Vulnerability Intelligence · All CVEs
Every Published CVE, Searchable.
Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status.
Synced hourly · figures as of Oct 19, 2026
40,404 vulnerabilities · newest first
- CVE-2026-70188Critical 9.1Microsoft Security Advisory CVE-2026-70188 - ASP.NET Core Security Feature Bypass VulnerabilityPublished Oct 13, 2026
- CVE-2026-103849Critical 10.0Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)Published Oct 13, 2026
- CVE-2026-91013Critical 9.3Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)Published Oct 13, 2026
- CVE-2026-92464Critical 9.1Adobe Commerce | Improper Input Validation (CWE-20)Published Oct 13, 2026
- CVE-2026-92909Critical 9.8Adobe Commerce | Incorrect Authorization (CWE-863)Published Oct 13, 2026
- CVE-2026-100133Critical 9.3Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)Published Oct 13, 2026
- CVE-2026-75120Critical 9.3Remote Code Execution (RCE) vulnerability identified in the OpenText™ EnCase SAFE AgentsPublished Oct 13, 2026
- CVE-2026-92892Critical 9.0Potential command execution on the host running JFrog CLI.Published Oct 13, 2026
- CVE-2026-106173Critical 9.4A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSIEM 7.5.0 may allow attacker to execute unauthorized code or commands via specially crafted packets.Published Oct 13, 2026
- CVE-2026-105445Critical 9.4Docker Hub account conversion could reassign an active personal access token to another userPublished Oct 13, 2026
- CVE-2026-54454Critical 9.1OpenCATS: Authenticated RCE in the Import modulePublished Oct 13, 2026
- CVE-2026-77459Critical 9.9Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooksPublished Oct 13, 2026
- CVE-2026-109412Critical 9.9An exposed dangerous endpoint in Ivanti Neurons Patch for Intune allows a remote authenticated attacker to leak sensitive authentication information.Published Oct 13, 2026
- CVE-2026-55183Critical 9.6RClone Manager: Unauthenticated RClone Daemon Enables Remote Attack via Malicious Web PagePublished Oct 13, 2026
- CVE-2026-55562Critical 9.0Cronicle: Stored XSS in admin Activity Log via account full_name fieldPublished Oct 13, 2026
- CVE-2026-102989Critical 9.3TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responsesPublished Oct 13, 2026
- CVE-2026-106042Critical 9.9An External Control of File Name or Path vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to redirect application-generated requests to an attacker-controlled endpoint and obtain EPMM…Published Oct 13, 2026
- CVE-2026-69227Critical 9.8BUG-000187331 Portal for ArcGIS has a security vulnerabilityPublished Oct 13, 2026
- CVE-2026-55695Critical 9.1FearlessCMS: Remote Code Execution via Unvalidated Update Repository URL in System UpdaterPublished Oct 13, 2026
- CVE-2026-103928Critical 9.3Metabase: Arbitrary File Read/Write via Unsafe H2 Built-in FunctionsPublished Oct 13, 2026
- CVE-2026-55675Critical 10.0Salty documentation workflow executes fork-controlled Python build hooks with deployment secretsPublished Oct 13, 2026
- CVE-2026-104192Critical 9.6DragonflyDB stream RDB deserialization double-freePublished Oct 13, 2026
- CVE-2026-53709Critical 9.8MCP Context Forge: Hardcoded default JWT_SECRET_KEY shipped in source and .env.example enables pre-authentication platform admin token forgeryPublished Oct 13, 2026
- CVE-2026-77099Critical 9.3CVFS Command ExecutionPublished Oct 13, 2026
- CVE-2026-109520Critical 9.3Colorful iGameCenter Dispatch AMDRyzenMasterDriver.sys MmMapIoSpace privilege defined with unsafe actionsPublished Oct 13, 2026
- CVE-2026-65173Critical 9.1NVIDIA AIStore for Linux contains a missing authentication vulnerability in the token-revocation endpoint where an unauthenticated remote attacker may submit crafted token-revocation lists.Published Oct 13, 2026
- CVE-2026-65162Critical 10.0NVIDIA AIStore for Linux contains a vulnerability in the legacy ETL Kubernetes PodSpec initialization API where a remote attacker may supply Kubernetes host-namespace and container-security settings.Published Oct 13, 2026
- CVE-2026-109755Critical 9.6Sandbox escape in the DOM: Content Processes componentPublished Oct 13, 2026
- CVE-2026-109745Critical 9.6Sandbox escape due to uninitialized memory in the DOM: Web Serial componentPublished Oct 13, 2026
- CVE-2026-109740Critical 9.6Sandbox escape due to incorrect boundary conditions in the Widget: Win32 componentPublished Oct 13, 2026
- CVE-2026-109708Critical 9.6Sandbox escape due to incorrect boundary conditions in the Networking componentPublished Oct 13, 2026
- CVE-2026-109707Critical 9.6Sandbox escape due to use-after-free in the Networking componentPublished Oct 13, 2026
- CVE-2026-109705Critical 9.6Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking componentPublished Oct 13, 2026
- CVE-2026-109157Critical 9.4TRENDnet TEW-432BRP formTcpipSetup stack-based overflowPublished Oct 13, 2026
- CVE-2026-63354Critical 9.4Affected devices do not properly validate and sanitize visual marker data contained in imported CSV trace files before rendering it on the Trace page.Published Oct 13, 2026
- CVE-2026-63353Critical 9.4Affected devices do not properly sanitize comment fields contained in imported trace files before rendering them on the Trace page.Published Oct 13, 2026
- CVE-2026-63350Critical 9.4Affected devices do not properly restrict executable content contained in imported trace files.Published Oct 13, 2026
- CVE-2026-89309Critical 10.0CVE-2026-89309Published Oct 13, 2026
- CVE-2026-74041Critical 9.4Case-sensitivity mismatch bypasses remote-command validation, allowing command execution as rootPublished Oct 13, 2026
- CVE-2026-74040Critical 9.4Cluster worker can overwrite arbitrary master files (incl.Published Oct 13, 2026
- CVE-2026-109110Critical 10.0Wavlink WL-WN592AX6 wmapd system os command injectionPublished Oct 13, 2026
- CVE-2026-109109Critical 10.0Wavlink WL-WN530BE1-A Settings Export CGI ExportAllSettings.cgi strcpy stack-based overflowPublished Oct 13, 2026
- CVE-2026-109108Critical 9.4Wavlink WL-WN530BE1-A uploadVpn.cgi popen os command injectionPublished Oct 13, 2026
- CVE-2026-108971Critical 9.4D-Link DCS-930L Emergency HTTP Recovery Server bootloader_region.bin mpfd_decode signature verificationPublished Oct 13, 2026
- CVE-2026-109758Critical 9.3Perforce Helix Authentication Service (HAS) deployments that retain the shipped default SCIM bearer token are vulnerable to unauthorized access when the SCIM endpoint is reachable by an attacker.Published Oct 13, 2026
- CVE-2026-97229Critical 10.0GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially…gitlab · gitlabPublished Oct 13, 2026
- CVE-2026-89111Critical 10.0The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting multi-tenant BTP applications.Published Oct 13, 2026
- CVE-2026-89110Critical 9.9SAP NetWeaver Visual Composer does not perform sufficient authorization checks in certain portal functionality.Published Oct 13, 2026
- CVE-2026-89108Critical 9.1SAP Manufacturing Integration and Intelligence does not sufficiently enforce authorization boundaries within certain administrative functionality.Published Oct 13, 2026
- CVE-2026-89107Critical 9.9SAP S/4HANA (Manage Substitution/Validation Rules) does not sufficiently validate input processed by rule definition functionality that utilizes a domain-specific scripting language.Published Oct 13, 2026
| CVE | Title | Severity | Published |
|---|---|---|---|
| CVE-2026-70188 | Microsoft Security Advisory CVE-2026-70188 - ASP.NET Core Security Feature Bypass Vulnerability | Critical 9.1 | |
| CVE-2026-103849 | Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336) | Critical 10.0 | |
| CVE-2026-91013 | Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) | Critical 9.3 | |
| CVE-2026-92464 | Adobe Commerce | Improper Input Validation (CWE-20) | Critical 9.1 | |
| CVE-2026-92909 | Adobe Commerce | Incorrect Authorization (CWE-863) | Critical 9.8 | |
| CVE-2026-100133 | Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) | Critical 9.3 | |
| CVE-2026-75120 | Remote Code Execution (RCE) vulnerability identified in the OpenText™ EnCase SAFE Agents | Critical 9.3 | |
| CVE-2026-92892 | Potential command execution on the host running JFrog CLI. | Critical 9.0 | |
| CVE-2026-106173 | A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSIEM 7.5.0 may allow attacker to execute unauthorized code or commands via specially crafted packets. | Critical 9.4 | |
| CVE-2026-105445 | Docker Hub account conversion could reassign an active personal access token to another user | Critical 9.4 | |
| CVE-2026-54454 | OpenCATS: Authenticated RCE in the Import module | Critical 9.1 | |
| CVE-2026-77459 | Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks | Critical 9.9 | |
| CVE-2026-109412 | An exposed dangerous endpoint in Ivanti Neurons Patch for Intune allows a remote authenticated attacker to leak sensitive authentication information. | Critical 9.9 | |
| CVE-2026-55183 | RClone Manager: Unauthenticated RClone Daemon Enables Remote Attack via Malicious Web Page | Critical 9.6 | |
| CVE-2026-55562 | Cronicle: Stored XSS in admin Activity Log via account full_name field | Critical 9.0 | |
| CVE-2026-102989 | TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses | Critical 9.3 | |
| CVE-2026-106042 | An External Control of File Name or Path vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to redirect application-generated requests to an attacker-controlled endpoint and obtain EPMM… | Critical 9.9 | |
| CVE-2026-69227 | BUG-000187331 Portal for ArcGIS has a security vulnerability | Critical 9.8 | |
| CVE-2026-55695 | FearlessCMS: Remote Code Execution via Unvalidated Update Repository URL in System Updater | Critical 9.1 | |
| CVE-2026-103928 | Metabase: Arbitrary File Read/Write via Unsafe H2 Built-in Functions | Critical 9.3 | |
| CVE-2026-55675 | Salty documentation workflow executes fork-controlled Python build hooks with deployment secrets | Critical 10.0 | |
| CVE-2026-104192 | DragonflyDB stream RDB deserialization double-free | Critical 9.6 | |
| CVE-2026-53709 | MCP Context Forge: Hardcoded default JWT_SECRET_KEY shipped in source and .env.example enables pre-authentication platform admin token forgery | Critical 9.8 | |
| CVE-2026-77099 | CVFS Command Execution | Critical 9.3 | |
| CVE-2026-109520 | Colorful iGameCenter Dispatch AMDRyzenMasterDriver.sys MmMapIoSpace privilege defined with unsafe actions | Critical 9.3 | |
| CVE-2026-65173 | NVIDIA AIStore for Linux contains a missing authentication vulnerability in the token-revocation endpoint where an unauthenticated remote attacker may submit crafted token-revocation lists. | Critical 9.1 | |
| CVE-2026-65162 | NVIDIA AIStore for Linux contains a vulnerability in the legacy ETL Kubernetes PodSpec initialization API where a remote attacker may supply Kubernetes host-namespace and container-security settings. | Critical 10.0 | |
| CVE-2026-109755 | Sandbox escape in the DOM: Content Processes component | Critical 9.6 | |
| CVE-2026-109745 | Sandbox escape due to uninitialized memory in the DOM: Web Serial component | Critical 9.6 | |
| CVE-2026-109740 | Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component | Critical 9.6 | |
| CVE-2026-109708 | Sandbox escape due to incorrect boundary conditions in the Networking component | Critical 9.6 | |
| CVE-2026-109707 | Sandbox escape due to use-after-free in the Networking component | Critical 9.6 | |
| CVE-2026-109705 | Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking component | Critical 9.6 | |
| CVE-2026-109157 | TRENDnet TEW-432BRP formTcpipSetup stack-based overflow | Critical 9.4 | |
| CVE-2026-63354 | Affected devices do not properly validate and sanitize visual marker data contained in imported CSV trace files before rendering it on the Trace page. | Critical 9.4 | |
| CVE-2026-63353 | Affected devices do not properly sanitize comment fields contained in imported trace files before rendering them on the Trace page. | Critical 9.4 | |
| CVE-2026-63350 | Affected devices do not properly restrict executable content contained in imported trace files. | Critical 9.4 | |
| CVE-2026-89309 | CVE-2026-89309 | Critical 10.0 | |
| CVE-2026-74041 | Case-sensitivity mismatch bypasses remote-command validation, allowing command execution as root | Critical 9.4 | |
| CVE-2026-74040 | Cluster worker can overwrite arbitrary master files (incl. | Critical 9.4 | |
| CVE-2026-109110 | Wavlink WL-WN592AX6 wmapd system os command injection | Critical 10.0 | |
| CVE-2026-109109 | Wavlink WL-WN530BE1-A Settings Export CGI ExportAllSettings.cgi strcpy stack-based overflow | Critical 10.0 | |
| CVE-2026-109108 | Wavlink WL-WN530BE1-A uploadVpn.cgi popen os command injection | Critical 9.4 | |
| CVE-2026-108971 | D-Link DCS-930L Emergency HTTP Recovery Server bootloader_region.bin mpfd_decode signature verification | Critical 9.4 | |
| CVE-2026-109758 | Perforce Helix Authentication Service (HAS) deployments that retain the shipped default SCIM bearer token are vulnerable to unauthorized access when the SCIM endpoint is reachable by an attacker. | Critical 9.3 | |
| CVE-2026-97229 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially… gitlab · gitlab | Critical 10.0 | |
| CVE-2026-89111 | The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting multi-tenant BTP applications. | Critical 10.0 | |
| CVE-2026-89110 | SAP NetWeaver Visual Composer does not perform sufficient authorization checks in certain portal functionality. | Critical 9.9 | |
| CVE-2026-89108 | SAP Manufacturing Integration and Intelligence does not sufficiently enforce authorization boundaries within certain administrative functionality. | Critical 9.1 | |
| CVE-2026-89107 | SAP S/4HANA (Manage Substitution/Validation Rules) does not sufficiently validate input processed by rule definition functionality that utilizes a domain-specific scripting language. | Critical 9.9 |
Showing 301–350 of 40,404. Narrow the filters to see the rest.
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status. Filter by severity and year here; the other filters work on the curated lists.