Vulnerability Intelligence · All CVEs
Every Published CVE, Searchable.
Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status.
Synced hourly · figures as of Oct 19, 2026
138,422 vulnerabilities · newest first
- CVE-2026-96425Medium 5.5Incorrect DBus policy for lomiri-download-manager allows arbitrary user to run arbitrary command as root over DBusPublished Oct 16, 2026
- CVE-2026-68908Medium 5.3Prior to 1.6.2, Reporting_RCBWriteAccessHandler accepts an RptID longer than 129 bytes in the…Published Oct 16, 2026
- CVE-2026-57447Medium 4.3Prior to the verified source fix, the doc category index refresh resolves linked titles for private messages or restricted category topics without…Published Oct 16, 2026
- CVE-2026-57446Medium 5.3From 1.6.1 until 1.6.2, a successful MMS ObtainFile operation closes MmsObtainFileTask::fileHandle…Published Oct 16, 2026
- CVE-2026-55862Medium 6.5Prior to 2.0.0, multiple ixml DOM traversal functions process deeply nested XML with unbounded recursion.Published Oct 16, 2026
- CVE-2026-55836Medium 6.8From 1.13.0 until 1.27.2, 1.28.2, and 1.29.0, _import_document_row in src/openzaak/components/documenten/tasks.py uses the attacker-controlled…Published Oct 16, 2026
- CVE-2026-54657Medium 6.5From 1.0.0 until 1.27.2, 1.28.2, and 1.29.0, the POST search endpoints /zaken/api/v1/zaken/_zoek and…Published Oct 16, 2026
- CVE-2026-46471Medium 5.5While parsing an MP4 file, the isomp4 plugin's qtdemux_parse_uuid function may read past the end of a heap-allocated buffer, allowing an attacker to disclose heap memory…Published Oct 16, 2026
- CVE-2026-102923Medium 5.4Prior to 1.6.0, SparkyFitnessServer/services/chatService.ts and SparkyFitnessServer/services/labelScanService.ts do not validate destinations supplied in…Published Oct 16, 2026
- CVE-2026-111728Medium 5.3Seanime v3.7.0 to v3.10.3 contains an argument injection vulnerability reachable through improper authorization, allowing unauthenticated LAN or Tailnet clients to bypass the privileged mediastream settings guard by setting…Published Oct 16, 2026
- CVE-2026-92715Medium 4.3Tutor LMS <= 4.1.0 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Course Modification and Ownership Takeover via 'ID' ParameterPublished Oct 16, 2026
- CVE-2026-109985Medium 6.4xSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDN <= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'post_content' ParameterPublished Oct 16, 2026
- CVE-2026-110268Medium 4.9Post Export Import with Media <= 1.17.2 - Authenticated (Administrator+) Path Traversal via 'theme_slug' ParameterPublished Oct 16, 2026
- CVE-2026-92978Medium 4.3User Registration & Membership <= 5.2.8 - Cross-Site Request Forgery to trigger_bulk_action()Published Oct 16, 2026
- CVE-2026-109369Medium 6.8WP Booking System <= 2.1.0.3 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via 'user_permission' Parameter via Cross-Form Nonce ReusePublished Oct 16, 2026
- CVE-2026-109368Medium 6.5WP Booking System <= 2.1.0.3 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via wpbs_refresh_calendar_editor AJAX actionPublished Oct 16, 2026
- CVE-2026-109989Medium 6.4Themify Popup <= 1.4.7 - Authenticated (Author+) Stored Cross-Site Scripting via 'popup_width_unit' ParameterPublished Oct 16, 2026
- CVE-2026-111726Medium 6.4Themify Builder <= 7.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'visible' Shortcode AttributePublished Oct 16, 2026
- CVE-2026-107752Medium 4.9Welcart e-Commerce <= 2.12.4 - Authenticated (Editor+) SQL Injection via 'wp_usces_order_old' CookiePublished Oct 16, 2026
- CVE-2026-107744Medium 6.5LearnPress <= 4.4.10 - Missing Authorization to Authenticated (Subscriber+) Email Address Enumeration via 'search-authors' AJAX ActionPublished Oct 16, 2026
- CVE-2026-111601Medium 6.1Hippoo Mobile App for WooCommerce <= 1.12.0 - Reflected Cross-Site Scripting via 'token_id' ParameterPublished Oct 16, 2026
- CVE-2026-97858Medium 6.9An attacker can cause the server to unbind the target device from its current owner and rebind it to the requesting account, regardless of whether the device is currently bound to a different account, allowing an attacker to obtain the…Published Oct 16, 2026
- CVE-2026-105664Medium 6.9The endpoint exposes an observable response discrepancy when processing ID values.Published Oct 16, 2026
- CVE-2026-110804Medium 4.3Improperly controlled modification of JIT elevation settings in PAM checkout in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with PAM checkout access to delete arbitrary Active Directory groups or retain elevated…Published Oct 16, 2026
- CVE-2026-110806Medium 6.5Incorrect authorization in add-on properties in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with only View permission to obtain add-on passwords via the unredacted add-on properties returned in connection data.Published Oct 16, 2026
- CVE-2026-110287Medium 4.3Improper access control in asset contact password in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with general Edit but without Edit asset permission to modify the asset contact password via a crafted direct…Published Oct 16, 2026
- CVE-2026-90821Medium 5.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Crafty ControllerPublished Oct 16, 2026
- CVE-2026-97470Medium 6.4Tourfic <= 3.0.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Comment Content via unfiltered_html Grant to Customer RolePublished Oct 16, 2026
- CVE-2026-110896Medium 5.3WordPress Passster plugin <= 4.3.18 - Broken Access Control vulnerabilityPublished Oct 16, 2026
- CVE-2026-111400Medium 6.5WordPress PowerPack Addons for Elementor plugin <= 3.1.0 - Cross Site Scripting (XSS) vulnerabilityPublished Oct 16, 2026
- CVE-2026-111409Medium 5.3WordPress YITH PayPal Express Checkout for WooCommerce plugin <= 1.61.0 - Broken Access Control vulnerabilityPublished Oct 16, 2026
- CVE-2026-110903Medium 6.5WordPress The Events Calendar plugin <= 6.18.1 - Cross Site Scripting (XSS) vulnerabilityPublished Oct 16, 2026
- CVE-2026-110900Medium 5.3WordPress BookIt plugin <= 2.6.0.5 - Broken Access Control vulnerabilityPublished Oct 16, 2026
- CVE-2026-110901Medium 5.4WordPress SmartCrawl plugin <= 3.16.4 - Insecure Direct Object References (IDOR) vulnerabilityPublished Oct 16, 2026
- CVE-2026-110380Medium 5.3WordPress WP Event Solution plugin <= 4.1.26 - Broken Access Control vulnerabilityPublished Oct 16, 2026
- CVE-2026-111405Medium 6.5WordPress MapSVG plugin <= 8.16.1 - Cross Site Scripting (XSS) vulnerabilityPublished Oct 16, 2026
- CVE-2026-111397Medium 5.3WordPress MapSVG plugin <= 8.16.1 - Sensitive Data Exposure vulnerabilityPublished Oct 16, 2026
- CVE-2026-111555Medium 6.0Luksmeta: missing slot-range validation permits out-of-gap device i/oPublished Oct 16, 2026
- CVE-2026-111390Medium 6.0Erupt through 2.3.0 HQL Injection via linkTreeVal in Data Table APIPublished Oct 16, 2026
- CVE-2026-110029Medium 5.4Squeeze < 1.8.1 - Subscriber+ Missing Authorization via squeeze_restore_attachmentPublished Oct 16, 2026
- CVE-2026-109930Medium 5.3MAIO < 7.3.22 - Unauthenticated Crawl Analytics Disclosure via Hardcoded API KeyPublished Oct 16, 2026
- CVE-2026-109118Medium 4.6Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in rdiffwebPublished Oct 16, 2026
- CVE-2026-106030Medium 6.8Missing Authorization in NordVPN for WindowsPublished Oct 16, 2026
- CVE-2026-107649Medium 5.4Events Made Easy <= 3.2.22 - Unauthenticated Stored Cross-Site Scripting via 'event[location_name]' ParameterPublished Oct 16, 2026
- CVE-2026-110703Medium 6.4GeoDirectory <= 2.8.191 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_content' Parameter via data-embed-url AttributePublished Oct 16, 2026
- CVE-2026-15575Medium 5.3Sensitive Information Disclosure Due to Enabled Debug Mode in Production in SFM Software's CostifierPublished Oct 16, 2026
- CVE-2026-15219Medium 6.5IDOR in SFM Software's CostifierPublished Oct 16, 2026
- CVE-2026-104003Medium 5.4Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.5 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Comment Content Rendered on ProfilePress User Profile 'Comments'…Published Oct 16, 2026
- CVE-2026-104726Medium 6.4Name Directory <= 1.34.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'dir' Shortcode AttributePublished Oct 16, 2026
- CVE-2026-93681Medium 6.4Tutor LMS <= 4.1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via display_name ParameterPublished Oct 16, 2026
| CVE | Title | Severity | Published |
|---|---|---|---|
| CVE-2026-96425 | Incorrect DBus policy for lomiri-download-manager allows arbitrary user to run arbitrary command as root over DBus | Medium 5.5 | |
| CVE-2026-68908 | Prior to 1.6.2, Reporting_RCBWriteAccessHandler accepts an RptID longer than 129 bytes in the… | Medium 5.3 | |
| CVE-2026-57447 | Prior to the verified source fix, the doc category index refresh resolves linked titles for private messages or restricted category topics without… | Medium 4.3 | |
| CVE-2026-57446 | From 1.6.1 until 1.6.2, a successful MMS ObtainFile operation closes MmsObtainFileTask::fileHandle… | Medium 5.3 | |
| CVE-2026-55862 | Prior to 2.0.0, multiple ixml DOM traversal functions process deeply nested XML with unbounded recursion. | Medium 6.5 | |
| CVE-2026-55836 | From 1.13.0 until 1.27.2, 1.28.2, and 1.29.0, _import_document_row in src/openzaak/components/documenten/tasks.py uses the attacker-controlled… | Medium 6.8 | |
| CVE-2026-54657 | From 1.0.0 until 1.27.2, 1.28.2, and 1.29.0, the POST search endpoints /zaken/api/v1/zaken/_zoek and… | Medium 6.5 | |
| CVE-2026-46471 | While parsing an MP4 file, the isomp4 plugin's qtdemux_parse_uuid function may read past the end of a heap-allocated buffer, allowing an attacker to disclose heap memory… | Medium 5.5 | |
| CVE-2026-102923 | Prior to 1.6.0, SparkyFitnessServer/services/chatService.ts and SparkyFitnessServer/services/labelScanService.ts do not validate destinations supplied in… | Medium 5.4 | |
| CVE-2026-111728 | Seanime v3.7.0 to v3.10.3 contains an argument injection vulnerability reachable through improper authorization, allowing unauthenticated LAN or Tailnet clients to bypass the privileged mediastream settings guard by setting… | Medium 5.3 | |
| CVE-2026-92715 | Tutor LMS <= 4.1.0 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Course Modification and Ownership Takeover via 'ID' Parameter | Medium 4.3 | |
| CVE-2026-109985 | xSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDN <= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'post_content' Parameter | Medium 6.4 | |
| CVE-2026-110268 | Post Export Import with Media <= 1.17.2 - Authenticated (Administrator+) Path Traversal via 'theme_slug' Parameter | Medium 4.9 | |
| CVE-2026-92978 | User Registration & Membership <= 5.2.8 - Cross-Site Request Forgery to trigger_bulk_action() | Medium 4.3 | |
| CVE-2026-109369 | WP Booking System <= 2.1.0.3 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via 'user_permission' Parameter via Cross-Form Nonce Reuse | Medium 6.8 | |
| CVE-2026-109368 | WP Booking System <= 2.1.0.3 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via wpbs_refresh_calendar_editor AJAX action | Medium 6.5 | |
| CVE-2026-109989 | Themify Popup <= 1.4.7 - Authenticated (Author+) Stored Cross-Site Scripting via 'popup_width_unit' Parameter | Medium 6.4 | |
| CVE-2026-111726 | Themify Builder <= 7.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'visible' Shortcode Attribute | Medium 6.4 | |
| CVE-2026-107752 | Welcart e-Commerce <= 2.12.4 - Authenticated (Editor+) SQL Injection via 'wp_usces_order_old' Cookie | Medium 4.9 | |
| CVE-2026-107744 | LearnPress <= 4.4.10 - Missing Authorization to Authenticated (Subscriber+) Email Address Enumeration via 'search-authors' AJAX Action | Medium 6.5 | |
| CVE-2026-111601 | Hippoo Mobile App for WooCommerce <= 1.12.0 - Reflected Cross-Site Scripting via 'token_id' Parameter | Medium 6.1 | |
| CVE-2026-97858 | An attacker can cause the server to unbind the target device from its current owner and rebind it to the requesting account, regardless of whether the device is currently bound to a different account, allowing an attacker to obtain the… | Medium 6.9 | |
| CVE-2026-105664 | The endpoint exposes an observable response discrepancy when processing ID values. | Medium 6.9 | |
| CVE-2026-110804 | Improperly controlled modification of JIT elevation settings in PAM checkout in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with PAM checkout access to delete arbitrary Active Directory groups or retain elevated… | Medium 4.3 | |
| CVE-2026-110806 | Incorrect authorization in add-on properties in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with only View permission to obtain add-on passwords via the unredacted add-on properties returned in connection data. | Medium 6.5 | |
| CVE-2026-110287 | Improper access control in asset contact password in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with general Edit but without Edit asset permission to modify the asset contact password via a crafted direct… | Medium 4.3 | |
| CVE-2026-90821 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Crafty Controller | Medium 5.4 | |
| CVE-2026-97470 | Tourfic <= 3.0.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Comment Content via unfiltered_html Grant to Customer Role | Medium 6.4 | |
| CVE-2026-110896 | WordPress Passster plugin <= 4.3.18 - Broken Access Control vulnerability | Medium 5.3 | |
| CVE-2026-111400 | WordPress PowerPack Addons for Elementor plugin <= 3.1.0 - Cross Site Scripting (XSS) vulnerability | Medium 6.5 | |
| CVE-2026-111409 | WordPress YITH PayPal Express Checkout for WooCommerce plugin <= 1.61.0 - Broken Access Control vulnerability | Medium 5.3 | |
| CVE-2026-110903 | WordPress The Events Calendar plugin <= 6.18.1 - Cross Site Scripting (XSS) vulnerability | Medium 6.5 | |
| CVE-2026-110900 | WordPress BookIt plugin <= 2.6.0.5 - Broken Access Control vulnerability | Medium 5.3 | |
| CVE-2026-110901 | WordPress SmartCrawl plugin <= 3.16.4 - Insecure Direct Object References (IDOR) vulnerability | Medium 5.4 | |
| CVE-2026-110380 | WordPress WP Event Solution plugin <= 4.1.26 - Broken Access Control vulnerability | Medium 5.3 | |
| CVE-2026-111405 | WordPress MapSVG plugin <= 8.16.1 - Cross Site Scripting (XSS) vulnerability | Medium 6.5 | |
| CVE-2026-111397 | WordPress MapSVG plugin <= 8.16.1 - Sensitive Data Exposure vulnerability | Medium 5.3 | |
| CVE-2026-111555 | Luksmeta: missing slot-range validation permits out-of-gap device i/o | Medium 6.0 | |
| CVE-2026-111390 | Erupt through 2.3.0 HQL Injection via linkTreeVal in Data Table API | Medium 6.0 | |
| CVE-2026-110029 | Squeeze < 1.8.1 - Subscriber+ Missing Authorization via squeeze_restore_attachment | Medium 5.4 | |
| CVE-2026-109930 | MAIO < 7.3.22 - Unauthenticated Crawl Analytics Disclosure via Hardcoded API Key | Medium 5.3 | |
| CVE-2026-109118 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in rdiffweb | Medium 4.6 | |
| CVE-2026-106030 | Missing Authorization in NordVPN for Windows | Medium 6.8 | |
| CVE-2026-107649 | Events Made Easy <= 3.2.22 - Unauthenticated Stored Cross-Site Scripting via 'event[location_name]' Parameter | Medium 5.4 | |
| CVE-2026-110703 | GeoDirectory <= 2.8.191 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_content' Parameter via data-embed-url Attribute | Medium 6.4 | |
| CVE-2026-15575 | Sensitive Information Disclosure Due to Enabled Debug Mode in Production in SFM Software's Costifier | Medium 5.3 | |
| CVE-2026-15219 | IDOR in SFM Software's Costifier | Medium 6.5 | |
| CVE-2026-104003 | Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.5 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Comment Content Rendered on ProfilePress User Profile 'Comments'… | Medium 5.4 | |
| CVE-2026-104726 | Name Directory <= 1.34.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'dir' Shortcode Attribute | Medium 6.4 | |
| CVE-2026-93681 | Tutor LMS <= 4.1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via display_name Parameter | Medium 6.4 |
Showing 401–450 of 138,422. Narrow the filters to see the rest.
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status. Filter by severity and year here; the other filters work on the curated lists.