Vulnerability Intelligence · All CVEs
Every Published CVE, Searchable.
Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status.
Synced hourly · figures as of Oct 19, 2026
392,087 vulnerabilities · newest first
- CVE-2026-110494UnscoredAdding attachments to a release checked the repository and release of an attachment but not whether it was already linked to an issue or comment.Published Oct 18, 2026
- CVE-2026-110324UnscoredThe visibility check of Gitea user profiles was applied to GET requests only, while POST /{username} (follow and unfollow) required only a signed-in user.Published Oct 18, 2026
- CVE-2026-110311UnscoredCreating a draft release through the API returned an assets list that was built from a release without an ID, which matched every attachment that was not linked to a release.Published Oct 18, 2026
- CVE-2026-109844UnscoredGET /api/v1/user/subscriptions returned the metadata of every repository a user was watching without checking that the user still had access to it.Published Oct 18, 2026
- CVE-2026-109553UnscoredGitea resolved the principals of an SSH certificate by searching the content of all stored public keys instead of only principal keys.Published Oct 18, 2026
- CVE-2026-107686UnscoredThe Gitea web handlers for adding and removing reactions on issues and comments did not refuse locked issues for users without write access, although the API did.Published Oct 18, 2026
- CVE-2026-107618UnscoredPOST /{owner}/{repo}/topics was registered without the sign-in middleware that provides the cross-origin protection, so a request issued by a third-party site was not rejected.Published Oct 18, 2026
- CVE-2026-105964UnscoredThe Gitea Actions artifact v4 (Twirp) handlers read the whole request body into memory without a size limit.Published Oct 18, 2026
- CVE-2026-105661UnscoredRequesting /{username}/-/repositories for an individual user instead of an organization made the organization home handler dereference a nil organization and panic.Published Oct 18, 2026
- CVE-2026-104627UnscoredThe Gitea OpenID association callback in the security settings accepted a positive OpenID 2.0 assertion without checking that the signed-in user had started the linking.Published Oct 18, 2026
- CVE-2024-4457UnscoredThe Management Console fails to properly validate input related to the configuration of JDBC user stores.Published Oct 18, 2026
- CVE-2026-111993Medium 4.8This manipulation of the argument Password causes…Published Oct 18, 2026
- CVE-2026-111992Medium 5.3A vulnerability was detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449.Published Oct 18, 2026
- CVE-2026-98868UnscoredLinux kernel: dm-pcache: reject a kset that overruns its segmentPublished Oct 18, 2026
- CVE-2026-98867UnscoredLinux kernel: dm-pcache: bound the logical key offset from persistent memoryPublished Oct 18, 2026
- CVE-2026-98866UnscoredLinux kernel: sched/cache: Introduce task_struct->sched_cache_grp to fix UAFPublished Oct 18, 2026
- CVE-2026-98865UnscoredLinux kernel: sched_ext: Don't run ops.dequeue() with a DSQ lock heldPublished Oct 18, 2026
- CVE-2026-98864UnscoredLinux kernel: sched_ext: Wait for SCX_OPSS_DISPATCHING before reenqueueing a taskPublished Oct 18, 2026
- CVE-2026-98863UnscoredLinux kernel: KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages failsPublished Oct 18, 2026
- CVE-2026-98862UnscoredLinux kernel: audit: fix exe mark UAF in kill_rules()Published Oct 18, 2026
- CVE-2026-98861UnscoredLinux kernel: fprobe: Use guard(rcu_sched_notrace) and check rcu_is_watching()Published Oct 18, 2026
- CVE-2026-98860UnscoredLinux kernel: HID: bpf: cast size to ssize_t when checking hid_bpf_hw_requestPublished Oct 18, 2026
- CVE-2026-98859UnscoredLinux kernel: HID: multitouch: stop the release timer from being rearmed on removePublished Oct 18, 2026
- CVE-2026-98858UnscoredLinux kernel: io_uring: fix task_work add use-after-free with SQPOLLPublished Oct 18, 2026
- CVE-2026-98857UnscoredLinux kernel: ipvs: bound LBLCR and LBLC cache growthPublished Oct 18, 2026
- CVE-2026-98856UnscoredLinux kernel: kprobes: Skip disarmed probes when checking optkprobe overlapPublished Oct 18, 2026
- CVE-2026-98855UnscoredLinux kernel: of/overlay: put property on deadprops only after changeset add succeedsPublished Oct 18, 2026
- CVE-2026-98854UnscoredLinux kernel: of/overlay: only treat a positive changeset id as registeredPublished Oct 18, 2026
- CVE-2026-98853UnscoredLinux kernel: net: gso: limit recursive IP-in-IP segmentationPublished Oct 18, 2026
- CVE-2026-98852UnscoredLinux kernel: net: extend IPv6 exthdr detection of tunneled packetsPublished Oct 18, 2026
- CVE-2026-98851UnscoredLinux kernel: netfilter: nft_flow_offload: drop flowtable reference on init error pathPublished Oct 18, 2026
- CVE-2026-98850UnscoredLinux kernel: net/packet: prevent TX_RING byte count overflowPublished Oct 18, 2026
- CVE-2026-98849UnscoredLinux kernel: pfcp: fix socket lifetime on netdevice registration failurePublished Oct 18, 2026
- CVE-2026-98848UnscoredLinux kernel: rtc: ac100: Assign .num before accessing .hwsPublished Oct 18, 2026
- CVE-2026-98847UnscoredLinux kernel: rtc: spear: initialize IRQ state before requesting alarm IRQPublished Oct 18, 2026
- CVE-2026-98846UnscoredLinux kernel: sctp: check RCV_SHUTDOWN after the sendmsg connect waitPublished Oct 18, 2026
- CVE-2026-98845UnscoredLinux kernel: tpm: Disable TPM on null key name mismatchPublished Oct 18, 2026
- CVE-2026-98844UnscoredLinux kernel: netfs: clear post-EOF pagecache when extending a file via writePublished Oct 18, 2026
- CVE-2026-98843UnscoredLinux kernel: netfs: zero gaps in read-gaps folio to avoid writing back stale dataPublished Oct 18, 2026
- CVE-2026-98842UnscoredLinux kernel: module: fix lost error code from codetag_load_module()Published Oct 18, 2026
- CVE-2026-98841UnscoredLinux kernel: virt: vmgenid: set driver_data before registering notification handlersPublished Oct 18, 2026
- CVE-2026-98840UnscoredLinux kernel: vc_screen: reload vc pointer before if (ret) in vcs_write() to avoid UAFPublished Oct 18, 2026
- CVE-2026-98839UnscoredLinux kernel: vt: selection: Fix unsigned underflow and slab-out-of-bounds read in paste_selection()Published Oct 18, 2026
- CVE-2026-98838UnscoredLinux kernel: vt: skip screen update for DEC alignment test on backgroup consolesPublished Oct 18, 2026
- CVE-2026-98837UnscoredLinux kernel: ALSA: caiaq: unregister the input device when probe failsPublished Oct 18, 2026
- CVE-2026-98836UnscoredLinux kernel: ALSA: line6: reject oversized playback packetsPublished Oct 18, 2026
- CVE-2026-98835UnscoredLinux kernel: iio: accel: kionix-kx022a: Fix array boundary checkPublished Oct 18, 2026
- CVE-2026-98834UnscoredLinux kernel: mtd: core: avoid double-free of OTP NVMEM devicePublished Oct 18, 2026
- CVE-2026-98833UnscoredLinux kernel: mtd: core: call _get_device() with the master MTDPublished Oct 18, 2026
- CVE-2026-98832UnscoredLinux kernel: blk-cgroup: save IRQ state in blkg_tryget_closest()Published Oct 18, 2026
| CVE | Title | Severity | Published |
|---|---|---|---|
| CVE-2026-110494 | Adding attachments to a release checked the repository and release of an attachment but not whether it was already linked to an issue or comment. | Unscored | |
| CVE-2026-110324 | The visibility check of Gitea user profiles was applied to GET requests only, while POST /{username} (follow and unfollow) required only a signed-in user. | Unscored | |
| CVE-2026-110311 | Creating a draft release through the API returned an assets list that was built from a release without an ID, which matched every attachment that was not linked to a release. | Unscored | |
| CVE-2026-109844 | GET /api/v1/user/subscriptions returned the metadata of every repository a user was watching without checking that the user still had access to it. | Unscored | |
| CVE-2026-109553 | Gitea resolved the principals of an SSH certificate by searching the content of all stored public keys instead of only principal keys. | Unscored | |
| CVE-2026-107686 | The Gitea web handlers for adding and removing reactions on issues and comments did not refuse locked issues for users without write access, although the API did. | Unscored | |
| CVE-2026-107618 | POST /{owner}/{repo}/topics was registered without the sign-in middleware that provides the cross-origin protection, so a request issued by a third-party site was not rejected. | Unscored | |
| CVE-2026-105964 | The Gitea Actions artifact v4 (Twirp) handlers read the whole request body into memory without a size limit. | Unscored | |
| CVE-2026-105661 | Requesting /{username}/-/repositories for an individual user instead of an organization made the organization home handler dereference a nil organization and panic. | Unscored | |
| CVE-2026-104627 | The Gitea OpenID association callback in the security settings accepted a positive OpenID 2.0 assertion without checking that the signed-in user had started the linking. | Unscored | |
| CVE-2024-4457 | The Management Console fails to properly validate input related to the configuration of JDBC user stores. | Unscored | |
| CVE-2026-111993 | This manipulation of the argument Password causes… | Medium 4.8 | |
| CVE-2026-111992 | A vulnerability was detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. | Medium 5.3 | |
| CVE-2026-98868 | Linux kernel: dm-pcache: reject a kset that overruns its segment | Unscored | |
| CVE-2026-98867 | Linux kernel: dm-pcache: bound the logical key offset from persistent memory | Unscored | |
| CVE-2026-98866 | Linux kernel: sched/cache: Introduce task_struct->sched_cache_grp to fix UAF | Unscored | |
| CVE-2026-98865 | Linux kernel: sched_ext: Don't run ops.dequeue() with a DSQ lock held | Unscored | |
| CVE-2026-98864 | Linux kernel: sched_ext: Wait for SCX_OPSS_DISPATCHING before reenqueueing a task | Unscored | |
| CVE-2026-98863 | Linux kernel: KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails | Unscored | |
| CVE-2026-98862 | Linux kernel: audit: fix exe mark UAF in kill_rules() | Unscored | |
| CVE-2026-98861 | Linux kernel: fprobe: Use guard(rcu_sched_notrace) and check rcu_is_watching() | Unscored | |
| CVE-2026-98860 | Linux kernel: HID: bpf: cast size to ssize_t when checking hid_bpf_hw_request | Unscored | |
| CVE-2026-98859 | Linux kernel: HID: multitouch: stop the release timer from being rearmed on remove | Unscored | |
| CVE-2026-98858 | Linux kernel: io_uring: fix task_work add use-after-free with SQPOLL | Unscored | |
| CVE-2026-98857 | Linux kernel: ipvs: bound LBLCR and LBLC cache growth | Unscored | |
| CVE-2026-98856 | Linux kernel: kprobes: Skip disarmed probes when checking optkprobe overlap | Unscored | |
| CVE-2026-98855 | Linux kernel: of/overlay: put property on deadprops only after changeset add succeeds | Unscored | |
| CVE-2026-98854 | Linux kernel: of/overlay: only treat a positive changeset id as registered | Unscored | |
| CVE-2026-98853 | Linux kernel: net: gso: limit recursive IP-in-IP segmentation | Unscored | |
| CVE-2026-98852 | Linux kernel: net: extend IPv6 exthdr detection of tunneled packets | Unscored | |
| CVE-2026-98851 | Linux kernel: netfilter: nft_flow_offload: drop flowtable reference on init error path | Unscored | |
| CVE-2026-98850 | Linux kernel: net/packet: prevent TX_RING byte count overflow | Unscored | |
| CVE-2026-98849 | Linux kernel: pfcp: fix socket lifetime on netdevice registration failure | Unscored | |
| CVE-2026-98848 | Linux kernel: rtc: ac100: Assign .num before accessing .hws | Unscored | |
| CVE-2026-98847 | Linux kernel: rtc: spear: initialize IRQ state before requesting alarm IRQ | Unscored | |
| CVE-2026-98846 | Linux kernel: sctp: check RCV_SHUTDOWN after the sendmsg connect wait | Unscored | |
| CVE-2026-98845 | Linux kernel: tpm: Disable TPM on null key name mismatch | Unscored | |
| CVE-2026-98844 | Linux kernel: netfs: clear post-EOF pagecache when extending a file via write | Unscored | |
| CVE-2026-98843 | Linux kernel: netfs: zero gaps in read-gaps folio to avoid writing back stale data | Unscored | |
| CVE-2026-98842 | Linux kernel: module: fix lost error code from codetag_load_module() | Unscored | |
| CVE-2026-98841 | Linux kernel: virt: vmgenid: set driver_data before registering notification handlers | Unscored | |
| CVE-2026-98840 | Linux kernel: vc_screen: reload vc pointer before if (ret) in vcs_write() to avoid UAF | Unscored | |
| CVE-2026-98839 | Linux kernel: vt: selection: Fix unsigned underflow and slab-out-of-bounds read in paste_selection() | Unscored | |
| CVE-2026-98838 | Linux kernel: vt: skip screen update for DEC alignment test on backgroup consoles | Unscored | |
| CVE-2026-98837 | Linux kernel: ALSA: caiaq: unregister the input device when probe fails | Unscored | |
| CVE-2026-98836 | Linux kernel: ALSA: line6: reject oversized playback packets | Unscored | |
| CVE-2026-98835 | Linux kernel: iio: accel: kionix-kx022a: Fix array boundary check | Unscored | |
| CVE-2026-98834 | Linux kernel: mtd: core: avoid double-free of OTP NVMEM device | Unscored | |
| CVE-2026-98833 | Linux kernel: mtd: core: call _get_device() with the master MTD | Unscored | |
| CVE-2026-98832 | Linux kernel: blk-cgroup: save IRQ state in blkg_tryget_closest() | Unscored |
Showing 351–400 of 392,087. Narrow the filters to see the rest.
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status. Filter by severity and year here; the other filters work on the curated lists.