Vulnerability Intelligence · All CVEs
Every Published CVE, Searchable.
Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status.
Synced hourly · figures as of Oct 20, 2026
11,306 vulnerabilities · newest first
- CVE-2026-78253Low 2.3Denial-of-service (stack-exhaustion) vulnerability in QXmlStreamReader::readElementText() impacts QtPublished Sep 23, 2026
- CVE-2026-77756Low 3.7Apache Tomcat: Transfer-Encoding honored for HTTP/1.0 requestsPublished Sep 23, 2026
- CVE-2026-87848Low 3.7The MPCX Lightbox WordPress plugin 1.2.2 through 1.2.5 does not have any authorisation or authentication on one of its AJAX actions available to unauthenticated users, nor does it check the status of the requested post, allowing…Published Sep 23, 2026
- CVE-2026-79616Low 0.6Out-of-bounds read while parsing untrusted SVG path strings in Qt Quick's Context2D.path / PathSvg.path.Published Sep 23, 2026
- CVE-2026-93528Low 3.7NP Quote Request for WooCommerce < 2.4.16 - Unauthenticated Order Data Disclosure via Quote Request PagePublished Sep 23, 2026
- CVE-2026-93507Low 3.3WC Fields Factory < 4.1.11 - Contributor+ Arbitrary Post Cloning and Private Content DisclosurePublished Sep 23, 2026
- CVE-2026-91077Low 2.7Event Booking Manager for WooCommerce 5.3.6 - 5.7.2 - Contributor+ Unpublished Event Disclosure via mpwem_load_event_listPublished Sep 23, 2026
- CVE-2026-90951Low 3.7Paid Member Subscriptions < 3.1.0 - Unauthenticated In-Flight Checkout State Deletion via pms_process_paymentPublished Sep 23, 2026
- CVE-2026-87074Low 3.7Forminator Forms < 1.57.2.1 - Unauthenticated Arbitrary Recipient Email Sending with Attacker-Controlled LinkPublished Sep 23, 2026
- CVE-2026-87069Low 3.1Forminator Forms < 1.57.2.1 - Subscriber+ Form Stripe Field Migration via migrate_stripePublished Sep 23, 2026
- CVE-2026-84743Low 3.8The Events Calendar 6.15.16.1 - 6.17.4.1 - Contributor+ Event/Venue/Organizer Update, Trash and Ownership Takeover via by-slug REST RoutesPublished Sep 23, 2026
- CVE-2026-84742Low 2.7The Events Calendar 6.15.0 - 6.17.4.1 - Contributor+ Content Publication via TEC V1 REST APIPublished Sep 23, 2026
- CVE-2026-18173Low 3.7IBM Financial Transaction Manager (FTM) is Impacted by Multiple VulnerabilitiesPublished Sep 22, 2026
- CVE-2026-76909Low 2.1Prior to 8.0.3, the change-request approval email template at src/mailtemplates/requested-cr-approval/requested-cr-approval.html.mustache renders the user-controlled…Published Sep 22, 2026
- CVE-2026-62364Low 2.3Prior to 2.0.1, automatically discovered configuration from .weblate, .weblate.ini, or weblate.ini can select the API URL while an unscoped API token is supplied through…Published Sep 22, 2026
- CVE-2026-77285Low 2.4OpenBao Agent Writes Secrets to StdoutPublished Sep 22, 2026
- CVE-2026-95818Low 3.6AT_SECURE program buffer overflow via $ORIGIN processingPublished Sep 22, 2026
- CVE-2026-86698Low 2.3Refresh tokens accepted as private repository credentials at the CDNPublished Sep 22, 2026
- CVE-2026-77637Low 3.8Cloudreve: Privilege Scope Bypass: State-Mutating Admin Operations Accessible via Read-Only OAuth ScopePublished Sep 22, 2026
- CVE-2026-92706Low 3.4Dark Reader: Ability to request icon-like bitmap data from certain local web serversPublished Sep 22, 2026
- CVE-2026-81883Low 3.3radare2: Out-of-bounds Read at the end of string in the LUA 5.3 bytecodePublished Sep 22, 2026
- CVE-2026-81884Low 3.3radare2: Heap out-of-bounds read in radare2 Mach-O LC_DATA_IN_CODE parserPublished Sep 22, 2026
- CVE-2026-92882Low 2.3Insufficiently protected credentials in the host and folder configuration endpoints of the REST API in Checkmk <2.5.0p15, <2.4.0p37, <2.3.0p51 and 2.2.0 (EOL) allows an authenticated user who may view a host's configuration to read stored…Published Sep 22, 2026
- CVE-2026-49449Low 2.5Joplin: KaTeX trust:true enables URL-allowlist bypass leading to NTLMv2 credential theft via UNC path on WindowsPublished Sep 21, 2026
- CVE-2026-85219Low 3.7Denial-of-Service in the OpenCanary Redis servicePublished Sep 21, 2026
- CVE-2026-91165Low 2.4Warpgate: Markup injection in SSO form_post return page via unencoded redirect/error valuesPublished Sep 21, 2026
- CVE-2026-63416Low 3.7draw.io: Path traversal in ExportProxyServlet allows access to arbitrary backend endpointsPublished Sep 21, 2026
- CVE-2026-84298Low 3.1Hatchet: Cross-tenant durable callback payload disclosure in Hatchet V1 DispatcherPublished Sep 21, 2026
- CVE-2026-77166Low 2.4The emoji field in the page emoji update endpoint does not properly validate user input.Published Sep 21, 2026
- CVE-2026-55870Low 2.3Prior to 26.1.0, GoCD can return unmasked credentials that administrators stored in the userinfo portion of source control material URLs through several read-only APIs available to regular…Published Sep 21, 2026
- CVE-2026-55060Low 3.7GoCD is vulnerable to authorization bypass via support process list APIPublished Sep 21, 2026
- CVE-2026-85220Low 3.7A vulnerability in the Thinkst Canary honeypot Redis service allows an unauthenticated remote attacker to execute a Denial-of-Service attack against the honeypot.Published Sep 21, 2026
- CVE-2026-94382Low 2.3Beszel before 0.19.0 contains an insecure direct object reference vulnerability in the POST and DELETE /api/beszel/user-alerts handlers that allows any authenticated user to create or delete alerts on systems they cannot access.Published Sep 21, 2026
- CVE-2026-92612Low 1.0In Eclipse iceoryx2 versions greater than v0.8.0, the StaticString exposes its contents as mutable bytes through safe APIs, while String::as_str() converts those bytes into a Rust string slice without validating UTF-8.Published Sep 21, 2026
- CVE-2026-86802Low 3.7To Do List Member 1.4 - 1.6 - Unauthenticated Content Injection via ImportPublished Sep 21, 2026
- CVE-2026-94218Low 3.1Keycloak-services: keycloak-services: 2fa setup enforcement bypass via authentication session restart endpointPublished Sep 21, 2026
- CVE-2026-94217Low 3.5Keycloak-services: keycloak-services: uma scope merge across resource owners via resource name collisionPublished Sep 21, 2026
- CVE-2026-94030Low 2.3A security vulnerability has been detected in SerenityOS up to 3d83e4509fd20d7438e1ae8470ffe668c136229c.Published Sep 20, 2026
- CVE-2026-92965Low 3.7TikTok 1.2.0 - 1.4.1 - Unauthenticated OAuth Code RedemptionPublished Sep 20, 2026
- CVE-2026-92423Low 2.7Meow Gallery < 5.5.5 - Author+ Draft and Private Post Disclosure via fetch_postsPublished Sep 20, 2026
- CVE-2026-81654Low 3.1NextGEN Gallery < 4.5.0 - Authenticated Plugin Image Settings UpdatePublished Sep 20, 2026
- CVE-2026-81652Low 2.7NextGEN Gallery < 4.5.0 - Contributor+ Image Metadata Disclosure via IDORPublished Sep 20, 2026
- CVE-2026-81651Low 3.1NextGEN Gallery < 4.5.0 - Authenticated Cross-Gallery Settings Modification via IDORPublished Sep 20, 2026
- CVE-2026-86551Low 3.3Wi-Fi MAC Address Obtainment by Non-privileged Program Vulnerability in ZTE Z80Ultra (NX741J) productPublished Sep 20, 2026
- CVE-2026-93989Low 2.3vLLM through 0.29.0 fails to properly validate bad_words token indices against the model's generation output width in SamplingParams.update_from_tokenizer().Published Sep 19, 2026
- CVE-2026-93986Low 2.3rclone before 1.75.1 fails to confine names from server and third-party listing responses to the listed directory, allowing path traversal sequences in object names.Published Sep 19, 2026
- CVE-2026-93981Low 2.3hono before 4.13.7 fails to HTML-escape plain strings rendered by hono/jsx as a child or fallback of Suspense, as a string child of ErrorBoundary alongside an asynchronous sibling, as the single child of a Context.Provider, or as the root…Published Sep 19, 2026
- CVE-2026-92420Low 3.8Hydra Booking < 1.2.2 - Hydra Host+ Cross-Host Booking Deletion and Modification via IDORPublished Sep 19, 2026
- CVE-2026-92403Low 3.7Secure Custom Fields < 6.9.4 - Unauthenticated Post Modification via Front-End Form ID SubstitutionPublished Sep 19, 2026
- CVE-2025-15698Low 3.5Business Name Generator <= 1.3 - Admin+ Stored XSS via Button Color SettingPublished Sep 19, 2026
| CVE | Title | Severity | Published |
|---|---|---|---|
| CVE-2026-78253 | Denial-of-service (stack-exhaustion) vulnerability in QXmlStreamReader::readElementText() impacts Qt | Low 2.3 | |
| CVE-2026-77756 | Apache Tomcat: Transfer-Encoding honored for HTTP/1.0 requests | Low 3.7 | |
| CVE-2026-87848 | The MPCX Lightbox WordPress plugin 1.2.2 through 1.2.5 does not have any authorisation or authentication on one of its AJAX actions available to unauthenticated users, nor does it check the status of the requested post, allowing… | Low 3.7 | |
| CVE-2026-79616 | Out-of-bounds read while parsing untrusted SVG path strings in Qt Quick's Context2D.path / PathSvg.path. | Low 0.6 | |
| CVE-2026-93528 | NP Quote Request for WooCommerce < 2.4.16 - Unauthenticated Order Data Disclosure via Quote Request Page | Low 3.7 | |
| CVE-2026-93507 | WC Fields Factory < 4.1.11 - Contributor+ Arbitrary Post Cloning and Private Content Disclosure | Low 3.3 | |
| CVE-2026-91077 | Event Booking Manager for WooCommerce 5.3.6 - 5.7.2 - Contributor+ Unpublished Event Disclosure via mpwem_load_event_list | Low 2.7 | |
| CVE-2026-90951 | Paid Member Subscriptions < 3.1.0 - Unauthenticated In-Flight Checkout State Deletion via pms_process_payment | Low 3.7 | |
| CVE-2026-87074 | Forminator Forms < 1.57.2.1 - Unauthenticated Arbitrary Recipient Email Sending with Attacker-Controlled Link | Low 3.7 | |
| CVE-2026-87069 | Forminator Forms < 1.57.2.1 - Subscriber+ Form Stripe Field Migration via migrate_stripe | Low 3.1 | |
| CVE-2026-84743 | The Events Calendar 6.15.16.1 - 6.17.4.1 - Contributor+ Event/Venue/Organizer Update, Trash and Ownership Takeover via by-slug REST Routes | Low 3.8 | |
| CVE-2026-84742 | The Events Calendar 6.15.0 - 6.17.4.1 - Contributor+ Content Publication via TEC V1 REST API | Low 2.7 | |
| CVE-2026-18173 | IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities | Low 3.7 | |
| CVE-2026-76909 | Prior to 8.0.3, the change-request approval email template at src/mailtemplates/requested-cr-approval/requested-cr-approval.html.mustache renders the user-controlled… | Low 2.1 | |
| CVE-2026-62364 | Prior to 2.0.1, automatically discovered configuration from .weblate, .weblate.ini, or weblate.ini can select the API URL while an unscoped API token is supplied through… | Low 2.3 | |
| CVE-2026-77285 | OpenBao Agent Writes Secrets to Stdout | Low 2.4 | |
| CVE-2026-95818 | AT_SECURE program buffer overflow via $ORIGIN processing | Low 3.6 | |
| CVE-2026-86698 | Refresh tokens accepted as private repository credentials at the CDN | Low 2.3 | |
| CVE-2026-77637 | Cloudreve: Privilege Scope Bypass: State-Mutating Admin Operations Accessible via Read-Only OAuth Scope | Low 3.8 | |
| CVE-2026-92706 | Dark Reader: Ability to request icon-like bitmap data from certain local web servers | Low 3.4 | |
| CVE-2026-81883 | radare2: Out-of-bounds Read at the end of string in the LUA 5.3 bytecode | Low 3.3 | |
| CVE-2026-81884 | radare2: Heap out-of-bounds read in radare2 Mach-O LC_DATA_IN_CODE parser | Low 3.3 | |
| CVE-2026-92882 | Insufficiently protected credentials in the host and folder configuration endpoints of the REST API in Checkmk <2.5.0p15, <2.4.0p37, <2.3.0p51 and 2.2.0 (EOL) allows an authenticated user who may view a host's configuration to read stored… | Low 2.3 | |
| CVE-2026-49449 | Joplin: KaTeX trust:true enables URL-allowlist bypass leading to NTLMv2 credential theft via UNC path on Windows | Low 2.5 | |
| CVE-2026-85219 | Denial-of-Service in the OpenCanary Redis service | Low 3.7 | |
| CVE-2026-91165 | Warpgate: Markup injection in SSO form_post return page via unencoded redirect/error values | Low 2.4 | |
| CVE-2026-63416 | draw.io: Path traversal in ExportProxyServlet allows access to arbitrary backend endpoints | Low 3.7 | |
| CVE-2026-84298 | Hatchet: Cross-tenant durable callback payload disclosure in Hatchet V1 Dispatcher | Low 3.1 | |
| CVE-2026-77166 | The emoji field in the page emoji update endpoint does not properly validate user input. | Low 2.4 | |
| CVE-2026-55870 | Prior to 26.1.0, GoCD can return unmasked credentials that administrators stored in the userinfo portion of source control material URLs through several read-only APIs available to regular… | Low 2.3 | |
| CVE-2026-55060 | GoCD is vulnerable to authorization bypass via support process list API | Low 3.7 | |
| CVE-2026-85220 | A vulnerability in the Thinkst Canary honeypot Redis service allows an unauthenticated remote attacker to execute a Denial-of-Service attack against the honeypot. | Low 3.7 | |
| CVE-2026-94382 | Beszel before 0.19.0 contains an insecure direct object reference vulnerability in the POST and DELETE /api/beszel/user-alerts handlers that allows any authenticated user to create or delete alerts on systems they cannot access. | Low 2.3 | |
| CVE-2026-92612 | In Eclipse iceoryx2 versions greater than v0.8.0, the StaticString exposes its contents as mutable bytes through safe APIs, while String::as_str() converts those bytes into a Rust string slice without validating UTF-8. | Low 1.0 | |
| CVE-2026-86802 | To Do List Member 1.4 - 1.6 - Unauthenticated Content Injection via Import | Low 3.7 | |
| CVE-2026-94218 | Keycloak-services: keycloak-services: 2fa setup enforcement bypass via authentication session restart endpoint | Low 3.1 | |
| CVE-2026-94217 | Keycloak-services: keycloak-services: uma scope merge across resource owners via resource name collision | Low 3.5 | |
| CVE-2026-94030 | A security vulnerability has been detected in SerenityOS up to 3d83e4509fd20d7438e1ae8470ffe668c136229c. | Low 2.3 | |
| CVE-2026-92965 | TikTok 1.2.0 - 1.4.1 - Unauthenticated OAuth Code Redemption | Low 3.7 | |
| CVE-2026-92423 | Meow Gallery < 5.5.5 - Author+ Draft and Private Post Disclosure via fetch_posts | Low 2.7 | |
| CVE-2026-81654 | NextGEN Gallery < 4.5.0 - Authenticated Plugin Image Settings Update | Low 3.1 | |
| CVE-2026-81652 | NextGEN Gallery < 4.5.0 - Contributor+ Image Metadata Disclosure via IDOR | Low 2.7 | |
| CVE-2026-81651 | NextGEN Gallery < 4.5.0 - Authenticated Cross-Gallery Settings Modification via IDOR | Low 3.1 | |
| CVE-2026-86551 | Wi-Fi MAC Address Obtainment by Non-privileged Program Vulnerability in ZTE Z80Ultra (NX741J) product | Low 3.3 | |
| CVE-2026-93989 | vLLM through 0.29.0 fails to properly validate bad_words token indices against the model's generation output width in SamplingParams.update_from_tokenizer(). | Low 2.3 | |
| CVE-2026-93986 | rclone before 1.75.1 fails to confine names from server and third-party listing responses to the listed directory, allowing path traversal sequences in object names. | Low 2.3 | |
| CVE-2026-93981 | hono before 4.13.7 fails to HTML-escape plain strings rendered by hono/jsx as a child or fallback of Suspense, as a string child of ErrorBoundary alongside an asynchronous sibling, as the single child of a Context.Provider, or as the root… | Low 2.3 | |
| CVE-2026-92420 | Hydra Booking < 1.2.2 - Hydra Host+ Cross-Host Booking Deletion and Modification via IDOR | Low 3.8 | |
| CVE-2026-92403 | Secure Custom Fields < 6.9.4 - Unauthenticated Post Modification via Front-End Form ID Substitution | Low 3.7 | |
| CVE-2025-15698 | Business Name Generator <= 1.3 - Admin+ Stored XSS via Button Color Setting | Low 3.5 |
Showing 401–450 of 11,306. Narrow the filters to see the rest.
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status. Filter by severity and year here; the other filters work on the curated lists.