Vulnerability Intelligence · All CVEs
Every Published CVE, Searchable.
Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status.
Synced hourly · figures as of Oct 20, 2026
40,421 vulnerabilities · newest first
- CVE-2026-84286Critical 9.8ExLlamaV3’s EXL3 loader uses an untrusted, model-supplied index to select a CUDA kernel without first verifying that the index is within bounds.Published Oct 12, 2026
- CVE-2026-108914Critical 9.4Affected by this issue is some unknown functionality of the file /goform/formWlSiteSurvey.Published Oct 12, 2026
- CVE-2026-108915Critical 9.4Edimax BR-6208AC formWlanMP buffer overflowPublished Oct 12, 2026
- CVE-2026-108907Critical 10.0Netcore NR268 CGI Execution user_ok improper authenticationPublished Oct 12, 2026
- CVE-2026-109373Critical 9.2ZITADEL 3.0.0 before 4.19.2 Account Takeover via Unsigned Login V2 Session CookiePublished Oct 12, 2026
- CVE-2026-109372Critical 9.3ZITADEL 3.0.0 before 4.19.2 Account Takeover via SAML Identity-Provider ConfusionPublished Oct 12, 2026
- CVE-2026-109357Critical 9.2LibreNMS before 26.9.0 LDAP Filter Injection Authentication Bypass via Authorization HeaderPublished Oct 12, 2026
- CVE-2026-109321Critical 9.3Grav Login OAuth Plugin before 1.4.3 Predictable Local Credentials Authentication BypassPublished Oct 12, 2026
- CVE-2026-109238Critical 9.2Crawl4AI 0.7.0 before 0.9.4 SSRF via link_preview_config URL SeederPublished Oct 12, 2026
- CVE-2026-85956Critical 9.6Improper privilege management in Progress MarkLogic Server backup and restore operationsPublished Oct 12, 2026
- CVE-2026-85955Critical 9.9Improper privilege management in Progress MarkLogic Server xdmp:eval-inPublished Oct 12, 2026
- CVE-2026-85948Critical 9.9Improper privilege management in Progress MarkLogic Server Management APIPublished Oct 12, 2026
- CVE-2026-85947Critical 9.9Improper privilege management in Progress MarkLogic Server forest operationsPublished Oct 12, 2026
- CVE-2026-9191Critical 9.6Insufficient isolation of user-supplied code in Progress MarkLogic ServerPublished Oct 12, 2026
- CVE-2026-109399Critical 9.2SWUpdate through 2026.05.1 CMS Signature Verification Bypass via Embedded IntermediatesPublished Oct 12, 2026
- CVE-2026-109394Critical 9.1Thirty bees through 1.7.0 Account Takeover via PasswordController Guest CheckoutPublished Oct 12, 2026
- CVE-2026-109391Critical 9.2Square Squash through commit e73f280 Unauthenticated YAML Deserialization via Symbolication APIPublished Oct 12, 2026
- CVE-2026-92681Critical 9.3@neo4j/graphql: schema-level and type-level @authentication not enforced on top-level @cypher fieldsPublished Oct 12, 2026
- CVE-2026-109390Critical 9.8AnyDesk before 8.0.3 allows unauthenticated remote attackers to execute arbitrary code via a heap-based buffer overflow, as demonstrated on Linux for command execution as root without the victim approving desktop control.Published Oct 12, 2026
- CVE-2026-108896Critical 9.4Linksys E1700 setLinksysIpv6 os command injectionPublished Oct 12, 2026
- CVE-2026-108894Critical 9.4Performing a manipulation of the argument…Published Oct 12, 2026
- CVE-2026-108893Critical 9.4Such manipulation of the argument vlan_set leads to stack-based buffer overflow.Published Oct 12, 2026
- CVE-2026-108892Critical 10.0A vulnerability was determined in Linksys E1700 1.0.0.4.003.Published Oct 12, 2026
- CVE-2026-108895Critical 9.4Linksys E1700 setDMZ os command injectionPublished Oct 12, 2026
- CVE-2026-85499Critical 9.1Improper Authorization vulnerability in Apache SkyWalking BanyanDB.Published Oct 12, 2026
- CVE-2026-93582Critical 9.4The HTTP Basic Authentication modules in ((OTRS)) Community Edition 6 and prior accept the authenticated username from either the REMOTE_USER or HTTP_REMOTE_USER environment variable.Published Oct 12, 2026
- CVE-2026-78357Critical 9.1Previously issued authentication tokens are not immediately invalidated when an OTRS agent or customer user account is deactivated or its password is changed.Published Oct 12, 2026
- CVE-2026-108804Critical 10.0TRENDnet TEW-751DR/TEW-752DRU/TEW733GR Web Management Backend pigwidgeon.cgi fwrite os command injectionPublished Oct 12, 2026
- CVE-2026-108860Critical 9.3BotSharp through 5.2.0 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to forge bearer tokens using the hard-coded Jwt:Key in WebStarter appsettings.json.Published Oct 11, 2026
- CVE-2026-108753Critical 9.3Agnaistic agnai through 1.0.555 contains a hard-coded credentials vulnerability in self-host.docker-compose.yml, which sets a fixed admin password and public JWT secret.Published Oct 11, 2026
- CVE-2026-108576Critical 10.0The manipulation of the argument Host results in os command injection.Published Oct 11, 2026
- CVE-2026-108540Critical 9.4OpenSpug File Transfer transfer os command injectionPublished Oct 11, 2026
- CVE-2026-86717Critical 9.1Insurify <= 1.0 - Unauthenticated Arbitrary Option Deletion via removeimg_popupPublished Oct 11, 2026
- CVE-2026-86706Critical 9.1Quick quotes <= 1.0.0 - Unauthenticated Integer-Value Option UpdatePublished Oct 11, 2026
- CVE-2026-85121Critical 9.1Insurify <= 1.0 - Unauthenticated Arbitrary Option Creation and Overwrite via saveemailtemplatedesignPublished Oct 11, 2026
- CVE-2026-85118Critical 9.8AI Content Generator Marketing <= 1.0.0 - Unauthenticated Privilege Escalation via Arbitrary Option Update and DeletionPublished Oct 11, 2026
- CVE-2026-84737Critical 9.8Freeton WP <= 1.0.0 - Unauthenticated Account Takeover via 'secod' ParameterPublished Oct 11, 2026
- CVE-2026-84734Critical 9.8Mindstien Quick Login <= 1.0 - Unauthenticated Administrator Account Takeover via 'mql_pass' ParameterPublished Oct 11, 2026
- CVE-2026-84254Critical 9.8click5 CRM add-on to Contact Form 7 <= 1.0.4 - Unauthenticated Arbitrary Options UpdatePublished Oct 11, 2026
- CVE-2026-84253Critical 9.8click5 CRM add-on to Gravity Forms <= 1.0.3 - Unauthenticated Arbitrary Options UpdatePublished Oct 11, 2026
- CVE-2026-84252Critical 9.8click5 CRM add-on to WPForms <= 1.0.3 - Unauthenticated Arbitrary Options UpdatePublished Oct 11, 2026
- CVE-2026-84251Critical 9.8click5 CRM add-on to Ninja Forms <= 1.0.1 - Unauthenticated Arbitrary Options UpdatePublished Oct 11, 2026
- CVE-2026-81649Critical 9.1Fundiin <= 3.4.0 - Unauthenticated Payment Gateway Settings Update and Credential DisclosurePublished Oct 11, 2026
- CVE-2026-104028Critical 9.8Anton Extensions <= 1.2.2 - Unauthenticated Arbitrary File Upload to RCEPublished Oct 11, 2026
- CVE-2026-108707Critical 9.3Wukong_HRM through commit 186115e contains an authentication bypass vulnerability in ParamAspect that allows unauthenticated attackers to call every HRM API endpoint by omitting the AUTH-TOKEN header.Published Oct 11, 2026
- CVE-2026-81797Critical 9.8WordPress Buzz Stone | Magazine & Viral Blog WordPress Theme theme <= 1.0.2 - PHP Object Injection vulnerabilityPublished Oct 10, 2026
- CVE-2026-78535Critical 9.8WordPress Photolia theme <= 1.0.3 - PHP Object Injection vulnerabilityPublished Oct 10, 2026
- CVE-2026-78533Critical 9.8WordPress Qwery theme <= 3.6.1 - PHP Object Injection vulnerabilityPublished Oct 10, 2026
- CVE-2026-78531Critical 9.8WordPress Jacqueline theme <= 2.22 - PHP Object Injection vulnerabilityPublished Oct 10, 2026
- CVE-2026-78529Critical 9.8WordPress Alliance theme <= 3.11 - PHP Object Injection vulnerabilityPublished Oct 10, 2026
| CVE | Title | Severity | Published |
|---|---|---|---|
| CVE-2026-84286 | ExLlamaV3’s EXL3 loader uses an untrusted, model-supplied index to select a CUDA kernel without first verifying that the index is within bounds. | Critical 9.8 | |
| CVE-2026-108914 | Affected by this issue is some unknown functionality of the file /goform/formWlSiteSurvey. | Critical 9.4 | |
| CVE-2026-108915 | Edimax BR-6208AC formWlanMP buffer overflow | Critical 9.4 | |
| CVE-2026-108907 | Netcore NR268 CGI Execution user_ok improper authentication | Critical 10.0 | |
| CVE-2026-109373 | ZITADEL 3.0.0 before 4.19.2 Account Takeover via Unsigned Login V2 Session Cookie | Critical 9.2 | |
| CVE-2026-109372 | ZITADEL 3.0.0 before 4.19.2 Account Takeover via SAML Identity-Provider Confusion | Critical 9.3 | |
| CVE-2026-109357 | LibreNMS before 26.9.0 LDAP Filter Injection Authentication Bypass via Authorization Header | Critical 9.2 | |
| CVE-2026-109321 | Grav Login OAuth Plugin before 1.4.3 Predictable Local Credentials Authentication Bypass | Critical 9.3 | |
| CVE-2026-109238 | Crawl4AI 0.7.0 before 0.9.4 SSRF via link_preview_config URL Seeder | Critical 9.2 | |
| CVE-2026-85956 | Improper privilege management in Progress MarkLogic Server backup and restore operations | Critical 9.6 | |
| CVE-2026-85955 | Improper privilege management in Progress MarkLogic Server xdmp:eval-in | Critical 9.9 | |
| CVE-2026-85948 | Improper privilege management in Progress MarkLogic Server Management API | Critical 9.9 | |
| CVE-2026-85947 | Improper privilege management in Progress MarkLogic Server forest operations | Critical 9.9 | |
| CVE-2026-9191 | Insufficient isolation of user-supplied code in Progress MarkLogic Server | Critical 9.6 | |
| CVE-2026-109399 | SWUpdate through 2026.05.1 CMS Signature Verification Bypass via Embedded Intermediates | Critical 9.2 | |
| CVE-2026-109394 | Thirty bees through 1.7.0 Account Takeover via PasswordController Guest Checkout | Critical 9.1 | |
| CVE-2026-109391 | Square Squash through commit e73f280 Unauthenticated YAML Deserialization via Symbolication API | Critical 9.2 | |
| CVE-2026-92681 | @neo4j/graphql: schema-level and type-level @authentication not enforced on top-level @cypher fields | Critical 9.3 | |
| CVE-2026-109390 | AnyDesk before 8.0.3 allows unauthenticated remote attackers to execute arbitrary code via a heap-based buffer overflow, as demonstrated on Linux for command execution as root without the victim approving desktop control. | Critical 9.8 | |
| CVE-2026-108896 | Linksys E1700 setLinksysIpv6 os command injection | Critical 9.4 | |
| CVE-2026-108894 | Performing a manipulation of the argument… | Critical 9.4 | |
| CVE-2026-108893 | Such manipulation of the argument vlan_set leads to stack-based buffer overflow. | Critical 9.4 | |
| CVE-2026-108892 | A vulnerability was determined in Linksys E1700 1.0.0.4.003. | Critical 10.0 | |
| CVE-2026-108895 | Linksys E1700 setDMZ os command injection | Critical 9.4 | |
| CVE-2026-85499 | Improper Authorization vulnerability in Apache SkyWalking BanyanDB. | Critical 9.1 | |
| CVE-2026-93582 | The HTTP Basic Authentication modules in ((OTRS)) Community Edition 6 and prior accept the authenticated username from either the REMOTE_USER or HTTP_REMOTE_USER environment variable. | Critical 9.4 | |
| CVE-2026-78357 | Previously issued authentication tokens are not immediately invalidated when an OTRS agent or customer user account is deactivated or its password is changed. | Critical 9.1 | |
| CVE-2026-108804 | TRENDnet TEW-751DR/TEW-752DRU/TEW733GR Web Management Backend pigwidgeon.cgi fwrite os command injection | Critical 10.0 | |
| CVE-2026-108860 | BotSharp through 5.2.0 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to forge bearer tokens using the hard-coded Jwt:Key in WebStarter appsettings.json. | Critical 9.3 | |
| CVE-2026-108753 | Agnaistic agnai through 1.0.555 contains a hard-coded credentials vulnerability in self-host.docker-compose.yml, which sets a fixed admin password and public JWT secret. | Critical 9.3 | |
| CVE-2026-108576 | The manipulation of the argument Host results in os command injection. | Critical 10.0 | |
| CVE-2026-108540 | OpenSpug File Transfer transfer os command injection | Critical 9.4 | |
| CVE-2026-86717 | Insurify <= 1.0 - Unauthenticated Arbitrary Option Deletion via removeimg_popup | Critical 9.1 | |
| CVE-2026-86706 | Quick quotes <= 1.0.0 - Unauthenticated Integer-Value Option Update | Critical 9.1 | |
| CVE-2026-85121 | Insurify <= 1.0 - Unauthenticated Arbitrary Option Creation and Overwrite via saveemailtemplatedesign | Critical 9.1 | |
| CVE-2026-85118 | AI Content Generator Marketing <= 1.0.0 - Unauthenticated Privilege Escalation via Arbitrary Option Update and Deletion | Critical 9.8 | |
| CVE-2026-84737 | Freeton WP <= 1.0.0 - Unauthenticated Account Takeover via 'secod' Parameter | Critical 9.8 | |
| CVE-2026-84734 | Mindstien Quick Login <= 1.0 - Unauthenticated Administrator Account Takeover via 'mql_pass' Parameter | Critical 9.8 | |
| CVE-2026-84254 | click5 CRM add-on to Contact Form 7 <= 1.0.4 - Unauthenticated Arbitrary Options Update | Critical 9.8 | |
| CVE-2026-84253 | click5 CRM add-on to Gravity Forms <= 1.0.3 - Unauthenticated Arbitrary Options Update | Critical 9.8 | |
| CVE-2026-84252 | click5 CRM add-on to WPForms <= 1.0.3 - Unauthenticated Arbitrary Options Update | Critical 9.8 | |
| CVE-2026-84251 | click5 CRM add-on to Ninja Forms <= 1.0.1 - Unauthenticated Arbitrary Options Update | Critical 9.8 | |
| CVE-2026-81649 | Fundiin <= 3.4.0 - Unauthenticated Payment Gateway Settings Update and Credential Disclosure | Critical 9.1 | |
| CVE-2026-104028 | Anton Extensions <= 1.2.2 - Unauthenticated Arbitrary File Upload to RCE | Critical 9.8 | |
| CVE-2026-108707 | Wukong_HRM through commit 186115e contains an authentication bypass vulnerability in ParamAspect that allows unauthenticated attackers to call every HRM API endpoint by omitting the AUTH-TOKEN header. | Critical 9.3 | |
| CVE-2026-81797 | WordPress Buzz Stone | Magazine & Viral Blog WordPress Theme theme <= 1.0.2 - PHP Object Injection vulnerability | Critical 9.8 | |
| CVE-2026-78535 | WordPress Photolia theme <= 1.0.3 - PHP Object Injection vulnerability | Critical 9.8 | |
| CVE-2026-78533 | WordPress Qwery theme <= 3.6.1 - PHP Object Injection vulnerability | Critical 9.8 | |
| CVE-2026-78531 | WordPress Jacqueline theme <= 2.22 - PHP Object Injection vulnerability | Critical 9.8 | |
| CVE-2026-78529 | WordPress Alliance theme <= 3.11 - PHP Object Injection vulnerability | Critical 9.8 |
Showing 401–450 of 40,421. Narrow the filters to see the rest.
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status. Filter by severity and year here; the other filters work on the curated lists.