Vulnerability Intelligence · All CVEs
Every Published CVE, Searchable.
Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status.
Synced hourly · figures as of Oct 19, 2026
11,299 vulnerabilities · newest first
- CVE-2026-105137Low 2.3Laradock Build Process Dockerfile code downloadPublished Oct 4, 2026
- CVE-2026-104119Low 3.5Simple Shopping Cart < 5.2.6 - Admin+ Stored XSS via PayPal API CredentialsPublished Oct 4, 2026
- CVE-2026-105118Low 2.3OpenAM before 16.1.3 contains an open redirect vulnerability that allows unauthenticated attackers to redirect users by supplying an unverified id_token_hint to the /oauth2/connect/endSession endpoint.Published Oct 3, 2026
- CVE-2026-96962Low 3.7Pie Register < 3.8.4.14 - Unauthenticated User Email Disclosure via Invitation CodePublished Oct 3, 2026
- CVE-2026-86834Low 3.7MetForm 2.2.1 - 4.3.0 - Unauthenticated Debug File Disclosure via HubSpot Forms IntegrationPublished Oct 3, 2026
- CVE-2026-80518Low 3.7WP Ultimate CSV Importer < 9.2 - Unauthenticated Imported Data Disclosure via Predictable Log PathPublished Oct 3, 2026
- CVE-2026-80517Low 3.5WP Ultimate CSV Importer 7.17 - 9.1 - Admin+ Stored XSS via ZIP Import SVG UploadPublished Oct 3, 2026
- CVE-2026-105083Low 1.8ImageMagick before 7.1.2-32 and 6.9.13-57 Security Policy Bypass via policy.xml DOCTYPEPublished Oct 3, 2026
- CVE-2026-105051Low 1.9Denuvo Anti-Tamper through 2026-03-04 allows bypass of a hypervisor presence check via CPUID interception (SimpleSvm.sys on AMD; hyperkd.sys and hyperhv.dll on Intel).Published Oct 2, 2026
- CVE-2026-105043Low 3.6MathWorks Simulink before R2026b, when showing a crafted .slx file, can have blocks that are never visible in the Simulink Editor but will cause code execution.Published Oct 2, 2026
- CVE-2026-104994Low 2.5Trivy before 0.71.0 allows directory traversal in Terraform filesystem functions when they try to access pathnames above the scan root.Published Oct 2, 2026
- CVE-2026-104855Low 2.0Wasmtime: Preemption and traps during bulk operations enable breaking internal VM statePublished Oct 2, 2026
- CVE-2026-39601Low 3.7WordPress Booking Calendar plugin <= 11.8.4 - Race Condition vulnerabilityPublished Oct 2, 2026
- CVE-2026-104415Low 2.3Ghost from 0.7.2 before 6.64.0 contains an information disclosure vulnerability in the Admin API that allows staff-level users to determine the relative ordering of other staff users' password hashes.Published Oct 2, 2026
- CVE-2026-102002Low 3.1Otter Blocks <= 3.2.6 - Authenticated (Subscriber+) Sensitive Information Exposure in Form Submissions Dashboard WidgetPublished Oct 2, 2026
- CVE-2026-91023Low 3.1Motors – Car Dealership & Classified Listings < 1.4.124 - Subscriber+ Cross-User Post Meta Modification via stm_make_featuredPublished Oct 2, 2026
- CVE-2026-103923Low 2.1KaTeX: Existing prototype pollution can bypass trust restrictionsPublished Oct 1, 2026
- CVE-2026-21833Low 3.7HCL AION is susceptible to a Missing "Content-Security-Policy" header Vulnerability (CVE-2026-21833)Published Oct 1, 2026
- CVE-2026-67172Low 3.7HCL BigFix Service Management is affected by multiple security vulnerabilities.Published Oct 1, 2026
- CVE-2026-42356Low 3.7Apache HTTP Server: limited RCE for some internal redirects to non-CGI files in CGI directoriesPublished Oct 1, 2026
- CVE-2026-56599Low 2.2HCL BigFix Service Management is affected by an Insecure Cookie Attribute Configuration vulnerability, which could allow an attacker to exploit missing security attributes such as SameSite, HttpOnly, Secure, and restrictive Paths,…Published Oct 1, 2026
- CVE-2026-66253Low 3.1HCL iControl is affected by a Session Timeout vulnerabilityPublished Oct 1, 2026
- CVE-2026-66249Low 3.1HCL iControl is affected by a Missing Secure Attribute vulnerabilityPublished Oct 1, 2026
- CVE-2026-66248Low 3.1HCL iControl is affected by an Improper Error Handling vulnerabilityPublished Oct 1, 2026
- CVE-2026-94220Low 2.1Cross-Site request forgery (CSRF) vulnerability in feishu-auth and dingtalk-auth plugins in Apache APISIX.Published Oct 1, 2026
- CVE-2026-87973Low 3.1If-So Dynamic Content 1.9.9 - 1.10.1 - Editor+ Stored XSS via Conversion NamePublished Oct 1, 2026
- CVE-2026-76144Low 1.8Genians, Inc Genian SSL PNS Unrestricted File UploadPublished Oct 1, 2026
- CVE-2026-103533Low 2.1David-Crty databasement database-servers API Endpoint RestoreRequest.php 511 path traversalPublished Oct 1, 2026
- CVE-2026-101887Low 2.1BlueALSA bluealsad LC3plus Decoder Division-by-Zero DoSPublished Oct 1, 2026
- CVE-2026-103585Low 1.2Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki MediaSearch extension allows Cross-Site Scripting (XSS).Published Sep 30, 2026
- CVE-2026-103584Low 1.1Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki CommonsMetadata extension allows Cross-Site Scripting (XSS).Published Sep 30, 2026
- CVE-2026-102138Low 3.3Kiteworks Core Server-Side Request Forgery (SSRF)Published Sep 30, 2026
- CVE-2026-103440Low 1.2pagetriagelist discloses suppressed reviewer usernamesPublished Sep 30, 2026
- CVE-2026-103439Low 0.3Various rawParams() and escaped() updates to prevent XSS in Wikibase extensionPublished Sep 30, 2026
- CVE-2026-103438Low 0.3Various rawParams() and escaped() updates to prevent XSS in Wikistories extensionPublished Sep 30, 2026
- CVE-2026-103437Low 1.1ReadingLists imported metadata permits JavaScript URL XSSPublished Sep 30, 2026
- CVE-2026-103445Low 1.2Stored XSS through PageForms #autoedit redirect linksPublished Sep 30, 2026
- CVE-2026-103444Low 1.1Stored XSS through system messages in WikiForumPublished Sep 30, 2026
- CVE-2026-103443Low 1.1API permits session-seeded javascript URL XSSPublished Sep 30, 2026
- CVE-2026-103436Low 3.7apcupsd through 3.14.14 discloses uninitialized stack memory in getupsvar() in src/cgi/upsfetch.c (used by upsstats.cgi, multimon.cgi, and upsfstats.cgi.Published Sep 30, 2026
- CVE-2026-100271Low 2.7In JetBrains YouTrack before 2026.2.19197 missing authorisation on several endpoints allowed authenticated users to access information from other projectsPublished Sep 30, 2026
- CVE-2026-100270Low 2.7In JetBrains YouTrack before 2026.2.19197 low-level Admin Read permission users could disclose integration credentials via import configurationsPublished Sep 30, 2026
- CVE-2026-100268Low 2.7In JetBrains YouTrack before 2026.2.19197 project administrators could read comments from other projects via notification templatesPublished Sep 30, 2026
- CVE-2026-100264Low 2.7In JetBrains YouTrack before 2026.2.18991 stored SMTP server credentials could be disclosed by changing the server hostPublished Sep 30, 2026
- CVE-2026-94486Low 2.3Information disclosure in the Next.js development server's Model Context Protocol endpointPublished Sep 30, 2026
- CVE-2026-27085Low 2.7WordPress Astra WordPress theme theme <= 4.13.12 - Content Injection vulnerabilityPublished Sep 30, 2026
- CVE-2026-102587Low 2.7Moodle: user list filters bypass profile field visibilityPublished Sep 30, 2026
- CVE-2026-102583Low 2.7Moodle: incorrect capability check in ai generate image web servicePublished Sep 30, 2026
- CVE-2026-94297Low 2.7Media Library Organizer 2.0.4 - 2.1.3 - Contributor+ Arbitrary Taxonomy Term CreationPublished Sep 30, 2026
- CVE-2026-88791Low 3.4Safe Redirect Manager < 2.3.0 - Open Redirect via Wildcard Redirect RulesPublished Sep 30, 2026
| CVE | Title | Severity | Published |
|---|---|---|---|
| CVE-2026-105137 | Laradock Build Process Dockerfile code download | Low 2.3 | |
| CVE-2026-104119 | Simple Shopping Cart < 5.2.6 - Admin+ Stored XSS via PayPal API Credentials | Low 3.5 | |
| CVE-2026-105118 | OpenAM before 16.1.3 contains an open redirect vulnerability that allows unauthenticated attackers to redirect users by supplying an unverified id_token_hint to the /oauth2/connect/endSession endpoint. | Low 2.3 | |
| CVE-2026-96962 | Pie Register < 3.8.4.14 - Unauthenticated User Email Disclosure via Invitation Code | Low 3.7 | |
| CVE-2026-86834 | MetForm 2.2.1 - 4.3.0 - Unauthenticated Debug File Disclosure via HubSpot Forms Integration | Low 3.7 | |
| CVE-2026-80518 | WP Ultimate CSV Importer < 9.2 - Unauthenticated Imported Data Disclosure via Predictable Log Path | Low 3.7 | |
| CVE-2026-80517 | WP Ultimate CSV Importer 7.17 - 9.1 - Admin+ Stored XSS via ZIP Import SVG Upload | Low 3.5 | |
| CVE-2026-105083 | ImageMagick before 7.1.2-32 and 6.9.13-57 Security Policy Bypass via policy.xml DOCTYPE | Low 1.8 | |
| CVE-2026-105051 | Denuvo Anti-Tamper through 2026-03-04 allows bypass of a hypervisor presence check via CPUID interception (SimpleSvm.sys on AMD; hyperkd.sys and hyperhv.dll on Intel). | Low 1.9 | |
| CVE-2026-105043 | MathWorks Simulink before R2026b, when showing a crafted .slx file, can have blocks that are never visible in the Simulink Editor but will cause code execution. | Low 3.6 | |
| CVE-2026-104994 | Trivy before 0.71.0 allows directory traversal in Terraform filesystem functions when they try to access pathnames above the scan root. | Low 2.5 | |
| CVE-2026-104855 | Wasmtime: Preemption and traps during bulk operations enable breaking internal VM state | Low 2.0 | |
| CVE-2026-39601 | WordPress Booking Calendar plugin <= 11.8.4 - Race Condition vulnerability | Low 3.7 | |
| CVE-2026-104415 | Ghost from 0.7.2 before 6.64.0 contains an information disclosure vulnerability in the Admin API that allows staff-level users to determine the relative ordering of other staff users' password hashes. | Low 2.3 | |
| CVE-2026-102002 | Otter Blocks <= 3.2.6 - Authenticated (Subscriber+) Sensitive Information Exposure in Form Submissions Dashboard Widget | Low 3.1 | |
| CVE-2026-91023 | Motors – Car Dealership & Classified Listings < 1.4.124 - Subscriber+ Cross-User Post Meta Modification via stm_make_featured | Low 3.1 | |
| CVE-2026-103923 | KaTeX: Existing prototype pollution can bypass trust restrictions | Low 2.1 | |
| CVE-2026-21833 | HCL AION is susceptible to a Missing "Content-Security-Policy" header Vulnerability (CVE-2026-21833) | Low 3.7 | |
| CVE-2026-67172 | HCL BigFix Service Management is affected by multiple security vulnerabilities. | Low 3.7 | |
| CVE-2026-42356 | Apache HTTP Server: limited RCE for some internal redirects to non-CGI files in CGI directories | Low 3.7 | |
| CVE-2026-56599 | HCL BigFix Service Management is affected by an Insecure Cookie Attribute Configuration vulnerability, which could allow an attacker to exploit missing security attributes such as SameSite, HttpOnly, Secure, and restrictive Paths,… | Low 2.2 | |
| CVE-2026-66253 | HCL iControl is affected by a Session Timeout vulnerability | Low 3.1 | |
| CVE-2026-66249 | HCL iControl is affected by a Missing Secure Attribute vulnerability | Low 3.1 | |
| CVE-2026-66248 | HCL iControl is affected by an Improper Error Handling vulnerability | Low 3.1 | |
| CVE-2026-94220 | Cross-Site request forgery (CSRF) vulnerability in feishu-auth and dingtalk-auth plugins in Apache APISIX. | Low 2.1 | |
| CVE-2026-87973 | If-So Dynamic Content 1.9.9 - 1.10.1 - Editor+ Stored XSS via Conversion Name | Low 3.1 | |
| CVE-2026-76144 | Genians, Inc Genian SSL PNS Unrestricted File Upload | Low 1.8 | |
| CVE-2026-103533 | David-Crty databasement database-servers API Endpoint RestoreRequest.php 511 path traversal | Low 2.1 | |
| CVE-2026-101887 | BlueALSA bluealsad LC3plus Decoder Division-by-Zero DoS | Low 2.1 | |
| CVE-2026-103585 | Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki MediaSearch extension allows Cross-Site Scripting (XSS). | Low 1.2 | |
| CVE-2026-103584 | Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki CommonsMetadata extension allows Cross-Site Scripting (XSS). | Low 1.1 | |
| CVE-2026-102138 | Kiteworks Core Server-Side Request Forgery (SSRF) | Low 3.3 | |
| CVE-2026-103440 | pagetriagelist discloses suppressed reviewer usernames | Low 1.2 | |
| CVE-2026-103439 | Various rawParams() and escaped() updates to prevent XSS in Wikibase extension | Low 0.3 | |
| CVE-2026-103438 | Various rawParams() and escaped() updates to prevent XSS in Wikistories extension | Low 0.3 | |
| CVE-2026-103437 | ReadingLists imported metadata permits JavaScript URL XSS | Low 1.1 | |
| CVE-2026-103445 | Stored XSS through PageForms #autoedit redirect links | Low 1.2 | |
| CVE-2026-103444 | Stored XSS through system messages in WikiForum | Low 1.1 | |
| CVE-2026-103443 | API permits session-seeded javascript URL XSS | Low 1.1 | |
| CVE-2026-103436 | apcupsd through 3.14.14 discloses uninitialized stack memory in getupsvar() in src/cgi/upsfetch.c (used by upsstats.cgi, multimon.cgi, and upsfstats.cgi. | Low 3.7 | |
| CVE-2026-100271 | In JetBrains YouTrack before 2026.2.19197 missing authorisation on several endpoints allowed authenticated users to access information from other projects | Low 2.7 | |
| CVE-2026-100270 | In JetBrains YouTrack before 2026.2.19197 low-level Admin Read permission users could disclose integration credentials via import configurations | Low 2.7 | |
| CVE-2026-100268 | In JetBrains YouTrack before 2026.2.19197 project administrators could read comments from other projects via notification templates | Low 2.7 | |
| CVE-2026-100264 | In JetBrains YouTrack before 2026.2.18991 stored SMTP server credentials could be disclosed by changing the server host | Low 2.7 | |
| CVE-2026-94486 | Information disclosure in the Next.js development server's Model Context Protocol endpoint | Low 2.3 | |
| CVE-2026-27085 | WordPress Astra WordPress theme theme <= 4.13.12 - Content Injection vulnerability | Low 2.7 | |
| CVE-2026-102587 | Moodle: user list filters bypass profile field visibility | Low 2.7 | |
| CVE-2026-102583 | Moodle: incorrect capability check in ai generate image web service | Low 2.7 | |
| CVE-2026-94297 | Media Library Organizer 2.0.4 - 2.1.3 - Contributor+ Arbitrary Taxonomy Term Creation | Low 2.7 | |
| CVE-2026-88791 | Safe Redirect Manager < 2.3.0 - Open Redirect via Wildcard Redirect Rules | Low 3.4 |
Showing 251–300 of 11,299. Narrow the filters to see the rest.
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status. Filter by severity and year here; the other filters work on the curated lists.