVE-2026-105137 | Laradock Build Process Dockerfile code download | Low 2.3 | |
| CVE-2026-104119 | Simple Shopping Cart < 5.2.6 - Admin+ Stored XSS via PayPal API Credentials | Low 3.5 | |
| CVE-2026-105118 | OpenAM before 16.1.3 contains an open redirect vulnerability that allows unauthenticated attackers to redirect users by supplying an unverified id_token_hint to the /oauth2/connect/endSession endpoint. | Low 2.3 | |
| CVE-2026-96962 | Pie Register < 3.8.4.14 - Unauthenticated User Email Disclosure via Invitation Code | Low 3.7 | |
| CVE-2026-86834 | MetForm 2.2.1 - 4.3.0 - Unauthenticated Debug File Disclosure via HubSpot Forms Integration | Low 3.7 | |
| CVE-2026-80518 | WP Ultimate CSV Importer < 9.2 - Unauthenticated Imported Data Disclosure via Predictable Log Path | Low 3.7 | |
| CVE-2026-80517 | WP Ultimate CSV Importer 7.17 - 9.1 - Admin+ Stored XSS via ZIP Import SVG Upload | Low 3.5 | |
| CVE-2026-105083 | ImageMagick before 7.1.2-32 and 6.9.13-57 Security Policy Bypass via policy.xml DOCTYPE | Low 1.8 |
Showing 201–250 of 11,291. Narrow the filters to see the rest.
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status. Filter by severity and year here; the other filters work on the curated lists.