Vulnerability Intelligence · All CVEs
Every Published CVE, Searchable.
Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status.
Synced hourly · figures as of Oct 19, 2026
392,062 vulnerabilities · newest first
- CVE-2026-103091Critical 9.3Missing Authorization (CWE-862) and Initialization of a Resource with an Insecure Default (CWE-1188) in the MCP proxy (HandleStreamPassThrough in mcp_service.go) and OIDC registration flow (GET /info and POST /register in…Published Oct 19, 2026
- CVE-2026-102503Critical 9.3Missing Authentication for Critical Function (CWE-306) and Missing Authorization (CWE-862) in the /libp2p-http ingress server (StartIngressServer in cmd/sam-node/node.go) in Google OSS Agent Mesh (SAM) versions 0.1.0-alpha.1 through…Published Oct 19, 2026
- CVE-2026-112041Medium 6.3Such manipulation leads to…Published Oct 19, 2026
- CVE-2026-112040Medium 5.3A vulnerability was determined in diem-project diem up to 116974edfb9a5b8bd69cb13586dc62bcdbb485ad.Published Oct 19, 2026
- CVE-2026-112039Medium 4.8Affected by this issue is the function append of the file dmAdminPlugin/modules/dmConsole/actions/actions.class.php of the component…Published Oct 19, 2026
- CVE-2026-112038Medium 4.8Affected by this vulnerability is the function html of the file dmAdminPlugin/web/js/dmAdminCtrl.js of the component Version Check Service.Published Oct 19, 2026
- CVE-2026-112037Medium 6.3Executing a…Published Oct 19, 2026
- CVE-2026-108984High 7.5A vulnerability is in Web Server default connection ports under the process name GeoWebServer.exe .Published Oct 19, 2026
- CVE-2026-108983Critical 9.8A vulnerability is in Web Server default connection ports under the process name GeoWebServer.exe .Published Oct 19, 2026
- CVE-2026-112036Medium 5.3A vulnerability was detected in Artifex MuPDF up to 1.28.5.Published Oct 19, 2026
- CVE-2026-112035Medium 5.3A security vulnerability has been detected in aircheng-org iWebShop-5 up to 5.16.Published Oct 19, 2026
- CVE-2026-112034Medium 5.3A weakness has been identified in aircheng-org iWebShop-5 up to 5.16.Published Oct 19, 2026
- CVE-2026-112033Medium 5.3The manipulation of the…Published Oct 19, 2026
- CVE-2026-112032Medium 5.1The manipulation leads to sql injection.Published Oct 19, 2026
- CVE-2026-112031Medium 5.1A vulnerability was determined in Chamilo LMS up to 1.11.40/2.0.3/3.0.1.Published Oct 19, 2026
- CVE-2026-112030Medium 5.3Performing a manipulation results in use of default password.Published Oct 19, 2026
- CVE-2026-112112Low 2.3An IPv6 FlowSpec validation bypass in the CZ.NIC BIRD Internet Routing Daemon allows an established BGP peer to inject FlowSpec rules matching destinations outside the address space authorized by the unicast-route validation procedure.Published Oct 18, 2026
- CVE-2026-112111Medium 5.1The Bootstrap Shortcodes plugin for WordPress before 3.4.6 is vulnerable to stored XSS via the id attribute of the [bs_tcontent] shortcode.Published Oct 18, 2026
- CVE-2026-112029Low 2.0Such manipulation of the argument salt/password leads to…Published Oct 18, 2026
- CVE-2026-112028Medium 6.9Affected by this issue is some unknown functionality of the file App/Home/Controller/VoteController.class.php of the…Published Oct 18, 2026
- CVE-2026-112027Medium 6.9A vulnerability was detected in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930.Published Oct 18, 2026
- CVE-2026-112026Medium 6.3A security vulnerability has been detected in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930.Published Oct 18, 2026
- CVE-2026-112025Medium 6.9A weakness has been identified in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930.Published Oct 18, 2026
- CVE-2026-97859UnscoredSeven Gitea API routes under /api/v1/users/{username} (followers, following, following/{target}, starred, subscriptions, keys and gpg_keys) were registered without the individualPermsChecker middleware that enforces the visibility of…Published Oct 18, 2026
- CVE-2026-97204UnscoredDeleting a label compared the ID of the repository in the request against the organization ID of organization labels, and the two ID sequences overlap.Published Oct 18, 2026
- CVE-2026-110494UnscoredAdding attachments to a release checked the repository and release of an attachment but not whether it was already linked to an issue or comment.Published Oct 18, 2026
- CVE-2026-110324UnscoredThe visibility check of Gitea user profiles was applied to GET requests only, while POST /{username} (follow and unfollow) required only a signed-in user.Published Oct 18, 2026
- CVE-2026-110311UnscoredCreating a draft release through the API returned an assets list that was built from a release without an ID, which matched every attachment that was not linked to a release.Published Oct 18, 2026
- CVE-2026-109844UnscoredGET /api/v1/user/subscriptions returned the metadata of every repository a user was watching without checking that the user still had access to it.Published Oct 18, 2026
- CVE-2026-109553UnscoredGitea resolved the principals of an SSH certificate by searching the content of all stored public keys instead of only principal keys.Published Oct 18, 2026
- CVE-2026-107686UnscoredThe Gitea web handlers for adding and removing reactions on issues and comments did not refuse locked issues for users without write access, although the API did.Published Oct 18, 2026
- CVE-2026-107618UnscoredPOST /{owner}/{repo}/topics was registered without the sign-in middleware that provides the cross-origin protection, so a request issued by a third-party site was not rejected.Published Oct 18, 2026
- CVE-2026-105964UnscoredThe Gitea Actions artifact v4 (Twirp) handlers read the whole request body into memory without a size limit.Published Oct 18, 2026
- CVE-2026-105661UnscoredRequesting /{username}/-/repositories for an individual user instead of an organization made the organization home handler dereference a nil organization and panic.Published Oct 18, 2026
- CVE-2026-104627UnscoredThe Gitea OpenID association callback in the security settings accepted a positive OpenID 2.0 assertion without checking that the signed-in user had started the linking.Published Oct 18, 2026
- CVE-2024-4457UnscoredThe Management Console fails to properly validate input related to the configuration of JDBC user stores.Published Oct 18, 2026
- CVE-2026-111993Medium 4.8This manipulation of the argument Password causes…Published Oct 18, 2026
- CVE-2026-111992Medium 5.3A vulnerability was detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449.Published Oct 18, 2026
- CVE-2026-98868UnscoredLinux kernel: dm-pcache: reject a kset that overruns its segmentPublished Oct 18, 2026
- CVE-2026-98867UnscoredLinux kernel: dm-pcache: bound the logical key offset from persistent memoryPublished Oct 18, 2026
- CVE-2026-98866UnscoredLinux kernel: sched/cache: Introduce task_struct->sched_cache_grp to fix UAFPublished Oct 18, 2026
- CVE-2026-98865UnscoredLinux kernel: sched_ext: Don't run ops.dequeue() with a DSQ lock heldPublished Oct 18, 2026
- CVE-2026-98864UnscoredLinux kernel: sched_ext: Wait for SCX_OPSS_DISPATCHING before reenqueueing a taskPublished Oct 18, 2026
- CVE-2026-98863UnscoredLinux kernel: KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages failsPublished Oct 18, 2026
- CVE-2026-98862UnscoredLinux kernel: audit: fix exe mark UAF in kill_rules()Published Oct 18, 2026
- CVE-2026-98861UnscoredLinux kernel: fprobe: Use guard(rcu_sched_notrace) and check rcu_is_watching()Published Oct 18, 2026
- CVE-2026-98860UnscoredLinux kernel: HID: bpf: cast size to ssize_t when checking hid_bpf_hw_requestPublished Oct 18, 2026
- CVE-2026-98859UnscoredLinux kernel: HID: multitouch: stop the release timer from being rearmed on removePublished Oct 18, 2026
- CVE-2026-98858UnscoredLinux kernel: io_uring: fix task_work add use-after-free with SQPOLLPublished Oct 18, 2026
- CVE-2026-98857UnscoredLinux kernel: ipvs: bound LBLCR and LBLC cache growthPublished Oct 18, 2026
| CVE | Title | Severity | Published |
|---|---|---|---|
| CVE-2026-103091 | Missing Authorization (CWE-862) and Initialization of a Resource with an Insecure Default (CWE-1188) in the MCP proxy (HandleStreamPassThrough in mcp_service.go) and OIDC registration flow (GET /info and POST /register in… | Critical 9.3 | |
| CVE-2026-102503 | Missing Authentication for Critical Function (CWE-306) and Missing Authorization (CWE-862) in the /libp2p-http ingress server (StartIngressServer in cmd/sam-node/node.go) in Google OSS Agent Mesh (SAM) versions 0.1.0-alpha.1 through… | Critical 9.3 | |
| CVE-2026-112041 | Such manipulation leads to… | Medium 6.3 | |
| CVE-2026-112040 | A vulnerability was determined in diem-project diem up to 116974edfb9a5b8bd69cb13586dc62bcdbb485ad. | Medium 5.3 | |
| CVE-2026-112039 | Affected by this issue is the function append of the file dmAdminPlugin/modules/dmConsole/actions/actions.class.php of the component… | Medium 4.8 | |
| CVE-2026-112038 | Affected by this vulnerability is the function html of the file dmAdminPlugin/web/js/dmAdminCtrl.js of the component Version Check Service. | Medium 4.8 | |
| CVE-2026-112037 | Executing a… | Medium 6.3 | |
| CVE-2026-108984 | A vulnerability is in Web Server default connection ports under the process name GeoWebServer.exe . | High 7.5 | |
| CVE-2026-108983 | A vulnerability is in Web Server default connection ports under the process name GeoWebServer.exe . | Critical 9.8 | |
| CVE-2026-112036 | A vulnerability was detected in Artifex MuPDF up to 1.28.5. | Medium 5.3 | |
| CVE-2026-112035 | A security vulnerability has been detected in aircheng-org iWebShop-5 up to 5.16. | Medium 5.3 | |
| CVE-2026-112034 | A weakness has been identified in aircheng-org iWebShop-5 up to 5.16. | Medium 5.3 | |
| CVE-2026-112033 | The manipulation of the… | Medium 5.3 | |
| CVE-2026-112032 | The manipulation leads to sql injection. | Medium 5.1 | |
| CVE-2026-112031 | A vulnerability was determined in Chamilo LMS up to 1.11.40/2.0.3/3.0.1. | Medium 5.1 | |
| CVE-2026-112030 | Performing a manipulation results in use of default password. | Medium 5.3 | |
| CVE-2026-112112 | An IPv6 FlowSpec validation bypass in the CZ.NIC BIRD Internet Routing Daemon allows an established BGP peer to inject FlowSpec rules matching destinations outside the address space authorized by the unicast-route validation procedure. | Low 2.3 | |
| CVE-2026-112111 | The Bootstrap Shortcodes plugin for WordPress before 3.4.6 is vulnerable to stored XSS via the id attribute of the [bs_tcontent] shortcode. | Medium 5.1 | |
| CVE-2026-112029 | Such manipulation of the argument salt/password leads to… | Low 2.0 | |
| CVE-2026-112028 | Affected by this issue is some unknown functionality of the file App/Home/Controller/VoteController.class.php of the… | Medium 6.9 | |
| CVE-2026-112027 | A vulnerability was detected in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. | Medium 6.9 | |
| CVE-2026-112026 | A security vulnerability has been detected in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. | Medium 6.3 | |
| CVE-2026-112025 | A weakness has been identified in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. | Medium 6.9 | |
| CVE-2026-97859 | Seven Gitea API routes under /api/v1/users/{username} (followers, following, following/{target}, starred, subscriptions, keys and gpg_keys) were registered without the individualPermsChecker middleware that enforces the visibility of… | Unscored | |
| CVE-2026-97204 | Deleting a label compared the ID of the repository in the request against the organization ID of organization labels, and the two ID sequences overlap. | Unscored | |
| CVE-2026-110494 | Adding attachments to a release checked the repository and release of an attachment but not whether it was already linked to an issue or comment. | Unscored | |
| CVE-2026-110324 | The visibility check of Gitea user profiles was applied to GET requests only, while POST /{username} (follow and unfollow) required only a signed-in user. | Unscored | |
| CVE-2026-110311 | Creating a draft release through the API returned an assets list that was built from a release without an ID, which matched every attachment that was not linked to a release. | Unscored | |
| CVE-2026-109844 | GET /api/v1/user/subscriptions returned the metadata of every repository a user was watching without checking that the user still had access to it. | Unscored | |
| CVE-2026-109553 | Gitea resolved the principals of an SSH certificate by searching the content of all stored public keys instead of only principal keys. | Unscored | |
| CVE-2026-107686 | The Gitea web handlers for adding and removing reactions on issues and comments did not refuse locked issues for users without write access, although the API did. | Unscored | |
| CVE-2026-107618 | POST /{owner}/{repo}/topics was registered without the sign-in middleware that provides the cross-origin protection, so a request issued by a third-party site was not rejected. | Unscored | |
| CVE-2026-105964 | The Gitea Actions artifact v4 (Twirp) handlers read the whole request body into memory without a size limit. | Unscored | |
| CVE-2026-105661 | Requesting /{username}/-/repositories for an individual user instead of an organization made the organization home handler dereference a nil organization and panic. | Unscored | |
| CVE-2026-104627 | The Gitea OpenID association callback in the security settings accepted a positive OpenID 2.0 assertion without checking that the signed-in user had started the linking. | Unscored | |
| CVE-2024-4457 | The Management Console fails to properly validate input related to the configuration of JDBC user stores. | Unscored | |
| CVE-2026-111993 | This manipulation of the argument Password causes… | Medium 4.8 | |
| CVE-2026-111992 | A vulnerability was detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. | Medium 5.3 | |
| CVE-2026-98868 | Linux kernel: dm-pcache: reject a kset that overruns its segment | Unscored | |
| CVE-2026-98867 | Linux kernel: dm-pcache: bound the logical key offset from persistent memory | Unscored | |
| CVE-2026-98866 | Linux kernel: sched/cache: Introduce task_struct->sched_cache_grp to fix UAF | Unscored | |
| CVE-2026-98865 | Linux kernel: sched_ext: Don't run ops.dequeue() with a DSQ lock held | Unscored | |
| CVE-2026-98864 | Linux kernel: sched_ext: Wait for SCX_OPSS_DISPATCHING before reenqueueing a task | Unscored | |
| CVE-2026-98863 | Linux kernel: KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails | Unscored | |
| CVE-2026-98862 | Linux kernel: audit: fix exe mark UAF in kill_rules() | Unscored | |
| CVE-2026-98861 | Linux kernel: fprobe: Use guard(rcu_sched_notrace) and check rcu_is_watching() | Unscored | |
| CVE-2026-98860 | Linux kernel: HID: bpf: cast size to ssize_t when checking hid_bpf_hw_request | Unscored | |
| CVE-2026-98859 | Linux kernel: HID: multitouch: stop the release timer from being rearmed on remove | Unscored | |
| CVE-2026-98858 | Linux kernel: io_uring: fix task_work add use-after-free with SQPOLL | Unscored | |
| CVE-2026-98857 | Linux kernel: ipvs: bound LBLCR and LBLC cache growth | Unscored |
Showing 301–350 of 392,062. Narrow the filters to see the rest.
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status. Filter by severity and year here; the other filters work on the curated lists.