Vulnerability Intelligence · All CVEs
Every Published CVE, Searchable.
Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status.
Synced hourly · figures as of Oct 19, 2026
11,301 vulnerabilities · newest first
- CVE-2026-101051Low 2.3Cloudreve before 4.16.1 fails to properly sanitize file paths returned by remote downloaders, allowing authenticated users to create files outside the selected destination directory.Published Sep 27, 2026
- CVE-2026-101046Low 2.3Fleet before 4.89.0 contains an SQL injection vulnerability in the activity list endpoints (GET /api/v1/fleet/activities and GET /api/v1/fleet/hosts/{id}/activities).Published Sep 27, 2026
- CVE-2026-15442Low 2.3Heap use-after-free on read during bidirectional (D)TLS shutdownPublished Sep 27, 2026
- CVE-2026-94417Low 2.3CRL check skipped when OCSP enabled and certificate has no OCSP URLPublished Sep 27, 2026
- CVE-2026-94418Low 2.3Signature failure masked by date error under WOLFSSL_SMALL_CERT_VERIFYPublished Sep 27, 2026
- CVE-2026-94419Low 2.3Client session cache reference poisoning allows resumption with wrong serverPublished Sep 27, 2026
- CVE-2026-86839Low 3.8Bookly < 28.3 - Staff+ Appointment and Payment Disclosure, Modification and Deletion via IDORPublished Sep 27, 2026
- CVE-2026-96526Low 2.7MCP Server for WordPress < 1.8.2 - Contributor+ Arbitrary Post Title Disclosure via workflows/run REST RoutePublished Sep 26, 2026
- CVE-2026-96525Low 2.7MCP Server for WordPress < 1.8.2 - Contributor+ Workflow Modification and Deletion via Missing Ownership CheckPublished Sep 26, 2026
- CVE-2026-100554Low 2.3OpenClaw before 2026.8.1 Canvas Capability Revocation BypassPublished Sep 26, 2026
- CVE-2026-100542Low 2.3OpenClaw before 2026.8.1 Extraction Limit Bypass via tar.bz2Published Sep 26, 2026
- CVE-2026-100539Low 2.1OpenClaw before 2026.8.1 Memory Access Control BypassPublished Sep 26, 2026
- CVE-2026-100537Low 2.3OpenClaw before 2026.8.1 Authentication Bypass via Active MemoryPublished Sep 26, 2026
- CVE-2026-100534Low 2.3OpenClaw before 2026.8.1 Session Cancellation Authorization BypassPublished Sep 26, 2026
- CVE-2025-1218Low 3.4Various packet overreads in mysqlnd_writeprotocol.cPublished Sep 25, 2026
- CVE-2026-100417Low 2.3RustDesk before 1.5.0 One-Way File Transfer BypassPublished Sep 25, 2026
- CVE-2026-63204Low 2.3Zammad: Authenticated agents can read AI summary error messages from inaccessible ticketsPublished Sep 25, 2026
- CVE-2026-65828Low 2.3Zammad: Pending upload deletion bypass via legacy attachment endpointPublished Sep 25, 2026
- CVE-2026-56730Low 2.1Zammad: Missing authorization in GraphQL mutation for suggesting knowledge base answersPublished Sep 25, 2026
- CVE-2026-56729Low 2.1Zammad: Titles of knowledge base answers will be shown across all categories via the global searchPublished Sep 25, 2026
- CVE-2026-97869Low 2.1langchain4j LangChain4j-agentic AgenticScopeJsonSerializationIT.java AgenticScopeSerializer.fromJson deserializationPublished Sep 25, 2026
- CVE-2026-96874Low 2.3Stored XSS in Cargo Drilldown tab namesPublished Sep 25, 2026
- CVE-2026-97228Low 2.7Rapid7 Bulk Export MCP — GraphQL Query Injection in Export Status LookupPublished Sep 25, 2026
- CVE-2026-92106Low 2.3lazy_html serializes SVG and MathML style and script text unescaped, allowing mutation XSSPublished Sep 25, 2026
- CVE-2026-97764Low 3.7django-allauth before 65.19.4 does not have the expected limits on failed login attempts because, in some common configurations, an attacker can leverage the handling of diacritics (e.g., accents) for a higher effective limit.Published Sep 25, 2026
- CVE-2026-63630Low 3.4BentoPDF: Workflow Import Allows Unvalidated TSA URL Leading to PDF Hash Exfiltration via RFC 3161 RequestsPublished Sep 24, 2026
- CVE-2026-73064Low 2.9In Mbed TLS 3.2.0 though 3.6.6 and 4.0.0 through 4.1.0, an attacker who can cause an entropy source to fail can remove or inject bytes into the start of the TLS stream.Published Sep 24, 2026
- CVE-2026-19492Low 3.2This Power System update is being released to addressPublished Sep 24, 2026
- CVE-2026-18857Low 3.4IBM OPENBMC FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, and FW1060.00 through FW1060.81 is affected by a vulnerability in the BMC firmware management interface.Published Sep 24, 2026
- CVE-2026-18104Low 3.3IBM Db2 Mirror for i 7.6, 7.5, and 7.4 could allow a local attacker to obtain sensitive information due to the use of the AES Electronic Codebook (ECB) mode for encryption.Published Sep 24, 2026
- CVE-2026-17511Low 3.4IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3 is affected by a vulnerability in the partition resource dump interface.Published Sep 24, 2026
- CVE-2026-77797Low 3.6Velociraptor Prefetch parser out of boundsPublished Sep 24, 2026
- CVE-2026-11744Low 3.8PaperCut Hive Embedded App for Ricoh: Javascript injectionPublished Sep 24, 2026
- CVE-2026-93661Low 2.7Events Manager < 7.4.5 - Contributor+ Arbitrary Ticket Overwrite via IDORPublished Sep 24, 2026
- CVE-2026-89004Low 2.7WPeMatico RSS Feed Fetcher < 2.8.26 - Contributor+ Campaign Configuration and Log Disclosure via IDORPublished Sep 24, 2026
- CVE-2026-84151Low 3.5The Post Grid < 7.9.5 - Contributor+ Stored HTML/iframe Injection via wp_kses_post Allow-List WideningPublished Sep 24, 2026
- CVE-2026-92628Low 3.1Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in GitLabPublished Sep 23, 2026
- CVE-2026-96552Low 2.3sfturing hosp_order User Password MD5.java MD5.getMD5 hash without saltPublished Sep 23, 2026
- CVE-2026-96872Low 2.9WikiLambda public function execution bypasses the unsaved-code permission through nested Z825 compositionsPublished Sep 23, 2026
- CVE-2026-96546Low 2.5Gimp: gimp: one-byte out-of-bounds heap read in the uncompressed dds loaderPublished Sep 23, 2026
- CVE-2026-71465Low 3.1Automation-controller: automation-controller-container: automation-controller: ad-hoc command limit field allows cli argument injection into ansible executablePublished Sep 23, 2026
- CVE-2026-71464Low 3.1Automation-controller: automation-controller-container: automation-controller: schedule and workflowjobtemplatenode scm_branch prompt bypasses leading-dash git-argument guardPublished Sep 23, 2026
- CVE-2026-71463Low 2.7Automation-controller: automation-controller-container: automation-controller: notification template jinja whitelist bypass via conditional gating leaks tracebacksPublished Sep 23, 2026
- CVE-2026-4921Low 2.7IBM Guardium Data Protection is affected by multiple vulnerabilities.Published Sep 23, 2026
- CVE-2026-71178Low 3.7Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Use of Non-Canonical URL Paths for Authorization Decisions vulnerability.Published Sep 23, 2026
- CVE-2026-78253Low 2.3Denial-of-service (stack-exhaustion) vulnerability in QXmlStreamReader::readElementText() impacts QtPublished Sep 23, 2026
- CVE-2026-77756Low 3.7Apache Tomcat: Transfer-Encoding honored for HTTP/1.0 requestsPublished Sep 23, 2026
- CVE-2026-87848Low 3.7The MPCX Lightbox WordPress plugin 1.2.2 through 1.2.5 does not have any authorisation or authentication on one of its AJAX actions available to unauthenticated users, nor does it check the status of the requested post, allowing…Published Sep 23, 2026
- CVE-2026-79616Low 0.6Out-of-bounds read while parsing untrusted SVG path strings in Qt Quick's Context2D.path / PathSvg.path.Published Sep 23, 2026
- CVE-2026-93528Low 3.7NP Quote Request for WooCommerce < 2.4.16 - Unauthenticated Order Data Disclosure via Quote Request PagePublished Sep 23, 2026
| CVE | Title | Severity | Published |
|---|---|---|---|
| CVE-2026-101051 | Cloudreve before 4.16.1 fails to properly sanitize file paths returned by remote downloaders, allowing authenticated users to create files outside the selected destination directory. | Low 2.3 | |
| CVE-2026-101046 | Fleet before 4.89.0 contains an SQL injection vulnerability in the activity list endpoints (GET /api/v1/fleet/activities and GET /api/v1/fleet/hosts/{id}/activities). | Low 2.3 | |
| CVE-2026-15442 | Heap use-after-free on read during bidirectional (D)TLS shutdown | Low 2.3 | |
| CVE-2026-94417 | CRL check skipped when OCSP enabled and certificate has no OCSP URL | Low 2.3 | |
| CVE-2026-94418 | Signature failure masked by date error under WOLFSSL_SMALL_CERT_VERIFY | Low 2.3 | |
| CVE-2026-94419 | Client session cache reference poisoning allows resumption with wrong server | Low 2.3 | |
| CVE-2026-86839 | Bookly < 28.3 - Staff+ Appointment and Payment Disclosure, Modification and Deletion via IDOR | Low 3.8 | |
| CVE-2026-96526 | MCP Server for WordPress < 1.8.2 - Contributor+ Arbitrary Post Title Disclosure via workflows/run REST Route | Low 2.7 | |
| CVE-2026-96525 | MCP Server for WordPress < 1.8.2 - Contributor+ Workflow Modification and Deletion via Missing Ownership Check | Low 2.7 | |
| CVE-2026-100554 | OpenClaw before 2026.8.1 Canvas Capability Revocation Bypass | Low 2.3 | |
| CVE-2026-100542 | OpenClaw before 2026.8.1 Extraction Limit Bypass via tar.bz2 | Low 2.3 | |
| CVE-2026-100539 | OpenClaw before 2026.8.1 Memory Access Control Bypass | Low 2.1 | |
| CVE-2026-100537 | OpenClaw before 2026.8.1 Authentication Bypass via Active Memory | Low 2.3 | |
| CVE-2026-100534 | OpenClaw before 2026.8.1 Session Cancellation Authorization Bypass | Low 2.3 | |
| CVE-2025-1218 | Various packet overreads in mysqlnd_writeprotocol.c | Low 3.4 | |
| CVE-2026-100417 | RustDesk before 1.5.0 One-Way File Transfer Bypass | Low 2.3 | |
| CVE-2026-63204 | Zammad: Authenticated agents can read AI summary error messages from inaccessible tickets | Low 2.3 | |
| CVE-2026-65828 | Zammad: Pending upload deletion bypass via legacy attachment endpoint | Low 2.3 | |
| CVE-2026-56730 | Zammad: Missing authorization in GraphQL mutation for suggesting knowledge base answers | Low 2.1 | |
| CVE-2026-56729 | Zammad: Titles of knowledge base answers will be shown across all categories via the global search | Low 2.1 | |
| CVE-2026-97869 | langchain4j LangChain4j-agentic AgenticScopeJsonSerializationIT.java AgenticScopeSerializer.fromJson deserialization | Low 2.1 | |
| CVE-2026-96874 | Stored XSS in Cargo Drilldown tab names | Low 2.3 | |
| CVE-2026-97228 | Rapid7 Bulk Export MCP — GraphQL Query Injection in Export Status Lookup | Low 2.7 | |
| CVE-2026-92106 | lazy_html serializes SVG and MathML style and script text unescaped, allowing mutation XSS | Low 2.3 | |
| CVE-2026-97764 | django-allauth before 65.19.4 does not have the expected limits on failed login attempts because, in some common configurations, an attacker can leverage the handling of diacritics (e.g., accents) for a higher effective limit. | Low 3.7 | |
| CVE-2026-63630 | BentoPDF: Workflow Import Allows Unvalidated TSA URL Leading to PDF Hash Exfiltration via RFC 3161 Requests | Low 3.4 | |
| CVE-2026-73064 | In Mbed TLS 3.2.0 though 3.6.6 and 4.0.0 through 4.1.0, an attacker who can cause an entropy source to fail can remove or inject bytes into the start of the TLS stream. | Low 2.9 | |
| CVE-2026-19492 | This Power System update is being released to address | Low 3.2 | |
| CVE-2026-18857 | IBM OPENBMC FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, and FW1060.00 through FW1060.81 is affected by a vulnerability in the BMC firmware management interface. | Low 3.4 | |
| CVE-2026-18104 | IBM Db2 Mirror for i 7.6, 7.5, and 7.4 could allow a local attacker to obtain sensitive information due to the use of the AES Electronic Codebook (ECB) mode for encryption. | Low 3.3 | |
| CVE-2026-17511 | IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3 is affected by a vulnerability in the partition resource dump interface. | Low 3.4 | |
| CVE-2026-77797 | Velociraptor Prefetch parser out of bounds | Low 3.6 | |
| CVE-2026-11744 | PaperCut Hive Embedded App for Ricoh: Javascript injection | Low 3.8 | |
| CVE-2026-93661 | Events Manager < 7.4.5 - Contributor+ Arbitrary Ticket Overwrite via IDOR | Low 2.7 | |
| CVE-2026-89004 | WPeMatico RSS Feed Fetcher < 2.8.26 - Contributor+ Campaign Configuration and Log Disclosure via IDOR | Low 2.7 | |
| CVE-2026-84151 | The Post Grid < 7.9.5 - Contributor+ Stored HTML/iframe Injection via wp_kses_post Allow-List Widening | Low 3.5 | |
| CVE-2026-92628 | Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in GitLab | Low 3.1 | |
| CVE-2026-96552 | sfturing hosp_order User Password MD5.java MD5.getMD5 hash without salt | Low 2.3 | |
| CVE-2026-96872 | WikiLambda public function execution bypasses the unsaved-code permission through nested Z825 compositions | Low 2.9 | |
| CVE-2026-96546 | Gimp: gimp: one-byte out-of-bounds heap read in the uncompressed dds loader | Low 2.5 | |
| CVE-2026-71465 | Automation-controller: automation-controller-container: automation-controller: ad-hoc command limit field allows cli argument injection into ansible executable | Low 3.1 | |
| CVE-2026-71464 | Automation-controller: automation-controller-container: automation-controller: schedule and workflowjobtemplatenode scm_branch prompt bypasses leading-dash git-argument guard | Low 3.1 | |
| CVE-2026-71463 | Automation-controller: automation-controller-container: automation-controller: notification template jinja whitelist bypass via conditional gating leaks tracebacks | Low 2.7 | |
| CVE-2026-4921 | IBM Guardium Data Protection is affected by multiple vulnerabilities. | Low 2.7 | |
| CVE-2026-71178 | Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Use of Non-Canonical URL Paths for Authorization Decisions vulnerability. | Low 3.7 | |
| CVE-2026-78253 | Denial-of-service (stack-exhaustion) vulnerability in QXmlStreamReader::readElementText() impacts Qt | Low 2.3 | |
| CVE-2026-77756 | Apache Tomcat: Transfer-Encoding honored for HTTP/1.0 requests | Low 3.7 | |
| CVE-2026-87848 | The MPCX Lightbox WordPress plugin 1.2.2 through 1.2.5 does not have any authorisation or authentication on one of its AJAX actions available to unauthenticated users, nor does it check the status of the requested post, allowing… | Low 3.7 | |
| CVE-2026-79616 | Out-of-bounds read while parsing untrusted SVG path strings in Qt Quick's Context2D.path / PathSvg.path. | Low 0.6 | |
| CVE-2026-93528 | NP Quote Request for WooCommerce < 2.4.16 - Unauthenticated Order Data Disclosure via Quote Request Page | Low 3.7 |
Showing 351–400 of 11,301. Narrow the filters to see the rest.
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status. Filter by severity and year here; the other filters work on the curated lists.