Vulnerability Intelligence · All CVEs
Every Published CVE, Searchable.
Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status.
Synced hourly · figures as of Oct 19, 2026
40,404 vulnerabilities · newest first
- CVE-2026-87689Critical 9.8The Metasploit Framework Web Service REST API (msf-ws) exposes the credential store through Msf::WebServices::CredentialServlet.Published Oct 13, 2026
- CVE-2026-78802Critical 9.8An issue in SKYWORTH DIGITAL CO.,LTD SK-WR6640X Wi-Fi 6 Dual-Band Fiber Router (AX1800M) V1.0.3 allows a remote attacker to execute arbitrary code.Published Oct 13, 2026
- CVE-2026-78799Critical 9.8Directory Traversal vulnerability in Quanxun Huiju Network Technology (Beijing) Co., Ltd IK-Q3000 Enterprise-grade Wi-Fi 6 wireless router Enterprise Edition: <= iKuai8_3.7.23_Enterprise Build 202606021825 - Free Edition: <= iKuai…Published Oct 13, 2026
- CVE-2026-52394Critical 9.1DeepSeek V4 is vulnerable to Incorrect Access Control via a crafted input.Published Oct 13, 2026
- CVE-2026-37107Critical 9.8An issue in HTMLy v.3.1.1 allows a remote attacker to escalate privileges via the get_feed function in the admin.php componentPublished Oct 13, 2026
- CVE-2026-104585Critical 9.8Mobile Security Framework (MobSF) v4.5.2 is vulnerable to Command Injection in /download_data/, /api/v1/scan, Dynamic Analyzer ADB integration module.Published Oct 13, 2026
- CVE-2024-34324Critical 9.1An issue in ProPhoenix Law RMS v2022.2403.3.101 allows attackers to execute a session hijacking attack via injecting a crafted 24-character string into the ASP.NET_SessionId cookie.Published Oct 13, 2026
- CVE-2024-34323Critical 10.0ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an Insecure Direct Object Reference (IDOR) via the usrLogin$hdnPFID parameter.Published Oct 13, 2026
- CVE-2024-34320Critical 9.8ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an incorrect access control issue in sensitive API endpoints.Published Oct 13, 2026
- CVE-2026-96119Critical 9.9IBM i is Affected By An Improper Control of Code Generation Vulnerability in HTTP Server Administration GUIPublished Oct 12, 2026
- CVE-2026-19622Critical 9.8IBM Planning Analytics Local is affected by security vulnerabilitiesPublished Oct 12, 2026
- CVE-2026-82101Critical 9.6DataStage on Cloud Pak for Data Path TraversalPublished Oct 12, 2026
- CVE-2026-82110Critical 9.9DataStage on Cloud Pak for Data Path TraversalPublished Oct 12, 2026
- CVE-2026-109573Critical 9.2phpMyFAQ before 4.1.9 SQL Injection via api/autocomplete Search EndpointPublished Oct 12, 2026
- CVE-2026-44828Critical 9.3Qexo initialization endpoint can reset setup state and expose stored credentialsPublished Oct 12, 2026
- CVE-2026-90920Critical 9.8Maximo AI Service Code InjectionPublished Oct 12, 2026
- CVE-2026-109569Critical 9.3sandboxed.sh through 1.3.0 Container Escape via nsenter Missing Root NamespacePublished Oct 12, 2026
- CVE-2026-109566Critical 9.3Rapyd Admin 9.0.0 before 9.20.0 Hard-Coded Super-Admin Credentials via AuthSeederPublished Oct 12, 2026
- CVE-2025-71429Critical 9.3GPT-SoVITS through 20250606v2pro OS Command Injection via UVR5 vr.pyPublished Oct 12, 2026
- CVE-2020-37279Critical 9.2easy-pdf-merge 0.1.0 through 0.2.6 OS Command Injection via merge functionPublished Oct 12, 2026
- CVE-2026-53997Critical 9.1Netherman Portal del Hermano Account Takeover via Password Reset OraclePublished Oct 12, 2026
- CVE-2026-108929Critical 9.4Netcore NR268 DDNS DDNSset.cgi execvp argument injectionPublished Oct 12, 2026
- CVE-2026-92120Critical 9.1Apache Allura: Oauth1 Replay AttackPublished Oct 12, 2026
- CVE-2026-92119Critical 9.1Apache Allura: REST API Mass AssignmentPublished Oct 12, 2026
- CVE-2026-92116Critical 9.1Apache Allura: OAuth1 missing callback validationPublished Oct 12, 2026
- CVE-2026-109423Critical 9.1NetEase Cloud Music TLS Certificate Validation BypassPublished Oct 12, 2026
- CVE-2026-109422Critical 9.2NetEase Cloud Music RCE via os.navigateExternal IPCPublished Oct 12, 2026
- CVE-2026-109575Critical 9.8In HAProxy Data Plane API 2.2.0 through 3.4.3 (and corresponding Enterprise Edition releases), Server.ConfigureAPI() has process-global authentication logic that improperly drops security controls across multiple transport types.Published Oct 12, 2026
- CVE-2026-96012Critical 9.9IBM Db2 Mirror for i Privilege EscalationPublished Oct 12, 2026
- CVE-2026-108362Critical 9.1Privasys attested TLS accepted evidence from any unrevoked TEE platform (diversion attack)Published Oct 12, 2026
- CVE-2026-87744Critical 9.1Io.quarkus:quarkus-hibernate-orm-rest-data-panache: missing authorization in quarkus rest data panache via dropped security annotationsPublished Oct 12, 2026
- CVE-2026-108918Critical 10.0The manipulation of the argument readE2P leads to command injection.Published Oct 12, 2026
- CVE-2026-77366Critical 9.9obsidian-tc tokens can access arbitrary configured vaultsPublished Oct 12, 2026
- CVE-2026-108917Critical 10.0Edimax BR-6208AC formAutoFWupgrade command injectionPublished Oct 12, 2026
- CVE-2026-84286Critical 9.8ExLlamaV3’s EXL3 loader uses an untrusted, model-supplied index to select a CUDA kernel without first verifying that the index is within bounds.Published Oct 12, 2026
- CVE-2026-108914Critical 9.4Affected by this issue is some unknown functionality of the file /goform/formWlSiteSurvey.Published Oct 12, 2026
- CVE-2026-108915Critical 9.4Edimax BR-6208AC formWlanMP buffer overflowPublished Oct 12, 2026
- CVE-2026-108907Critical 10.0Netcore NR268 CGI Execution user_ok improper authenticationPublished Oct 12, 2026
- CVE-2026-109373Critical 9.2ZITADEL 3.0.0 before 4.19.2 Account Takeover via Unsigned Login V2 Session CookiePublished Oct 12, 2026
- CVE-2026-109372Critical 9.3ZITADEL 3.0.0 before 4.19.2 Account Takeover via SAML Identity-Provider ConfusionPublished Oct 12, 2026
- CVE-2026-109357Critical 9.2LibreNMS before 26.9.0 LDAP Filter Injection Authentication Bypass via Authorization HeaderPublished Oct 12, 2026
- CVE-2026-109321Critical 9.3Grav Login OAuth Plugin before 1.4.3 Predictable Local Credentials Authentication BypassPublished Oct 12, 2026
- CVE-2026-109238Critical 9.2Crawl4AI 0.7.0 before 0.9.4 SSRF via link_preview_config URL SeederPublished Oct 12, 2026
- CVE-2026-85956Critical 9.6Improper privilege management in Progress MarkLogic Server backup and restore operationsPublished Oct 12, 2026
- CVE-2026-85955Critical 9.9Improper privilege management in Progress MarkLogic Server xdmp:eval-inPublished Oct 12, 2026
- CVE-2026-85948Critical 9.9Improper privilege management in Progress MarkLogic Server Management APIPublished Oct 12, 2026
- CVE-2026-85947Critical 9.9Improper privilege management in Progress MarkLogic Server forest operationsPublished Oct 12, 2026
- CVE-2026-9191Critical 9.6Insufficient isolation of user-supplied code in Progress MarkLogic ServerPublished Oct 12, 2026
- CVE-2026-109399Critical 9.2SWUpdate through 2026.05.1 CMS Signature Verification Bypass via Embedded IntermediatesPublished Oct 12, 2026
- CVE-2026-109394Critical 9.1Thirty bees through 1.7.0 Account Takeover via PasswordController Guest CheckoutPublished Oct 12, 2026
| CVE | Title | Severity | Published |
|---|---|---|---|
| CVE-2026-87689 | The Metasploit Framework Web Service REST API (msf-ws) exposes the credential store through Msf::WebServices::CredentialServlet. | Critical 9.8 | |
| CVE-2026-78802 | An issue in SKYWORTH DIGITAL CO.,LTD SK-WR6640X Wi-Fi 6 Dual-Band Fiber Router (AX1800M) V1.0.3 allows a remote attacker to execute arbitrary code. | Critical 9.8 | |
| CVE-2026-78799 | Directory Traversal vulnerability in Quanxun Huiju Network Technology (Beijing) Co., Ltd IK-Q3000 Enterprise-grade Wi-Fi 6 wireless router Enterprise Edition: <= iKuai8_3.7.23_Enterprise Build 202606021825 - Free Edition: <= iKuai… | Critical 9.8 | |
| CVE-2026-52394 | DeepSeek V4 is vulnerable to Incorrect Access Control via a crafted input. | Critical 9.1 | |
| CVE-2026-37107 | An issue in HTMLy v.3.1.1 allows a remote attacker to escalate privileges via the get_feed function in the admin.php component | Critical 9.8 | |
| CVE-2026-104585 | Mobile Security Framework (MobSF) v4.5.2 is vulnerable to Command Injection in /download_data/, /api/v1/scan, Dynamic Analyzer ADB integration module. | Critical 9.8 | |
| CVE-2024-34324 | An issue in ProPhoenix Law RMS v2022.2403.3.101 allows attackers to execute a session hijacking attack via injecting a crafted 24-character string into the ASP.NET_SessionId cookie. | Critical 9.1 | |
| CVE-2024-34323 | ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an Insecure Direct Object Reference (IDOR) via the usrLogin$hdnPFID parameter. | Critical 10.0 | |
| CVE-2024-34320 | ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an incorrect access control issue in sensitive API endpoints. | Critical 9.8 | |
| CVE-2026-96119 | IBM i is Affected By An Improper Control of Code Generation Vulnerability in HTTP Server Administration GUI | Critical 9.9 | |
| CVE-2026-19622 | IBM Planning Analytics Local is affected by security vulnerabilities | Critical 9.8 | |
| CVE-2026-82101 | DataStage on Cloud Pak for Data Path Traversal | Critical 9.6 | |
| CVE-2026-82110 | DataStage on Cloud Pak for Data Path Traversal | Critical 9.9 | |
| CVE-2026-109573 | phpMyFAQ before 4.1.9 SQL Injection via api/autocomplete Search Endpoint | Critical 9.2 | |
| CVE-2026-44828 | Qexo initialization endpoint can reset setup state and expose stored credentials | Critical 9.3 | |
| CVE-2026-90920 | Maximo AI Service Code Injection | Critical 9.8 | |
| CVE-2026-109569 | sandboxed.sh through 1.3.0 Container Escape via nsenter Missing Root Namespace | Critical 9.3 | |
| CVE-2026-109566 | Rapyd Admin 9.0.0 before 9.20.0 Hard-Coded Super-Admin Credentials via AuthSeeder | Critical 9.3 | |
| CVE-2025-71429 | GPT-SoVITS through 20250606v2pro OS Command Injection via UVR5 vr.py | Critical 9.3 | |
| CVE-2020-37279 | easy-pdf-merge 0.1.0 through 0.2.6 OS Command Injection via merge function | Critical 9.2 | |
| CVE-2026-53997 | Netherman Portal del Hermano Account Takeover via Password Reset Oracle | Critical 9.1 | |
| CVE-2026-108929 | Netcore NR268 DDNS DDNSset.cgi execvp argument injection | Critical 9.4 | |
| CVE-2026-92120 | Apache Allura: Oauth1 Replay Attack | Critical 9.1 | |
| CVE-2026-92119 | Apache Allura: REST API Mass Assignment | Critical 9.1 | |
| CVE-2026-92116 | Apache Allura: OAuth1 missing callback validation | Critical 9.1 | |
| CVE-2026-109423 | NetEase Cloud Music TLS Certificate Validation Bypass | Critical 9.1 | |
| CVE-2026-109422 | NetEase Cloud Music RCE via os.navigateExternal IPC | Critical 9.2 | |
| CVE-2026-109575 | In HAProxy Data Plane API 2.2.0 through 3.4.3 (and corresponding Enterprise Edition releases), Server.ConfigureAPI() has process-global authentication logic that improperly drops security controls across multiple transport types. | Critical 9.8 | |
| CVE-2026-96012 | IBM Db2 Mirror for i Privilege Escalation | Critical 9.9 | |
| CVE-2026-108362 | Privasys attested TLS accepted evidence from any unrevoked TEE platform (diversion attack) | Critical 9.1 | |
| CVE-2026-87744 | Io.quarkus:quarkus-hibernate-orm-rest-data-panache: missing authorization in quarkus rest data panache via dropped security annotations | Critical 9.1 | |
| CVE-2026-108918 | The manipulation of the argument readE2P leads to command injection. | Critical 10.0 | |
| CVE-2026-77366 | obsidian-tc tokens can access arbitrary configured vaults | Critical 9.9 | |
| CVE-2026-108917 | Edimax BR-6208AC formAutoFWupgrade command injection | Critical 10.0 | |
| CVE-2026-84286 | ExLlamaV3’s EXL3 loader uses an untrusted, model-supplied index to select a CUDA kernel without first verifying that the index is within bounds. | Critical 9.8 | |
| CVE-2026-108914 | Affected by this issue is some unknown functionality of the file /goform/formWlSiteSurvey. | Critical 9.4 | |
| CVE-2026-108915 | Edimax BR-6208AC formWlanMP buffer overflow | Critical 9.4 | |
| CVE-2026-108907 | Netcore NR268 CGI Execution user_ok improper authentication | Critical 10.0 | |
| CVE-2026-109373 | ZITADEL 3.0.0 before 4.19.2 Account Takeover via Unsigned Login V2 Session Cookie | Critical 9.2 | |
| CVE-2026-109372 | ZITADEL 3.0.0 before 4.19.2 Account Takeover via SAML Identity-Provider Confusion | Critical 9.3 | |
| CVE-2026-109357 | LibreNMS before 26.9.0 LDAP Filter Injection Authentication Bypass via Authorization Header | Critical 9.2 | |
| CVE-2026-109321 | Grav Login OAuth Plugin before 1.4.3 Predictable Local Credentials Authentication Bypass | Critical 9.3 | |
| CVE-2026-109238 | Crawl4AI 0.7.0 before 0.9.4 SSRF via link_preview_config URL Seeder | Critical 9.2 | |
| CVE-2026-85956 | Improper privilege management in Progress MarkLogic Server backup and restore operations | Critical 9.6 | |
| CVE-2026-85955 | Improper privilege management in Progress MarkLogic Server xdmp:eval-in | Critical 9.9 | |
| CVE-2026-85948 | Improper privilege management in Progress MarkLogic Server Management API | Critical 9.9 | |
| CVE-2026-85947 | Improper privilege management in Progress MarkLogic Server forest operations | Critical 9.9 | |
| CVE-2026-9191 | Insufficient isolation of user-supplied code in Progress MarkLogic Server | Critical 9.6 | |
| CVE-2026-109399 | SWUpdate through 2026.05.1 CMS Signature Verification Bypass via Embedded Intermediates | Critical 9.2 | |
| CVE-2026-109394 | Thirty bees through 1.7.0 Account Takeover via PasswordController Guest Checkout | Critical 9.1 |
Showing 351–400 of 40,404. Narrow the filters to see the rest.
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status. Filter by severity and year here; the other filters work on the curated lists.