Vulnerability Intelligence · All CVEs
Every Published CVE, Searchable.
Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status.
Synced hourly · figures as of Oct 19, 2026
126,300 vulnerabilities · newest first
- CVE-2026-8168High 7.1Uncontrolled recursion in the SVG parser and renderer of the Qt SVG module (QtSvg) in Qt Group Qt allows attackers to cause a denial of service (application crash via stack exhaustion) via a crafted SVG file with deeply nested elements.Published Oct 19, 2026
- CVE-2026-112287High 7.1Krayin CRM before 2.2.7 contains a broken object level authorization vulnerability in EmailController write actions that allows scope-restricted authenticated users to manipulate other users' emails by supplying their numeric IDs.Published Oct 19, 2026
- CVE-2026-112286High 7.1Krayin CRM before 2.2.7 contains an insecure direct object reference vulnerability that allows scope-restricted authenticated users to read other users' quotes by bypassing per-user data scope checks in QuoteController.Published Oct 19, 2026
- CVE-2026-112279High 7.1rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in process_bmpcache2() in orders.c that allows malicious RDP servers to crash clients via crafted revision-2 bitmap cache orders.Published Oct 19, 2026
- CVE-2026-112278High 7.1rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in process_raw_bmpcache() in orders.c that allows malicious RDP servers to crash clients.Published Oct 19, 2026
- CVE-2026-112277High 7.1rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in process_plane() in bitmap.c that allows malicious RDP servers to crash clients by sending malformed 32 bpp compressed bitmaps.Published Oct 19, 2026
- CVE-2026-112270High 7.1SGLang through 0.5.22 with the Mooncake disaggregation backend contains an uncontrolled memory allocation vulnerability in handle_staging_rsp() that lets unauthenticated network-adjacent attackers exhaust Prefill memory.Published Oct 19, 2026
- CVE-2026-112269High 7.1SGLang through 0.5.22 with the Mooncake disaggregation backend accepts unauthenticated decode registration messages on the Prefill rank ZMQ PULL socket, allowing denial of service.Published Oct 19, 2026
- CVE-2026-112266High 8.2SGLang through 0.5.22 contains a denial of service vulnerability that allows API clients to abort other users' in-flight generation requests by supplying a short client-controlled rid.Published Oct 19, 2026
- CVE-2026-112265High 8.3LangBot through 4.11.0 contains a missing authenticity verification vulnerability that allows unauthenticated attackers to inject forged Lark/Feishu events by skipping signature checks.Published Oct 19, 2026
- CVE-2026-112264High 8.5BentoML through 1.4.39 contains a Dockerfile instruction injection vulnerability that allows attackers to add arbitrary build instructions by embedding newlines in docker.env mapping keys rendered by the legacy base.j2 template.Published Oct 19, 2026
- CVE-2026-112263High 8.5Television (tv) 0.15.0 through 0.15.9 contains an OS command injection vulnerability that allows attackers to run shell commands through improperly escaped single quotes in format_command.Published Oct 19, 2026
- CVE-2026-112262High 7.1RisingWave before 3.1.0 contains a missing authorization vulnerability that allows low-privileged SQL users to read and write arbitrary server files by creating posix_fs sources and fs sinks.Published Oct 19, 2026
- CVE-2026-111915High 8.2Yank Note before 3.93.1 contains a path traversal vulnerability that allows unauthenticated remote attackers to read arbitrary files via the path or doc parameter of /api/help.Published Oct 19, 2026
- CVE-2026-103314High 7.4The Central SAML authentication ACS endpoint does not retain used SAML assertion or response identifiers to prevent replay.Published Oct 19, 2026
- CVE-2026-88900High 8.8Deserialization of Untrusted Data vulnerability in Apache Camel Camel-Jgroups component.Published Oct 19, 2026
- CVE-2026-88901High 8.2Improper Restriction of XML External Entity Reference vulnerability in Apache Camel.Published Oct 19, 2026
- CVE-2026-85251High 7.5Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel HTTP component.Published Oct 19, 2026
- CVE-2026-85250High 7.5Improper Restriction of XML External Entity Reference vulnerability in Apache Camel XPath component.Published Oct 19, 2026
- CVE-2026-83531High 8.8Improper Control of Generation of Code ('Code Injection'), Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') vulnerability in Apache Camel.Published Oct 19, 2026
- CVE-2026-80344High 8.2Server-Side Request Forgery (SSRF) vulnerability in Apache Camel AS2 component.Published Oct 19, 2026
- CVE-2026-80343High 8.2Improper Handling of Case Sensitivity vulnerability in Apache Camel Netty HTTP component.Published Oct 19, 2026
- CVE-2026-80312High 8.2Improper Authentication vulnerability in Apache Camel OAuth component.Published Oct 19, 2026
- CVE-2026-79986High 7.4Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel Azure Files component.Published Oct 19, 2026
- CVE-2026-79985High 7.4Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel SMB component.Published Oct 19, 2026
- CVE-2026-79984High 7.4Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel Mina SFTP component.Published Oct 19, 2026
- CVE-2026-79983High 7.4Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel FTP component.Published Oct 19, 2026
- CVE-2026-78165High 8.8Deserialization of Untrusted Data vulnerability in Apache Camel Spring Redis component.Published Oct 19, 2026
- CVE-2026-78164High 8.2Improper Neutralization of Special Elements Used in a Template Engine and Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel HTTP, Netty HTTP, Undertow and Vert.x HTTP components.Published Oct 19, 2026
- CVE-2026-112188High 7.1MISP contains a vulnerability in its server settings lookup mechanism that allows an authenticated user to retrieve sensitive configuration data that should have been redacted.Published Oct 19, 2026
- CVE-2026-111408High 8.8Deserialization of Untrusted Data vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Object Injection.This issue affects Quiz And Survey Master: from n/a through 11.2.7.Published Oct 19, 2026
- CVE-2026-111398High 7.7Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Path Traversal.This issue affects MapSVG: from n/a through…Published Oct 19, 2026
- CVE-2026-110379High 7.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro Quiz Maker quiz-maker allows Reflected XSS.This issue affects Quiz Maker: from n/a through 6.7.1.91.Published Oct 19, 2026
- CVE-2026-13695High 8.8SQL injection (SQLi) vulnerability—specifically a UNION-based vulnerability—in the Integratec application that affects the sInfo parameter sent via POST to the endpoint /login/ap_Login.aspx/start.Published Oct 19, 2026
- CVE-2026-112178High 7.1MISP contains an access control flaw in the proposal (shadow attribute) visibility logic.Published Oct 19, 2026
- CVE-2026-112161High 8.5MobaXterm Personal Edition (Portable) 26.4 GA extracts the CygUtils64.plugin file without first verifying its integrity.Published Oct 19, 2026
- CVE-2026-76740High 7.2A security vulnerability in HPE Compute Scale-up Server 3200 and 3250 platforms, Superdome Flex and Superdome Flex 280 servers could be exploited remotely to execute arbitrary commands on the RMC.Published Oct 19, 2026
- CVE-2026-16460High 7.4Already-staged deployments are finalized without revalidating the deployment's container image against the current containers signature policy.Published Oct 19, 2026
- CVE-2026-16487High 8.1Automatic or manual upgrades of a mutable image tag may apply unsigned content for registries that fall through to insecureAcceptAnything, allowing an…Published Oct 19, 2026
- CVE-2026-112082High 8.7This impacts the function Scheduler.expert_distribution_handle of the file python/sglang/srt/eplb/expert_distribution.py of the component Expert-Distribution Recording…Published Oct 19, 2026
- CVE-2026-108120High 7.7Brian Mariani from DigitalCanion SA has discovered a path traversal vulnerability in the View Logs functionality of koozali's SME Server version 11.0rc1-215 allowing an unauthenticated attacker to access files outside of the intended…Published Oct 19, 2026
- CVE-2026-111440High 7.0在 openGauss-connector-jdbc 的 pgjdbc/src/main/java/org/postgresql/log/LogFactory.java 中，LogFactory 根据 JDBC 连接参数中的 logger 类名调用 Class.forName 加载类后，直接反射调用以 String 为参数的构造函数，再转换为 Log。缺少 asSubclass(Log.class) 校验，非 Log 实现类也会在类型检查前被实例化。因此，当攻击者可控制…Published Oct 19, 2026
- CVE-2026-111441High 8.1在 openGauss-server 的 src/gausskernel/cbb/utils/hll/hll.cpp 中，内置函数 HllObjectUnpack() 存在长度校验缺陷。该函数从用户提供的 packed HLL 解析 lenUsed 与 lenTotal 后，仅检查输入长度足以覆盖 HLL_HEAD_SIZE + lenUsed，随后按 lenTotal 分配缓冲区、按 lenUsed 调用 memcpy_s() 拷贝输入，既未校验 lenTotal >=…Published Oct 19, 2026
- CVE-2026-108984High 7.5A vulnerability is in Web Server default connection ports under the process name GeoWebServer.exe .Published Oct 19, 2026
- CVE-2026-112051High 8.3Xinference through 4.0.1 contains a path traversal vulnerability on Windows that allows unauthenticated attackers to write and delete arbitrary .json files via backslash sequences in model_name.Published Oct 18, 2026
- CVE-2026-112021High 8.7snac2 before 2.93 contains a heap-based buffer overflow vulnerability in _xs_json_load_lexer() that allows unauthenticated remote attackers to corrupt heap memory by sending JSON strings containing a \u0000 escape.Published Oct 18, 2026
- CVE-2026-112018High 7.3cgltf through 1.15 contains a heap out-of-bounds write vulnerability in cgltf_accessor_unpack_floats() that allows attackers to write outside the output buffer via unchecked sparse accessor indices.Published Oct 18, 2026
- CVE-2026-112017High 7.1JeecgBoot before 3.9.5 contains an sql injection vulnerability that allows authenticated attackers to bypass the SqlInjectionUtil keyword blocklist by inserting newline characters into dictionary and online report SQL fragments.Published Oct 18, 2026
- CVE-2026-112015High 7.7Omnigent 0.3.0 before 0.14.0 contains a path traversal vulnerability that allows authenticated users to escape the workspace by setting os_env.cwd on nested sub-agents.Published Oct 18, 2026
- CVE-2026-112006High 8.3OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 contains an improper certificate validation vulnerability that disables TLS verification when OTEL_EXPORTER_OTLP_CERTIFICATE variables are empty strings.Published Oct 18, 2026
| CVE | Title | Severity | Published |
|---|---|---|---|
| CVE-2026-8168 | Uncontrolled recursion in the SVG parser and renderer of the Qt SVG module (QtSvg) in Qt Group Qt allows attackers to cause a denial of service (application crash via stack exhaustion) via a crafted SVG file with deeply nested elements. | High 7.1 | |
| CVE-2026-112287 | Krayin CRM before 2.2.7 contains a broken object level authorization vulnerability in EmailController write actions that allows scope-restricted authenticated users to manipulate other users' emails by supplying their numeric IDs. | High 7.1 | |
| CVE-2026-112286 | Krayin CRM before 2.2.7 contains an insecure direct object reference vulnerability that allows scope-restricted authenticated users to read other users' quotes by bypassing per-user data scope checks in QuoteController. | High 7.1 | |
| CVE-2026-112279 | rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in process_bmpcache2() in orders.c that allows malicious RDP servers to crash clients via crafted revision-2 bitmap cache orders. | High 7.1 | |
| CVE-2026-112278 | rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in process_raw_bmpcache() in orders.c that allows malicious RDP servers to crash clients. | High 7.1 | |
| CVE-2026-112277 | rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in process_plane() in bitmap.c that allows malicious RDP servers to crash clients by sending malformed 32 bpp compressed bitmaps. | High 7.1 | |
| CVE-2026-112270 | SGLang through 0.5.22 with the Mooncake disaggregation backend contains an uncontrolled memory allocation vulnerability in handle_staging_rsp() that lets unauthenticated network-adjacent attackers exhaust Prefill memory. | High 7.1 | |
| CVE-2026-112269 | SGLang through 0.5.22 with the Mooncake disaggregation backend accepts unauthenticated decode registration messages on the Prefill rank ZMQ PULL socket, allowing denial of service. | High 7.1 | |
| CVE-2026-112266 | SGLang through 0.5.22 contains a denial of service vulnerability that allows API clients to abort other users' in-flight generation requests by supplying a short client-controlled rid. | High 8.2 | |
| CVE-2026-112265 | LangBot through 4.11.0 contains a missing authenticity verification vulnerability that allows unauthenticated attackers to inject forged Lark/Feishu events by skipping signature checks. | High 8.3 | |
| CVE-2026-112264 | BentoML through 1.4.39 contains a Dockerfile instruction injection vulnerability that allows attackers to add arbitrary build instructions by embedding newlines in docker.env mapping keys rendered by the legacy base.j2 template. | High 8.5 | |
| CVE-2026-112263 | Television (tv) 0.15.0 through 0.15.9 contains an OS command injection vulnerability that allows attackers to run shell commands through improperly escaped single quotes in format_command. | High 8.5 | |
| CVE-2026-112262 | RisingWave before 3.1.0 contains a missing authorization vulnerability that allows low-privileged SQL users to read and write arbitrary server files by creating posix_fs sources and fs sinks. | High 7.1 | |
| CVE-2026-111915 | Yank Note before 3.93.1 contains a path traversal vulnerability that allows unauthenticated remote attackers to read arbitrary files via the path or doc parameter of /api/help. | High 8.2 | |
| CVE-2026-103314 | The Central SAML authentication ACS endpoint does not retain used SAML assertion or response identifiers to prevent replay. | High 7.4 | |
| CVE-2026-88900 | Deserialization of Untrusted Data vulnerability in Apache Camel Camel-Jgroups component. | High 8.8 | |
| CVE-2026-88901 | Improper Restriction of XML External Entity Reference vulnerability in Apache Camel. | High 8.2 | |
| CVE-2026-85251 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel HTTP component. | High 7.5 | |
| CVE-2026-85250 | Improper Restriction of XML External Entity Reference vulnerability in Apache Camel XPath component. | High 7.5 | |
| CVE-2026-83531 | Improper Control of Generation of Code ('Code Injection'), Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') vulnerability in Apache Camel. | High 8.8 | |
| CVE-2026-80344 | Server-Side Request Forgery (SSRF) vulnerability in Apache Camel AS2 component. | High 8.2 | |
| CVE-2026-80343 | Improper Handling of Case Sensitivity vulnerability in Apache Camel Netty HTTP component. | High 8.2 | |
| CVE-2026-80312 | Improper Authentication vulnerability in Apache Camel OAuth component. | High 8.2 | |
| CVE-2026-79986 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel Azure Files component. | High 7.4 | |
| CVE-2026-79985 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel SMB component. | High 7.4 | |
| CVE-2026-79984 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel Mina SFTP component. | High 7.4 | |
| CVE-2026-79983 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel FTP component. | High 7.4 | |
| CVE-2026-78165 | Deserialization of Untrusted Data vulnerability in Apache Camel Spring Redis component. | High 8.8 | |
| CVE-2026-78164 | Improper Neutralization of Special Elements Used in a Template Engine and Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel HTTP, Netty HTTP, Undertow and Vert.x HTTP components. | High 8.2 | |
| CVE-2026-112188 | MISP contains a vulnerability in its server settings lookup mechanism that allows an authenticated user to retrieve sensitive configuration data that should have been redacted. | High 7.1 | |
| CVE-2026-111408 | Deserialization of Untrusted Data vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Object Injection.This issue affects Quiz And Survey Master: from n/a through 11.2.7. | High 8.8 | |
| CVE-2026-111398 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Path Traversal.This issue affects MapSVG: from n/a through… | High 7.7 | |
| CVE-2026-110379 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro Quiz Maker quiz-maker allows Reflected XSS.This issue affects Quiz Maker: from n/a through 6.7.1.91. | High 7.1 | |
| CVE-2026-13695 | SQL injection (SQLi) vulnerability—specifically a UNION-based vulnerability—in the Integratec application that affects the sInfo parameter sent via POST to the endpoint /login/ap_Login.aspx/start. | High 8.8 | |
| CVE-2026-112178 | MISP contains an access control flaw in the proposal (shadow attribute) visibility logic. | High 7.1 | |
| CVE-2026-112161 | MobaXterm Personal Edition (Portable) 26.4 GA extracts the CygUtils64.plugin file without first verifying its integrity. | High 8.5 | |
| CVE-2026-76740 | A security vulnerability in HPE Compute Scale-up Server 3200 and 3250 platforms, Superdome Flex and Superdome Flex 280 servers could be exploited remotely to execute arbitrary commands on the RMC. | High 7.2 | |
| CVE-2026-16460 | Already-staged deployments are finalized without revalidating the deployment's container image against the current containers signature policy. | High 7.4 | |
| CVE-2026-16487 | Automatic or manual upgrades of a mutable image tag may apply unsigned content for registries that fall through to insecureAcceptAnything, allowing an… | High 8.1 | |
| CVE-2026-112082 | This impacts the function Scheduler.expert_distribution_handle of the file python/sglang/srt/eplb/expert_distribution.py of the component Expert-Distribution Recording… | High 8.7 | |
| CVE-2026-108120 | Brian Mariani from DigitalCanion SA has discovered a path traversal vulnerability in the View Logs functionality of koozali's SME Server version 11.0rc1-215 allowing an unauthenticated attacker to access files outside of the intended… | High 7.7 | |
| CVE-2026-111440 | 在 openGauss-connector-jdbc 的 pgjdbc/src/main/java/org/postgresql/log/LogFactory.java 中，LogFactory 根据 JDBC 连接参数中的 logger 类名调用 Class.forName 加载类后，直接反射调用以 String 为参数的构造函数，再转换为 Log。缺少 asSubclass(Log.class) 校验，非 Log 实现类也会在类型检查前被实例化。因此，当攻击者可控制… | High 7.0 | |
| CVE-2026-111441 | 在 openGauss-server 的 src/gausskernel/cbb/utils/hll/hll.cpp 中，内置函数 HllObjectUnpack() 存在长度校验缺陷。该函数从用户提供的 packed HLL 解析 lenUsed 与 lenTotal 后，仅检查输入长度足以覆盖 HLL_HEAD_SIZE + lenUsed，随后按 lenTotal 分配缓冲区、按 lenUsed 调用 memcpy_s() 拷贝输入，既未校验 lenTotal >=… | High 8.1 | |
| CVE-2026-108984 | A vulnerability is in Web Server default connection ports under the process name GeoWebServer.exe . | High 7.5 | |
| CVE-2026-112051 | Xinference through 4.0.1 contains a path traversal vulnerability on Windows that allows unauthenticated attackers to write and delete arbitrary .json files via backslash sequences in model_name. | High 8.3 | |
| CVE-2026-112021 | snac2 before 2.93 contains a heap-based buffer overflow vulnerability in _xs_json_load_lexer() that allows unauthenticated remote attackers to corrupt heap memory by sending JSON strings containing a \u0000 escape. | High 8.7 | |
| CVE-2026-112018 | cgltf through 1.15 contains a heap out-of-bounds write vulnerability in cgltf_accessor_unpack_floats() that allows attackers to write outside the output buffer via unchecked sparse accessor indices. | High 7.3 | |
| CVE-2026-112017 | JeecgBoot before 3.9.5 contains an sql injection vulnerability that allows authenticated attackers to bypass the SqlInjectionUtil keyword blocklist by inserting newline characters into dictionary and online report SQL fragments. | High 7.1 | |
| CVE-2026-112015 | Omnigent 0.3.0 before 0.14.0 contains a path traversal vulnerability that allows authenticated users to escape the workspace by setting os_env.cwd on nested sub-agents. | High 7.7 | |
| CVE-2026-112006 | OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 contains an improper certificate validation vulnerability that disables TLS verification when OTEL_EXPORTER_OTLP_CERTIFICATE variables are empty strings. | High 8.3 |
Showing 1–50 of 126,300. Narrow the filters to see the rest.
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status. Filter by severity and year here; the other filters work on the curated lists.