Vulnerability Intelligence · All CVEs
Every Published CVE, Searchable.
Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status.
Synced hourly · figures as of Oct 20, 2026
126,396 vulnerabilities · newest first
- CVE-2026-108437High 8.8Microsoft Office Word Remote Code Execution VulnerabilityPublished Oct 15, 2026
- CVE-2026-108433High 7.8Microsoft Office Word Security Feature Bypass VulnerabilityPublished Oct 15, 2026
- CVE-2026-108432High 8.8Microsoft Office Word Remote Code Execution VulnerabilityPublished Oct 15, 2026
- CVE-2026-108431High 8.8Microsoft Office Word Remote Code Execution VulnerabilityPublished Oct 15, 2026
- CVE-2026-108430High 8.8Microsoft Office Word Remote Code Execution VulnerabilityPublished Oct 15, 2026
- CVE-2026-108429High 8.8Microsoft Office Word Remote Code Execution VulnerabilityPublished Oct 15, 2026
- CVE-2026-108428High 8.8Microsoft Office Word Remote Code Execution VulnerabilityPublished Oct 15, 2026
- CVE-2026-108427High 8.8Microsoft Office Word Remote Code Execution VulnerabilityPublished Oct 15, 2026
- CVE-2026-108426High 8.8Microsoft Office Word Remote Code Execution VulnerabilityPublished Oct 15, 2026
- CVE-2026-111357High 7.0Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root, as exploited in the wild in October 2026.Published Oct 15, 2026
- CVE-2026-105040High 8.8EnergizeLab Eilik User-ID Mass Assignment Account TakeoverPublished Oct 15, 2026
- CVE-2026-105036High 7.5EnergizeLab Firmware Updates Downloaded over HTTP Without Integrity ChecksPublished Oct 15, 2026
- CVE-2026-105035High 7.8EnergizeLab FirmwareUpdater Universal Hard-Coded AES KeyPublished Oct 15, 2026
- CVE-2026-105034High 8.2EnergizeLab Eilik Unauthenticated Device-Token Issuance for Arbitrary Serial NumbersPublished Oct 15, 2026
- CVE-2026-105033High 8.8EnergizeLab AI Station Default Root Credentials with SSH EnabledPublished Oct 15, 2026
- CVE-2026-77622High 8.2Sliver: Unauthenticated Memory Exhaustion Denial of Service in Sliver HTTP(S) Listener PNG DecoderPublished Oct 15, 2026
- CVE-2026-97370High 7.5Prior to 7.6.1, RarVM.ExecuteCode in src/main/java/com/github/junrar/unpack/vm/RarVM.java can repeatedly execute a VM_JMP instruction whose target is greater than or equal to the prepared…Published Oct 15, 2026
- CVE-2026-87018High 7.5In versions 4.2.1 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, the client process crashes when a TLS 1.2 server renegotiates after the connection is established and presents…Published Oct 15, 2026
- CVE-2026-55872High 8.7GYM One is open-source gym management software for fitness centers, personal trainers, and sports clubs.Published Oct 15, 2026
- CVE-2026-55587High 8.1Prior to 0.29.4, the AliasVault browser extension passkey provider does not bind passkey requests to the actual webpage origin or verify that the requested…Published Oct 15, 2026
- CVE-2026-55239High 8.8Prior to 1.31.29, the getDateQuery() function in src/server/utils/prisma.ts constructs raw SQL through Prisma.sql() by interpolating the timezone request…Published Oct 15, 2026
- CVE-2026-45165High 8.6An authorization flaw in Idira Conjur version 13.9.0 allows an authenticated user with limited privileges to perform unauthorized actions on a policy branch.Published Oct 15, 2026
- CVE-2026-36436High 7.5An authenticated administrator can inspect the client-side code to retrieve the credential.Published Oct 15, 2026
- CVE-2026-111170High 7.1kedro-datasets 9.3.0 through 9.6.0 Path Traversal via MatplotlibDataset Plot NamePublished Oct 15, 2026
- CVE-2026-111160High 8.7LightLLM through 1.2.0 Unauthenticated DoS via pd_kv_trans_params DeserializationPublished Oct 15, 2026
- CVE-2026-110874High 7.5Dolibarr before 23.0.4 PHP Object Injection via jsonOrUnserialize()Published Oct 15, 2026
- CVE-2026-111234High 8.2SimplePie through 1.9.0 Local File Read via file:// RedirectPublished Oct 15, 2026
- CVE-2026-111231High 8.6Netgate pfSense CE through 2.9.0 Authorization Bypass via config_restore() and config_install()Published Oct 15, 2026
- CVE-2026-111229High 8.6Netgate pfSense CE 2.7.0 through 2.9.0 Command Injection via Captive Portal HA SyncPublished Oct 15, 2026
- CVE-2026-111226High 8.6Netgate pfSense CE 2.4.5 through 2.9.0 OS Command Injection via system_advanced_admin.phpPublished Oct 15, 2026
- CVE-2026-111224High 7.7Netgate pfSense CE through 2.9.0 OS Command Injection via openvpn.connect_async.shPublished Oct 15, 2026
- CVE-2026-111223High 8.6Netgate pfSense CE 2.7.0 through 2.9.0 Command Injection via IPsec Mobile Login BannerPublished Oct 15, 2026
- CVE-2026-111222High 7.5Netgate pfSense CE through 2.9.0 php.ini Injection via Timezone SettingPublished Oct 15, 2026
- CVE-2026-111221High 7.5Netgate pfSense CE through 2.9.0 Command Injection via RADIUS Secret mpd.conf InjectionPublished Oct 15, 2026
- CVE-2026-111220High 8.6Netgate pfSense CE through 2.9.0 Crontab Injection via PPP Periodic Reset ptpidPublished Oct 15, 2026
- CVE-2026-111219High 7.5Netgate pfSense CE through 2.9.0 Command Injection via PPPoE Server UsernamePublished Oct 15, 2026
- CVE-2026-111218High 8.6Netgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via Traffic Shaper LimitersPublished Oct 15, 2026
- CVE-2026-111217High 8.6Netgate pfSense CE through 2.9.0 OS Command Injection via CARP VHIDPublished Oct 15, 2026
- CVE-2026-111216High 8.6Netgate pfSense CE through 2.9.0 OS Command Injection via Gateway Monitor IPPublished Oct 15, 2026
- CVE-2026-111215High 8.6Netgate pfSense CE through 2.9.0 OS Command Injection via Wireless Parent InterfacePublished Oct 15, 2026
- CVE-2026-111214High 8.6Netgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via interfaces_qinq_edit.phpPublished Oct 15, 2026
- CVE-2026-108334High 7.4Github.com/kuadrant/kuadrant-operator/internal/wasm: github.com/rh-api-management/rhcl-operator-product-build/kuadrant-operator: kuadrant-operator: crafted httproute match values can bypass gateway policy…Published Oct 15, 2026
- CVE-2026-104150High 8.7AdonisJS HTTP Server: Uncontrolled Resource Consumption and Inefficient Regular Expression ComplexityPublished Oct 15, 2026
- CVE-2026-104828High 7.2HtmlUnit Neko: Mutation XSS (mXSS) in HTMLWriterFilter - TEXTAREA/TITLE entity decode without re-encodePublished Oct 15, 2026
- CVE-2026-109383High 7.4undici vulnerable to TLS certificate validation bypass via dropped tls options in AgentPublished Oct 15, 2026
- CVE-2026-109829High 7.4undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirectsPublished Oct 15, 2026
- CVE-2026-104827High 7.5react/http: Unbounded HTTP Client Response Header Buffering Leads to Memory Exhaustion DoSPublished Oct 15, 2026
- CVE-2026-55246High 7.8Prior to 0.1.9, bincookie_init_file() in bincookie.h allocates a buffer using the actual .binarycookies file length but trusts the file-controlled num_pages field as the loop bound for…Published Oct 15, 2026
- CVE-2026-55103High 8.6Discourse ActivityPub adds ActivityPub support to Discourse.Published Oct 15, 2026
- CVE-2026-109869High 7.5undici vulnerable to Denial of Service via unhandled error on excessive content-encodingsPublished Oct 15, 2026
| CVE | Title | Severity | Published |
|---|---|---|---|
| CVE-2026-108437 | Microsoft Office Word Remote Code Execution Vulnerability | High 8.8 | |
| CVE-2026-108433 | Microsoft Office Word Security Feature Bypass Vulnerability | High 7.8 | |
| CVE-2026-108432 | Microsoft Office Word Remote Code Execution Vulnerability | High 8.8 | |
| CVE-2026-108431 | Microsoft Office Word Remote Code Execution Vulnerability | High 8.8 | |
| CVE-2026-108430 | Microsoft Office Word Remote Code Execution Vulnerability | High 8.8 | |
| CVE-2026-108429 | Microsoft Office Word Remote Code Execution Vulnerability | High 8.8 | |
| CVE-2026-108428 | Microsoft Office Word Remote Code Execution Vulnerability | High 8.8 | |
| CVE-2026-108427 | Microsoft Office Word Remote Code Execution Vulnerability | High 8.8 | |
| CVE-2026-108426 | Microsoft Office Word Remote Code Execution Vulnerability | High 8.8 | |
| CVE-2026-111357 | Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root, as exploited in the wild in October 2026. | High 7.0 | |
| CVE-2026-105040 | EnergizeLab Eilik User-ID Mass Assignment Account Takeover | High 8.8 | |
| CVE-2026-105036 | EnergizeLab Firmware Updates Downloaded over HTTP Without Integrity Checks | High 7.5 | |
| CVE-2026-105035 | EnergizeLab FirmwareUpdater Universal Hard-Coded AES Key | High 7.8 | |
| CVE-2026-105034 | EnergizeLab Eilik Unauthenticated Device-Token Issuance for Arbitrary Serial Numbers | High 8.2 | |
| CVE-2026-105033 | EnergizeLab AI Station Default Root Credentials with SSH Enabled | High 8.8 | |
| CVE-2026-77622 | Sliver: Unauthenticated Memory Exhaustion Denial of Service in Sliver HTTP(S) Listener PNG Decoder | High 8.2 | |
| CVE-2026-97370 | Prior to 7.6.1, RarVM.ExecuteCode in src/main/java/com/github/junrar/unpack/vm/RarVM.java can repeatedly execute a VM_JMP instruction whose target is greater than or equal to the prepared… | High 7.5 | |
| CVE-2026-87018 | In versions 4.2.1 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, the client process crashes when a TLS 1.2 server renegotiates after the connection is established and presents… | High 7.5 | |
| CVE-2026-55872 | GYM One is open-source gym management software for fitness centers, personal trainers, and sports clubs. | High 8.7 | |
| CVE-2026-55587 | Prior to 0.29.4, the AliasVault browser extension passkey provider does not bind passkey requests to the actual webpage origin or verify that the requested… | High 8.1 | |
| CVE-2026-55239 | Prior to 1.31.29, the getDateQuery() function in src/server/utils/prisma.ts constructs raw SQL through Prisma.sql() by interpolating the timezone request… | High 8.8 | |
| CVE-2026-45165 | An authorization flaw in Idira Conjur version 13.9.0 allows an authenticated user with limited privileges to perform unauthorized actions on a policy branch. | High 8.6 | |
| CVE-2026-36436 | An authenticated administrator can inspect the client-side code to retrieve the credential. | High 7.5 | |
| CVE-2026-111170 | kedro-datasets 9.3.0 through 9.6.0 Path Traversal via MatplotlibDataset Plot Name | High 7.1 | |
| CVE-2026-111160 | LightLLM through 1.2.0 Unauthenticated DoS via pd_kv_trans_params Deserialization | High 8.7 | |
| CVE-2026-110874 | Dolibarr before 23.0.4 PHP Object Injection via jsonOrUnserialize() | High 7.5 | |
| CVE-2026-111234 | SimplePie through 1.9.0 Local File Read via file:// Redirect | High 8.2 | |
| CVE-2026-111231 | Netgate pfSense CE through 2.9.0 Authorization Bypass via config_restore() and config_install() | High 8.6 | |
| CVE-2026-111229 | Netgate pfSense CE 2.7.0 through 2.9.0 Command Injection via Captive Portal HA Sync | High 8.6 | |
| CVE-2026-111226 | Netgate pfSense CE 2.4.5 through 2.9.0 OS Command Injection via system_advanced_admin.php | High 8.6 | |
| CVE-2026-111224 | Netgate pfSense CE through 2.9.0 OS Command Injection via openvpn.connect_async.sh | High 7.7 | |
| CVE-2026-111223 | Netgate pfSense CE 2.7.0 through 2.9.0 Command Injection via IPsec Mobile Login Banner | High 8.6 | |
| CVE-2026-111222 | Netgate pfSense CE through 2.9.0 php.ini Injection via Timezone Setting | High 7.5 | |
| CVE-2026-111221 | Netgate pfSense CE through 2.9.0 Command Injection via RADIUS Secret mpd.conf Injection | High 7.5 | |
| CVE-2026-111220 | Netgate pfSense CE through 2.9.0 Crontab Injection via PPP Periodic Reset ptpid | High 8.6 | |
| CVE-2026-111219 | Netgate pfSense CE through 2.9.0 Command Injection via PPPoE Server Username | High 7.5 | |
| CVE-2026-111218 | Netgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via Traffic Shaper Limiters | High 8.6 | |
| CVE-2026-111217 | Netgate pfSense CE through 2.9.0 OS Command Injection via CARP VHID | High 8.6 | |
| CVE-2026-111216 | Netgate pfSense CE through 2.9.0 OS Command Injection via Gateway Monitor IP | High 8.6 | |
| CVE-2026-111215 | Netgate pfSense CE through 2.9.0 OS Command Injection via Wireless Parent Interface | High 8.6 | |
| CVE-2026-111214 | Netgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via interfaces_qinq_edit.php | High 8.6 | |
| CVE-2026-108334 | Github.com/kuadrant/kuadrant-operator/internal/wasm: github.com/rh-api-management/rhcl-operator-product-build/kuadrant-operator: kuadrant-operator: crafted httproute match values can bypass gateway policy… | High 7.4 | |
| CVE-2026-104150 | AdonisJS HTTP Server: Uncontrolled Resource Consumption and Inefficient Regular Expression Complexity | High 8.7 | |
| CVE-2026-104828 | HtmlUnit Neko: Mutation XSS (mXSS) in HTMLWriterFilter - TEXTAREA/TITLE entity decode without re-encode | High 7.2 | |
| CVE-2026-109383 | undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent | High 7.4 | |
| CVE-2026-109829 | undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects | High 7.4 | |
| CVE-2026-104827 | react/http: Unbounded HTTP Client Response Header Buffering Leads to Memory Exhaustion DoS | High 7.5 | |
| CVE-2026-55246 | Prior to 0.1.9, bincookie_init_file() in bincookie.h allocates a buffer using the actual .binarycookies file length but trusts the file-controlled num_pages field as the loop bound for… | High 7.8 | |
| CVE-2026-55103 | Discourse ActivityPub adds ActivityPub support to Discourse. | High 8.6 | |
| CVE-2026-109869 | undici vulnerable to Denial of Service via unhandled error on excessive content-encodings | High 7.5 |
Showing 401–450 of 126,396. Narrow the filters to see the rest.
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status. Filter by severity and year here; the other filters work on the curated lists.