Vulnerability Intelligence · All CVEs
Every Published CVE, Searchable.
Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status.
Synced hourly · figures as of Oct 19, 2026
40,398 vulnerabilities · newest first
- CVE-2026-112296Critical 9.3FlyCms through commit edfdf724 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain super administrator access via the flycms account with password admin123.Published Oct 19, 2026
- CVE-2026-112292Critical 9.3CheckCle through 1.6.0 contains a missing authorization vulnerability that allows unauthenticated attackers to read, modify and delete records because shipped PocketBase collections use empty API rules.Published Oct 19, 2026
- CVE-2026-78162Critical 10.0Deserialization of Untrusted Data vulnerability in Apache Camel.Published Oct 19, 2026
- CVE-2026-111406Critical 9.9Unrestricted Upload of File with Dangerous Type vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Upload a Web Shell to a Web Server.This issue affects MapSVG: from n/a through 8.16.1.Published Oct 19, 2026
- CVE-2026-110887Critical 9.9Improper Control of Generation of Code ('Code Injection') vulnerability in HivePress HivePress hivepress allows Remote Code Inclusion.This issue affects HivePress: from n/a through 1.7.32.Published Oct 19, 2026
- CVE-2026-103091Critical 9.3Missing Authorization (CWE-862) and Initialization of a Resource with an Insecure Default (CWE-1188) in the MCP proxy (HandleStreamPassThrough in mcp_service.go) and OIDC registration flow (GET /info and POST /register in…Published Oct 19, 2026
- CVE-2026-102503Critical 9.3Missing Authentication for Critical Function (CWE-306) and Missing Authorization (CWE-862) in the /libp2p-http ingress server (StartIngressServer in cmd/sam-node/node.go) in Google OSS Agent Mesh (SAM) versions 0.1.0-alpha.1 through…Published Oct 19, 2026
- CVE-2026-108983Critical 9.8A vulnerability is in Web Server default connection ports under the process name GeoWebServer.exe .Published Oct 19, 2026
- CVE-2026-112005Critical 9.2WhoDB 0.104.0 before 0.135.0 contains a path traversal vulnerability that allows remote attackers to read and write arbitrary host files by running DuckDB filesystem functions through the query editor.Published Oct 18, 2026
- CVE-2026-111998Critical 9.3Vanus 0.8.0 through 0.9.0 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain cluster-admin access by using the hardcoded admin token.Published Oct 18, 2026
- CVE-2026-110886Critical 9.8Deserialization of Untrusted Data vulnerability in QuantumCloud Conversational Forms for ChatBot conversational-forms allows Object Injection.This issue affects Conversational Forms for ChatBot: from n/a through 1.5.1.Published Oct 18, 2026
- CVE-2026-110372Critical 9.8Incorrect Privilege Assignment vulnerability in Brainstorm Force OttoKit suretriggers allows Privilege Escalation.This issue affects OttoKit: from n/a through 1.1.40.Published Oct 18, 2026
- CVE-2026-109894Critical 9.3Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arraytics Booktics booktics allows SQL Injection.This issue affects Booktics: from n/a through 1.0.29.Published Oct 18, 2026
- CVE-2026-111911Critical 9.3phpMyFAQ 4.0.0 before 4.1.9 contains an authentication bypass vulnerability where WebAuthn registration endpoints attach credentials to any account without authentication or challenge validation.Published Oct 17, 2026
- CVE-2026-111823Critical 9.8Mage OSS through 0.9.80 before 76c4f46 can proceed with session creation upon encountering an unknown OAuth provider.Published Oct 16, 2026
- CVE-2026-96620Critical 9.2Prior to 0.2.121, the resume option is passed to the Claude CLI as a separate token without validation, so a dash-leading value is parsed as an independent CLI flag.Published Oct 16, 2026
- CVE-2026-102608Critical 9.0Prior to 1.38.3, downloadEvents() manually wraps a monitor Name value in single quotes instead of using escapeshellarg() before placing it in shell commands…Published Oct 16, 2026
- CVE-2026-111711Critical 9.3Netcore NR256CN through 1.5.140116 Pre-Auth Stack Overflow via Boa user_ok()Published Oct 16, 2026
- CVE-2026-111708Critical 9.3WhaTicket Community through commit cf04795 Admin Self-Registration via /auth/signupPublished Oct 16, 2026
- CVE-2026-111704Critical 9.3LangChat through commit 2a6285a Missing Authentication on REST API ControllersPublished Oct 16, 2026
- CVE-2026-111693Critical 9.3DataBuff ai-apm-web through 0.1.10 Hard-Coded Default Admin CredentialsPublished Oct 16, 2026
- CVE-2026-111692Critical 9.3DataBuff ai-apm-web through 0.1.10 Authentication Bypass via Hardcoded HMAC SecretPublished Oct 16, 2026
- CVE-2026-111691Critical 9.1WIMOOR through commit ec86736 Authentication Bypass via Forged X-USERINFO HeaderPublished Oct 16, 2026
- CVE-2026-111690Critical 9.3Simple Admin Core through 1.8.7 Hard-Coded JWT Secret Authentication BypassPublished Oct 16, 2026
- CVE-2026-111687Critical 9.3WeRSS (we-mp-rss) through 1.5.3 RCE via template Parameter in /rss EndpointPublished Oct 16, 2026
- CVE-2026-111675Critical 9.1Course-tencent-cloud through 2.0.1 Verification Code Brute Force Account TakeoverPublished Oct 16, 2026
- CVE-2026-111673Critical 9.3IceCMS through 4.1.5 Missing Authentication via /User Administrative EndpointsPublished Oct 16, 2026
- CVE-2026-111663Critical 9.2Chaskiq through 2.0.3 SSRF via createUrlUpload GraphQL MutationPublished Oct 16, 2026
- CVE-2026-111643Critical 9.3Misaka Danmu Server through 2.8.9 Authentication Bypass via Config-History RollbackPublished Oct 16, 2026
- CVE-2026-111641Critical 9.3FastapiAdmin through 3.0 Authentication Bypass via Auto-Login EndpointsPublished Oct 16, 2026
- CVE-2026-111636Critical 9.2OpenBMB StaffDeck through 0.5.6 Authentication Bypass via Hard-Coded Session SecretPublished Oct 16, 2026
- CVE-2026-111626Critical 9.3Webreaper Damselfly through 4.5.3 Missing Authentication on REST API ControllersPublished Oct 16, 2026
- CVE-2026-102551Critical 9.2Improper verification of the source of a communication channel in FreeRTOS-Plus-TCP Router Advertisement handlingPublished Oct 16, 2026
- CVE-2026-57169Critical 9.6Prior to 1.0.34, the in-browser container terminal endpoint /api/containers//exec does not enforce authentication on the WebSocket upgrade request.Published Oct 16, 2026
- CVE-2026-49868Critical 9.8Prior to 2026.07, _parse_reply() in sys/net/application_layer/dhcpv6/client.c omits minimum-length validation…Published Oct 16, 2026
- CVE-2026-102693Critical 9.6Prior to 2026.04, the ATWINC15x0 driver's _atwinc15x0_sta_set_current_ssid function uses strcpy to copy an SSID…Published Oct 16, 2026
- CVE-2026-102692Critical 9.1Prior to 2026.07, nanocoap accepts oversized CoAP Block2 option values without enforcing the 20-bit maximum block…Published Oct 16, 2026
- CVE-2026-109588Critical 9.3Numeric truncation in the MPU buffer authorization check in FreeRTOS-KernelPublished Oct 16, 2026
- CVE-2026-109587Critical 9.3Incorrect authorization in the Arm Cortex-R82 MPU port in FreeRTOS-KernelPublished Oct 16, 2026
- CVE-2026-44977Critical 9.0Prior to 24.05.50 and 25.03.44, plugins/star-rating/api/api.js allows a non-global application administrator to use uploadFeedbackFile to store…Published Oct 16, 2026
- CVE-2026-95182Critical 10.0An untrusted search path in DeepSeek Harness (dsh) commit c291e796 allows attackers to execute arbitrary code via supplying and opening crafted executable files in place of legitimate content.Published Oct 16, 2026
- CVE-2026-104736Critical 9.8LearnPress <= 4.4.10 - Unauthenticated PHP Object Injection via 'checkout-email' ParameterPublished Oct 16, 2026
- CVE-2026-105279Critical 9.3J4Care dcm4che Missing Authentication for Critical FunctionPublished Oct 16, 2026
- CVE-2026-110653Critical 9.1Appointment Booking Plugin <= 5.7.4 - Unauthenticated Authentication Bypass via Race Condition on OTP Attempts CounterPublished Oct 16, 2026
- CVE-2026-107617Critical 9.3An attacker can use a hard-coded credential to log in to EseeCloud devices.Published Oct 16, 2026
- CVE-2026-18516Critical 9.6Improper Encoding or Escaping of Output in Crafty ControllerPublished Oct 16, 2026
- CVE-2026-111391Critical 9.2SGLang 0.5.10 through 0.5.22 Code Injection via Debug Dumper FilterPublished Oct 16, 2026
- CVE-2026-111472Critical 9.3SQL injection in TSG ProfleetPublished Oct 16, 2026
- CVE-2026-94169Critical 10.0WordPress The Grid plugin <= 2.8.1 - Remote Code Execution (RCE) vulnerabilityPublished Oct 16, 2026
- CVE-2026-94388Critical 9.3WordPress Green Popups plugin < 7.6.3 - SQL Injection vulnerabilityPublished Oct 16, 2026
| CVE | Title | Severity | Published |
|---|---|---|---|
| CVE-2026-112296 | FlyCms through commit edfdf724 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain super administrator access via the flycms account with password admin123. | Critical 9.3 | |
| CVE-2026-112292 | CheckCle through 1.6.0 contains a missing authorization vulnerability that allows unauthenticated attackers to read, modify and delete records because shipped PocketBase collections use empty API rules. | Critical 9.3 | |
| CVE-2026-78162 | Deserialization of Untrusted Data vulnerability in Apache Camel. | Critical 10.0 | |
| CVE-2026-111406 | Unrestricted Upload of File with Dangerous Type vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Upload a Web Shell to a Web Server.This issue affects MapSVG: from n/a through 8.16.1. | Critical 9.9 | |
| CVE-2026-110887 | Improper Control of Generation of Code ('Code Injection') vulnerability in HivePress HivePress hivepress allows Remote Code Inclusion.This issue affects HivePress: from n/a through 1.7.32. | Critical 9.9 | |
| CVE-2026-103091 | Missing Authorization (CWE-862) and Initialization of a Resource with an Insecure Default (CWE-1188) in the MCP proxy (HandleStreamPassThrough in mcp_service.go) and OIDC registration flow (GET /info and POST /register in… | Critical 9.3 | |
| CVE-2026-102503 | Missing Authentication for Critical Function (CWE-306) and Missing Authorization (CWE-862) in the /libp2p-http ingress server (StartIngressServer in cmd/sam-node/node.go) in Google OSS Agent Mesh (SAM) versions 0.1.0-alpha.1 through… | Critical 9.3 | |
| CVE-2026-108983 | A vulnerability is in Web Server default connection ports under the process name GeoWebServer.exe . | Critical 9.8 | |
| CVE-2026-112005 | WhoDB 0.104.0 before 0.135.0 contains a path traversal vulnerability that allows remote attackers to read and write arbitrary host files by running DuckDB filesystem functions through the query editor. | Critical 9.2 | |
| CVE-2026-111998 | Vanus 0.8.0 through 0.9.0 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain cluster-admin access by using the hardcoded admin token. | Critical 9.3 | |
| CVE-2026-110886 | Deserialization of Untrusted Data vulnerability in QuantumCloud Conversational Forms for ChatBot conversational-forms allows Object Injection.This issue affects Conversational Forms for ChatBot: from n/a through 1.5.1. | Critical 9.8 | |
| CVE-2026-110372 | Incorrect Privilege Assignment vulnerability in Brainstorm Force OttoKit suretriggers allows Privilege Escalation.This issue affects OttoKit: from n/a through 1.1.40. | Critical 9.8 | |
| CVE-2026-109894 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arraytics Booktics booktics allows SQL Injection.This issue affects Booktics: from n/a through 1.0.29. | Critical 9.3 | |
| CVE-2026-111911 | phpMyFAQ 4.0.0 before 4.1.9 contains an authentication bypass vulnerability where WebAuthn registration endpoints attach credentials to any account without authentication or challenge validation. | Critical 9.3 | |
| CVE-2026-111823 | Mage OSS through 0.9.80 before 76c4f46 can proceed with session creation upon encountering an unknown OAuth provider. | Critical 9.8 | |
| CVE-2026-96620 | Prior to 0.2.121, the resume option is passed to the Claude CLI as a separate token without validation, so a dash-leading value is parsed as an independent CLI flag. | Critical 9.2 | |
| CVE-2026-102608 | Prior to 1.38.3, downloadEvents() manually wraps a monitor Name value in single quotes instead of using escapeshellarg() before placing it in shell commands… | Critical 9.0 | |
| CVE-2026-111711 | Netcore NR256CN through 1.5.140116 Pre-Auth Stack Overflow via Boa user_ok() | Critical 9.3 | |
| CVE-2026-111708 | WhaTicket Community through commit cf04795 Admin Self-Registration via /auth/signup | Critical 9.3 | |
| CVE-2026-111704 | LangChat through commit 2a6285a Missing Authentication on REST API Controllers | Critical 9.3 | |
| CVE-2026-111693 | DataBuff ai-apm-web through 0.1.10 Hard-Coded Default Admin Credentials | Critical 9.3 | |
| CVE-2026-111692 | DataBuff ai-apm-web through 0.1.10 Authentication Bypass via Hardcoded HMAC Secret | Critical 9.3 | |
| CVE-2026-111691 | WIMOOR through commit ec86736 Authentication Bypass via Forged X-USERINFO Header | Critical 9.1 | |
| CVE-2026-111690 | Simple Admin Core through 1.8.7 Hard-Coded JWT Secret Authentication Bypass | Critical 9.3 | |
| CVE-2026-111687 | WeRSS (we-mp-rss) through 1.5.3 RCE via template Parameter in /rss Endpoint | Critical 9.3 | |
| CVE-2026-111675 | Course-tencent-cloud through 2.0.1 Verification Code Brute Force Account Takeover | Critical 9.1 | |
| CVE-2026-111673 | IceCMS through 4.1.5 Missing Authentication via /User Administrative Endpoints | Critical 9.3 | |
| CVE-2026-111663 | Chaskiq through 2.0.3 SSRF via createUrlUpload GraphQL Mutation | Critical 9.2 | |
| CVE-2026-111643 | Misaka Danmu Server through 2.8.9 Authentication Bypass via Config-History Rollback | Critical 9.3 | |
| CVE-2026-111641 | FastapiAdmin through 3.0 Authentication Bypass via Auto-Login Endpoints | Critical 9.3 | |
| CVE-2026-111636 | OpenBMB StaffDeck through 0.5.6 Authentication Bypass via Hard-Coded Session Secret | Critical 9.2 | |
| CVE-2026-111626 | Webreaper Damselfly through 4.5.3 Missing Authentication on REST API Controllers | Critical 9.3 | |
| CVE-2026-102551 | Improper verification of the source of a communication channel in FreeRTOS-Plus-TCP Router Advertisement handling | Critical 9.2 | |
| CVE-2026-57169 | Prior to 1.0.34, the in-browser container terminal endpoint /api/containers//exec does not enforce authentication on the WebSocket upgrade request. | Critical 9.6 | |
| CVE-2026-49868 | Prior to 2026.07, _parse_reply() in sys/net/application_layer/dhcpv6/client.c omits minimum-length validation… | Critical 9.8 | |
| CVE-2026-102693 | Prior to 2026.04, the ATWINC15x0 driver's _atwinc15x0_sta_set_current_ssid function uses strcpy to copy an SSID… | Critical 9.6 | |
| CVE-2026-102692 | Prior to 2026.07, nanocoap accepts oversized CoAP Block2 option values without enforcing the 20-bit maximum block… | Critical 9.1 | |
| CVE-2026-109588 | Numeric truncation in the MPU buffer authorization check in FreeRTOS-Kernel | Critical 9.3 | |
| CVE-2026-109587 | Incorrect authorization in the Arm Cortex-R82 MPU port in FreeRTOS-Kernel | Critical 9.3 | |
| CVE-2026-44977 | Prior to 24.05.50 and 25.03.44, plugins/star-rating/api/api.js allows a non-global application administrator to use uploadFeedbackFile to store… | Critical 9.0 | |
| CVE-2026-95182 | An untrusted search path in DeepSeek Harness (dsh) commit c291e796 allows attackers to execute arbitrary code via supplying and opening crafted executable files in place of legitimate content. | Critical 10.0 | |
| CVE-2026-104736 | LearnPress <= 4.4.10 - Unauthenticated PHP Object Injection via 'checkout-email' Parameter | Critical 9.8 | |
| CVE-2026-105279 | J4Care dcm4che Missing Authentication for Critical Function | Critical 9.3 | |
| CVE-2026-110653 | Appointment Booking Plugin <= 5.7.4 - Unauthenticated Authentication Bypass via Race Condition on OTP Attempts Counter | Critical 9.1 | |
| CVE-2026-107617 | An attacker can use a hard-coded credential to log in to EseeCloud devices. | Critical 9.3 | |
| CVE-2026-18516 | Improper Encoding or Escaping of Output in Crafty Controller | Critical 9.6 | |
| CVE-2026-111391 | SGLang 0.5.10 through 0.5.22 Code Injection via Debug Dumper Filter | Critical 9.2 | |
| CVE-2026-111472 | SQL injection in TSG Profleet | Critical 9.3 | |
| CVE-2026-94169 | WordPress The Grid plugin <= 2.8.1 - Remote Code Execution (RCE) vulnerability | Critical 10.0 | |
| CVE-2026-94388 | WordPress Green Popups plugin < 7.6.3 - SQL Injection vulnerability | Critical 9.3 |
Showing 1–50 of 40,398. Narrow the filters to see the rest.
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status. Filter by severity and year here; the other filters work on the curated lists.