Vulnerability Intelligence · All CVEs
Every Published CVE, Searchable.
Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status.
Synced hourly · figures as of Oct 19, 2026
138,379 vulnerabilities · newest first
- CVE-2026-112011Medium 5.8libtta through 2.3 contains an integer overflow vulnerability in tta_decoder_init_get_info() that allows attackers to cause a heap buffer overflow on 32-bit builds via unvalidated header fields.Published Oct 18, 2026
- CVE-2026-112010Medium 6.8smpeg through 2.0.0 contains an integer underflow vulnerability in stream_header() in MPEGsystem.cpp that allows attackers to wrap packet_size by declaring an undersized packet length.Published Oct 18, 2026
- CVE-2026-112009Medium 6.8smpeg through 2.0.0 contains a heap out-of-bounds read vulnerability in MPEGsystem::FillBuffer() that allows attackers to read past the 16384-byte buffer by supplying a crafted system header stream table.Published Oct 18, 2026
- CVE-2026-112008Medium 6.9libmng through 2.0.3 contains a heap-based buffer overflow vulnerability in mng_read_ordr() that allows attackers to corrupt heap memory because ORDR entry buffers are sized by 5-byte on-wire records instead of 8-byte in-memory entries.Published Oct 18, 2026
- CVE-2026-112007Medium 6.9Schism Tracker through 20260524 contains a heap out-of-bounds write vulnerability in fmt_ult_load_song() in fmt/ult.c that fails to clamp the one-byte sample count to MAX_SAMPLES.Published Oct 18, 2026
- CVE-2026-112003Medium 6.0ProjectSend 2.0.0 before 2.7.0 contains a path validation flaw in OrphanFileScanner::isOrphan() that allows staff with import_orphans permission to treat tracked files as orphans.Published Oct 18, 2026
- CVE-2026-111985Medium 5.3This impacts the function read_metadata_from_safetensors of the file modules/sd_models.py of the component Metadata Extraction.Published Oct 18, 2026
- CVE-2026-111984Medium 5.3The manipulation of the argument…Published Oct 18, 2026
- CVE-2026-110885Medium 6.5Improper Control of Generation of Code ('Code Injection') vulnerability in HivePress HivePress hivepress allows Code Injection.This issue affects HivePress: from n/a through 1.7.32.Published Oct 18, 2026
- CVE-2026-110883Medium 6.5Authentication Bypass by Primary Weakness vulnerability in VideoWhisper.com 2Way VideoCalls and Random Chat webcam-2way-videochat allows Authentication Abuse.This issue affects 2Way VideoCalls and Random Chat: from n/a through 6.1.5.Published Oct 18, 2026
- CVE-2026-110880Medium 6.5Missing Authorization vulnerability in Kit Kit (formerly ConvertKit) convertkit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kit (formerly ConvertKit): from n/a through 3.4.6.Published Oct 18, 2026
- CVE-2026-110365Medium 6.5Missing Authorization vulnerability in WPExperts Advanced File Manager file-manager-advanced allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced File Manager: from n/a through 5.4.14.Published Oct 18, 2026
- CVE-2026-87844Medium 5.3The PickPlugins Product Designer for WooCommerce WordPress plugin through 1.0.40 does not perform any capability check and its nonce verification is inverted, accepting requests with an invalid or absent nonce while rejecting valid ones,…Published Oct 18, 2026
- CVE-2026-111942Medium 5.3A weakness has been identified in hrisikeshpal Blood_Bank_Management_System 1.0.0.Published Oct 18, 2026
- CVE-2026-111877Medium 5.3A vulnerability was determined in dext34-morgan Books4Cash up to a8d3e357db75c07ac5ffbadcbaee2aeb4db3e571.Published Oct 18, 2026
- CVE-2026-111041Medium 4.9The AI Engine WordPress plugin before 3.7.9 does not verify that the user performing certain AI media management actions owns or is otherwise allowed to edit the targeted object, allowing users with the Editor role or above to modify, or…Published Oct 18, 2026
- CVE-2026-110976Medium 4.9The AI Engine WordPress plugin before 3.7.9 does not check that the item passed to one of its media actions belongs to the requesting user before converting it to an attachment and permanently deleting it, allowing users with the Editor…Published Oct 18, 2026
- CVE-2026-110070Medium 6.5The Modern Events Calendar Lite WordPress plugin before 7.36.4 does not verify that a user is authorized to edit the target post before updating it, allowing authenticated users with the Subscriber role to modify the title, content, and…Published Oct 18, 2026
- CVE-2026-110069Medium 4.3The Modern Events Calendar Lite WordPress plugin before 7.37.0 does not perform capability, nonce, or ownership checks before returning event booking and attendee data, allowing any authenticated user, including Subscribers, to disclose…Published Oct 18, 2026
- CVE-2026-110035Medium 4.3The Salon Booking System WordPress plugin before 10.31.11 does not restrict one of its REST API endpoints to salon staff, allowing any authenticated user, such as a subscriber, to retrieve every discount coupon configured on the site,…Published Oct 18, 2026
- CVE-2026-110033Medium 6.8The Salon Booking System WordPress plugin before 10.31.11 does not validate a user-supplied image URL before fetching it server-side and writing the response to a publicly accessible location under an attacker-chosen filename, allowing…Published Oct 18, 2026
- CVE-2026-110032Medium 5.5The Salon Booking System WordPress plugin before 10.31.11 does not restrict which user account its salon staff roles may edit through the customers management screen, allowing users with the Salon Staff or Salon Worker role to reset any…Published Oct 18, 2026
- CVE-2026-110026Medium 4.9The Tasty Recipes Lite WordPress plugin before 1.2.11 does not correctly check user capabilities when creating, renaming and deleting taxonomy terms, allowing users with a role as low as Contributor to add, rename and permanently delete…Published Oct 18, 2026
- CVE-2026-109937Medium 5.4The Otter Blocks WordPress plugin before 3.2.3 does not validate that a user-supplied return URL belongs to the site before using it to build the return destination of a Stripe Checkout session, allowing unauthenticated attackers to…Published Oct 18, 2026
- CVE-2026-111876Medium 4.8Affected by this issue is the function Entry::output of the file television/channels/entry.rs.Published Oct 18, 2026
- CVE-2026-111875Medium 5.1Affected by this vulnerability is an unknown functionality of the file app/Http/Requests/Api/V1/SaveScheduledRestoreRequest.php of the component Scheduled Restore.Published Oct 18, 2026
- CVE-2026-111874Medium 6.3This manipulation of the argument applyToJobSubAction causes improper restriction of…Published Oct 18, 2026
- CVE-2026-111873Medium 6.9A vulnerability was detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449.Published Oct 18, 2026
- CVE-2026-111872Medium 6.9A security vulnerability has been detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449.Published Oct 18, 2026
- CVE-2026-111871Medium 6.9A weakness has been identified in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449.Published Oct 18, 2026
- CVE-2026-111870Medium 6.9Performing a manipulation results in…Published Oct 18, 2026
- CVE-2026-111869Medium 6.9Such manipulation of the argument X-Forwarded-For leads to reliance on untrusted inputs in a security decision.Published Oct 18, 2026
- CVE-2026-111997Medium 6.3ip-address before 10.7.4 allows a denial of service (CPU consumption from quadratic complexity, and application stall) via many % characters in input reaching a function call that uses the Address6 constructor.Published Oct 18, 2026
- CVE-2026-111868Medium 5.3A vulnerability was determined in datastax pulsar-jms up to 9.0.3.Published Oct 18, 2026
- CVE-2026-111866Medium 6.9A weakness has been identified in nemoTyrant manong up to 7c9e5228e133b9267ad3a415833bc9bb53193bb4.Published Oct 17, 2026
- CVE-2026-111865Medium 4.8The manipulation of…Published Oct 17, 2026
- CVE-2026-111934Medium 6.3Coder before 2.34.7 contains an IP spoofing vulnerability in the ExtractRealIPAddress middleware that trusts the leftmost, client-supplied X-Forwarded-For value instead of the client IP appended by a reverse proxy.Published Oct 17, 2026
- CVE-2026-111933Medium 6.3Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a user enumeration vulnerability because userpassword.Compare() substitutes a placeholder hash derived from the string "hunter2" when a…Published Oct 17, 2026
- CVE-2026-111932Medium 4.8Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a stored HTML injection vulnerability because the ApplicationName and LogoURL appearance settings are rendered into HTML output without…Published Oct 17, 2026
- CVE-2026-111931Medium 5.3Coder from 2.0.0 before 2.34.8 contains an open redirect vulnerability in handleAPIKeySmuggling that allows attackers to redirect users externally via unsanitized r.URL.Path values.Published Oct 17, 2026
- CVE-2026-111930Medium 5.3Coder from 2.26.0 before 2.34.8 contains an incorrect authorization flaw in the GET /api/v2/workspaces/{id}/acl endpoint, which checks only workspace read access and then fetches group members using an elevated system context.Published Oct 17, 2026
- CVE-2026-111929Medium 6.0Coder from 2.30.0 before 2.34.8 contains an authorization bypass vulnerability in the provisioner daemon DownloadFile gRPC handler that allows authenticated provisioner daemons to download other organizations' cached Terraform module…Published Oct 17, 2026
- CVE-2026-111928Medium 5.3Coder from 2.0.0 before 2.34.8 contains an incorrect authorization vulnerability in the acl_allow rule of coderd/rbac/policy.rego, which does not verify organization membership for per-user ACL entries, and organization member removal…Published Oct 17, 2026
- CVE-2026-111926Medium 4.8Coder from 2.10.0 before 2.34.8 has an unauthenticated agent debug HTTP server on 127.0.0.1:2113 whose /debug/manifest handler returns the full agent manifest, including template-provided environment variable values.Published Oct 17, 2026
- CVE-2026-111921Medium 5.3Vikunja 0.13.0 before 2.7.0 contains an incorrect authorization vulnerability that allows project members with Write permission to delete admin-tier link shares because the delete permission check reads an unloaded share object.Published Oct 17, 2026
- CVE-2026-111920Medium 5.3Vikunja 2.6.0 contains a broken access control flaw in getProjectAccessForUser (pkg/models/project_access.go), which resolves a user's effective project permission as the maximum over the project tree, silently overriding explicit…Published Oct 17, 2026
- CVE-2026-111918Medium 5.3Vikunja from 1.0.0-rc0 before 2.7.0 contains an improper authorization vulnerability in RecalculateTaskPositions that allows authenticated users with zero accessible projects to write task_positions rows for all tasks instance-wide.Published Oct 17, 2026
- CVE-2026-111916Medium 6.9Admidio before 5.0.16 contains an information disclosure vulnerability that allows unauthenticated attackers to view role-restricted weblinks because rss/links.php omits the category_view role-visibility filter.Published Oct 17, 2026
- CVE-2026-111913Medium 5.3Admidio from 5.0.0 before 5.0.16 contains an authorization bypass vulnerability that allows authenticated users to export lists despite export restrictions by requesting mode=pdfl.Published Oct 17, 2026
- CVE-2026-111904Medium 6.9phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an information disclosure vulnerability that allows unauthenticated attackers to read hidden open questions due to an inverted api.onlyPublicQuestions check in OpenQuestionController.Published Oct 17, 2026
| CVE | Title | Severity | Published |
|---|---|---|---|
| CVE-2026-112011 | libtta through 2.3 contains an integer overflow vulnerability in tta_decoder_init_get_info() that allows attackers to cause a heap buffer overflow on 32-bit builds via unvalidated header fields. | Medium 5.8 | |
| CVE-2026-112010 | smpeg through 2.0.0 contains an integer underflow vulnerability in stream_header() in MPEGsystem.cpp that allows attackers to wrap packet_size by declaring an undersized packet length. | Medium 6.8 | |
| CVE-2026-112009 | smpeg through 2.0.0 contains a heap out-of-bounds read vulnerability in MPEGsystem::FillBuffer() that allows attackers to read past the 16384-byte buffer by supplying a crafted system header stream table. | Medium 6.8 | |
| CVE-2026-112008 | libmng through 2.0.3 contains a heap-based buffer overflow vulnerability in mng_read_ordr() that allows attackers to corrupt heap memory because ORDR entry buffers are sized by 5-byte on-wire records instead of 8-byte in-memory entries. | Medium 6.9 | |
| CVE-2026-112007 | Schism Tracker through 20260524 contains a heap out-of-bounds write vulnerability in fmt_ult_load_song() in fmt/ult.c that fails to clamp the one-byte sample count to MAX_SAMPLES. | Medium 6.9 | |
| CVE-2026-112003 | ProjectSend 2.0.0 before 2.7.0 contains a path validation flaw in OrphanFileScanner::isOrphan() that allows staff with import_orphans permission to treat tracked files as orphans. | Medium 6.0 | |
| CVE-2026-111985 | This impacts the function read_metadata_from_safetensors of the file modules/sd_models.py of the component Metadata Extraction. | Medium 5.3 | |
| CVE-2026-111984 | The manipulation of the argument… | Medium 5.3 | |
| CVE-2026-110885 | Improper Control of Generation of Code ('Code Injection') vulnerability in HivePress HivePress hivepress allows Code Injection.This issue affects HivePress: from n/a through 1.7.32. | Medium 6.5 | |
| CVE-2026-110883 | Authentication Bypass by Primary Weakness vulnerability in VideoWhisper.com 2Way VideoCalls and Random Chat webcam-2way-videochat allows Authentication Abuse.This issue affects 2Way VideoCalls and Random Chat: from n/a through 6.1.5. | Medium 6.5 | |
| CVE-2026-110880 | Missing Authorization vulnerability in Kit Kit (formerly ConvertKit) convertkit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kit (formerly ConvertKit): from n/a through 3.4.6. | Medium 6.5 | |
| CVE-2026-110365 | Missing Authorization vulnerability in WPExperts Advanced File Manager file-manager-advanced allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced File Manager: from n/a through 5.4.14. | Medium 6.5 | |
| CVE-2026-87844 | The PickPlugins Product Designer for WooCommerce WordPress plugin through 1.0.40 does not perform any capability check and its nonce verification is inverted, accepting requests with an invalid or absent nonce while rejecting valid ones,… | Medium 5.3 | |
| CVE-2026-111942 | A weakness has been identified in hrisikeshpal Blood_Bank_Management_System 1.0.0. | Medium 5.3 | |
| CVE-2026-111877 | A vulnerability was determined in dext34-morgan Books4Cash up to a8d3e357db75c07ac5ffbadcbaee2aeb4db3e571. | Medium 5.3 | |
| CVE-2026-111041 | The AI Engine WordPress plugin before 3.7.9 does not verify that the user performing certain AI media management actions owns or is otherwise allowed to edit the targeted object, allowing users with the Editor role or above to modify, or… | Medium 4.9 | |
| CVE-2026-110976 | The AI Engine WordPress plugin before 3.7.9 does not check that the item passed to one of its media actions belongs to the requesting user before converting it to an attachment and permanently deleting it, allowing users with the Editor… | Medium 4.9 | |
| CVE-2026-110070 | The Modern Events Calendar Lite WordPress plugin before 7.36.4 does not verify that a user is authorized to edit the target post before updating it, allowing authenticated users with the Subscriber role to modify the title, content, and… | Medium 6.5 | |
| CVE-2026-110069 | The Modern Events Calendar Lite WordPress plugin before 7.37.0 does not perform capability, nonce, or ownership checks before returning event booking and attendee data, allowing any authenticated user, including Subscribers, to disclose… | Medium 4.3 | |
| CVE-2026-110035 | The Salon Booking System WordPress plugin before 10.31.11 does not restrict one of its REST API endpoints to salon staff, allowing any authenticated user, such as a subscriber, to retrieve every discount coupon configured on the site,… | Medium 4.3 | |
| CVE-2026-110033 | The Salon Booking System WordPress plugin before 10.31.11 does not validate a user-supplied image URL before fetching it server-side and writing the response to a publicly accessible location under an attacker-chosen filename, allowing… | Medium 6.8 | |
| CVE-2026-110032 | The Salon Booking System WordPress plugin before 10.31.11 does not restrict which user account its salon staff roles may edit through the customers management screen, allowing users with the Salon Staff or Salon Worker role to reset any… | Medium 5.5 | |
| CVE-2026-110026 | The Tasty Recipes Lite WordPress plugin before 1.2.11 does not correctly check user capabilities when creating, renaming and deleting taxonomy terms, allowing users with a role as low as Contributor to add, rename and permanently delete… | Medium 4.9 | |
| CVE-2026-109937 | The Otter Blocks WordPress plugin before 3.2.3 does not validate that a user-supplied return URL belongs to the site before using it to build the return destination of a Stripe Checkout session, allowing unauthenticated attackers to… | Medium 5.4 | |
| CVE-2026-111876 | Affected by this issue is the function Entry::output of the file television/channels/entry.rs. | Medium 4.8 | |
| CVE-2026-111875 | Affected by this vulnerability is an unknown functionality of the file app/Http/Requests/Api/V1/SaveScheduledRestoreRequest.php of the component Scheduled Restore. | Medium 5.1 | |
| CVE-2026-111874 | This manipulation of the argument applyToJobSubAction causes improper restriction of… | Medium 6.3 | |
| CVE-2026-111873 | A vulnerability was detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. | Medium 6.9 | |
| CVE-2026-111872 | A security vulnerability has been detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. | Medium 6.9 | |
| CVE-2026-111871 | A weakness has been identified in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. | Medium 6.9 | |
| CVE-2026-111870 | Performing a manipulation results in… | Medium 6.9 | |
| CVE-2026-111869 | Such manipulation of the argument X-Forwarded-For leads to reliance on untrusted inputs in a security decision. | Medium 6.9 | |
| CVE-2026-111997 | ip-address before 10.7.4 allows a denial of service (CPU consumption from quadratic complexity, and application stall) via many % characters in input reaching a function call that uses the Address6 constructor. | Medium 6.3 | |
| CVE-2026-111868 | A vulnerability was determined in datastax pulsar-jms up to 9.0.3. | Medium 5.3 | |
| CVE-2026-111866 | A weakness has been identified in nemoTyrant manong up to 7c9e5228e133b9267ad3a415833bc9bb53193bb4. | Medium 6.9 | |
| CVE-2026-111865 | The manipulation of… | Medium 4.8 | |
| CVE-2026-111934 | Coder before 2.34.7 contains an IP spoofing vulnerability in the ExtractRealIPAddress middleware that trusts the leftmost, client-supplied X-Forwarded-For value instead of the client IP appended by a reverse proxy. | Medium 6.3 | |
| CVE-2026-111933 | Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a user enumeration vulnerability because userpassword.Compare() substitutes a placeholder hash derived from the string "hunter2" when a… | Medium 6.3 | |
| CVE-2026-111932 | Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a stored HTML injection vulnerability because the ApplicationName and LogoURL appearance settings are rendered into HTML output without… | Medium 4.8 | |
| CVE-2026-111931 | Coder from 2.0.0 before 2.34.8 contains an open redirect vulnerability in handleAPIKeySmuggling that allows attackers to redirect users externally via unsanitized r.URL.Path values. | Medium 5.3 | |
| CVE-2026-111930 | Coder from 2.26.0 before 2.34.8 contains an incorrect authorization flaw in the GET /api/v2/workspaces/{id}/acl endpoint, which checks only workspace read access and then fetches group members using an elevated system context. | Medium 5.3 | |
| CVE-2026-111929 | Coder from 2.30.0 before 2.34.8 contains an authorization bypass vulnerability in the provisioner daemon DownloadFile gRPC handler that allows authenticated provisioner daemons to download other organizations' cached Terraform module… | Medium 6.0 | |
| CVE-2026-111928 | Coder from 2.0.0 before 2.34.8 contains an incorrect authorization vulnerability in the acl_allow rule of coderd/rbac/policy.rego, which does not verify organization membership for per-user ACL entries, and organization member removal… | Medium 5.3 | |
| CVE-2026-111926 | Coder from 2.10.0 before 2.34.8 has an unauthenticated agent debug HTTP server on 127.0.0.1:2113 whose /debug/manifest handler returns the full agent manifest, including template-provided environment variable values. | Medium 4.8 | |
| CVE-2026-111921 | Vikunja 0.13.0 before 2.7.0 contains an incorrect authorization vulnerability that allows project members with Write permission to delete admin-tier link shares because the delete permission check reads an unloaded share object. | Medium 5.3 | |
| CVE-2026-111920 | Vikunja 2.6.0 contains a broken access control flaw in getProjectAccessForUser (pkg/models/project_access.go), which resolves a user's effective project permission as the maximum over the project tree, silently overriding explicit… | Medium 5.3 | |
| CVE-2026-111918 | Vikunja from 1.0.0-rc0 before 2.7.0 contains an improper authorization vulnerability in RecalculateTaskPositions that allows authenticated users with zero accessible projects to write task_positions rows for all tasks instance-wide. | Medium 5.3 | |
| CVE-2026-111916 | Admidio before 5.0.16 contains an information disclosure vulnerability that allows unauthenticated attackers to view role-restricted weblinks because rss/links.php omits the category_view role-visibility filter. | Medium 6.9 | |
| CVE-2026-111913 | Admidio from 5.0.0 before 5.0.16 contains an authorization bypass vulnerability that allows authenticated users to export lists despite export restrictions by requesting mode=pdfl. | Medium 5.3 | |
| CVE-2026-111904 | phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an information disclosure vulnerability that allows unauthenticated attackers to read hidden open questions due to an inverted api.onlyPublicQuestions check in OpenQuestionController. | Medium 6.9 |
Showing 201–250 of 138,379. Narrow the filters to see the rest.
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status. Filter by severity and year here; the other filters work on the curated lists.