Vulnerability Intelligence · All CVEs
Every Published CVE, Searchable.
Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status.
Synced hourly · figures as of Oct 19, 2026
11,289 vulnerabilities · newest first
- CVE-2026-112290Low 2.3Intelligence Community UI Kit @ukic/canary-web-components 3.0.0-canary.12 before 3.0.0-canary.48 contains a DOM-based cross-site scripting vulnerability in ic-tree-item that re-parses router-item slot text as HTML.Published Oct 19, 2026
- CVE-2026-112288Low 2.1Krayin CRM 2.2.5 before 2.2.7 contains a server-side request forgery filter bypass that allows users with webhook permissions to reach internal addresses via DNS rebinding.Published Oct 19, 2026
- CVE-2026-112146Low 2.1A vulnerability was detected in D-Link E15, M32, R15 and R32.Published Oct 19, 2026
- CVE-2026-111935Low 2.1NoteGen through 0.38.3 contains an external control of file path vulnerability in chat image analysis that allows attackers to read local image files via unvalidated synced sourceUrl paths.Published Oct 19, 2026
- CVE-2026-112140Low 2.1This impacts the function _get_lib_module of the file python/mlc_chat/chat_module.py.Published Oct 19, 2026
- CVE-2026-112138Low 2.0Executing a manipulation can…Published Oct 19, 2026
- CVE-2026-112108Low 2.1A vulnerability was determined in ztxz16 fastllm up to 0.1.8.2.Published Oct 19, 2026
- CVE-2026-112107Low 2.1Affected by this issue is the function SafeTensorItem::CreateBuffer of the file src/model.cpp of the component Safetensors Weight Loading.Published Oct 19, 2026
- CVE-2026-91831Low 3.8The Subscribe to Comments WordPress plugin before 2.3.3 does not sanitise newline characters from a notification sender-name setting before using it in e-mail headers, allowing users with Author-level access and above to inject arbitrary…Published Oct 19, 2026
- CVE-2026-110034Low 3.7The Salon Booking System WordPress plugin before 10.31.11 does not enforce a minimum of zero when subtracting a fixed-amount discount from a booking's total, allowing an unauthenticated visitor who knows a valid discount code to create a…Published Oct 19, 2026
- CVE-2026-112112Low 2.3An IPv6 FlowSpec validation bypass in the CZ.NIC BIRD Internet Routing Daemon allows an established BGP peer to inject FlowSpec rules matching destinations outside the address space authorized by the unicast-route validation procedure.Published Oct 18, 2026
- CVE-2026-112029Low 2.0Such manipulation of the argument salt/password leads to…Published Oct 18, 2026
- CVE-2026-112050Low 2.3Gitify before 7.10.0 contains a login cross-site request forgery vulnerability that allows remote attackers to bind a victim's client to their account because performGitHubWebOAuth() omits OAuth state validation.Published Oct 18, 2026
- CVE-2026-112004Low 2.3Teable before 2026-10-12T12-45-53Z.3331 contains an authorization bypass vulnerability that allows authenticated users to rename folders in other bases by supplying a foreign folderId.Published Oct 18, 2026
- CVE-2025-71435Low 2.3Coder before 2.23.0 contains a session expiration bypass vulnerability that allows authenticated users to retain access after OIDC token expiry when no refresh token is issued.Published Oct 17, 2026
- CVE-2026-92431Low 3.7The Patreon WordPress plugin before 1.10.0 does not perform an authorization check on some of its functionality, allowing unauthenticated users to enumerate the names of terms in any taxonomy, including non-public taxonomies that…Published Oct 17, 2026
- CVE-2026-17591Low 3.6An attacker can cause a Denial of Service (DoS) or potential information disclosure due to a use-after-free vulnerability, which occurs when a program reads memory that has already been released.Published Oct 16, 2026
- CVE-2026-76894Low 3.1ckan-mcp-server: DataStore Table UI resource does not validate postMessage origin (in) and posts to targetOrigin "*" (out)Published Oct 16, 2026
- CVE-2026-68549Low 3.3ClickMigrate has Path Traversal in "revision -m" argumentPublished Oct 16, 2026
- CVE-2026-17275Low 3.7IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote attacker to perform unauthorized manipulation of distributed transactions due to improper validation of attacker-supplied transaction identifiers.Published Oct 16, 2026
- CVE-2026-111714Low 2.3tarteaucitron.js before 1.37.0 ReDoS via Unescaped Cookie Name in cookie.purgePublished Oct 16, 2026
- CVE-2026-111628Low 2.310up Distributor before 2.3.2 PHP Object Injection via set_meta()Published Oct 16, 2026
- CVE-2026-111608Low 2.3Jeepay through 3.2.9 IDOR via DELETE /api/divisionReceivers/{recordId}Published Oct 16, 2026
- CVE-2026-109839Low 3.1IBM Db2 Genius Hub Missing Cryptographic StepPublished Oct 16, 2026
- CVE-2026-111581Low 3.3The bd_fs_ntfs_set_label() and bd_fs_vfat_set_label() functions pass caller-supplied label values as bare positional arguments to the ntfslabel and fatlabel utilities without end-of-options separators or…Published Oct 16, 2026
- CVE-2026-111602Low 3.7Appointment Booking Plugin <= 5.7.4 - Unauthenticated Sensitive Information Disclosure via ORM Operator Injection in 'customer[uuid]' ParameterPublished Oct 16, 2026
- CVE-2026-110805Low 2.6Server-side request forgery in PingOne groups endpoint in Devolutions Server 2026.3.8.0 and earlier allows an authenticated low-privileged user to exfiltrate the stored PingOne application secret via an attacker-controlled PingOne…Published Oct 16, 2026
- CVE-2026-109401Low 2.7WP Mail Logging <= 1.17.0 - Authenticated (Administrator+) Sensitive Information Exposure in LIKE Wildcard in Personal Data Export EmailPublished Oct 16, 2026
- CVE-2026-110191Low 2.7Product Delivery Date for WooCommerce – Lite < 3.3.2 - Contributor+ Order Information Disclosure via Calendar View AJAX ActionsPublished Oct 16, 2026
- CVE-2026-110039Low 2.7Smush < 4.3.4 - Admin+ Network-Wide Plugin Settings Update on MultisitePublished Oct 16, 2026
- CVE-2026-111448Low 3.7Wheels 4.0.0 through 4.1.2 uses case-insensitive comparisons in path-containment checks on case-sensitive filesystems.Published Oct 16, 2026
- CVE-2026-111376Low 2.3FreeRDP 3.30.0 before 3.32.0 Heap Over-Read via Windows cliprdr FILECONTENTS_SIZEPublished Oct 16, 2026
- CVE-2026-111212Low 2.4ImprintLab Medical-SAM-Adapter AutoBackend Model Loading autobackend.py session.get_modelmeta.custom_metadata_map eval injectionPublished Oct 16, 2026
- CVE-2026-111354Low 2.3crmeb_java through 3.1 Authorization Bypass via Front Order Express and Refund EndpointsPublished Oct 15, 2026
- CVE-2026-111351Low 2.3metasfresh through 5.175 Authorization Bypass via /rest/api/board REST APIPublished Oct 15, 2026
- CVE-2026-111350Low 2.3Papermark through 0.22.0 Missing Authorization in Data Room Viewer Group APIPublished Oct 15, 2026
- CVE-2026-111169Low 2.3La Suite Docs through 6.0.0 Authorization Bypass via Comment Thread CreationPublished Oct 15, 2026
- CVE-2026-111233Low 2.3Netgate pfSense CE 2.7.1 through 2.9.0 Reflected XSS via firewall_rules.phpPublished Oct 15, 2026
- CVE-2026-111225Low 2.3Netgate pfSense CE 2.5.0 through 2.9.0 OS Command Injection via openvpn.learn-address.shPublished Oct 15, 2026
- CVE-2026-55876Low 3.5Prior to 2.2.60, the POST /planner/attachments/ endpoint allows authenticated users to upload SVG and HTML attachments because conf/configs/common.py omits…Published Oct 15, 2026
- CVE-2026-55467Low 2.5Prior to 2.4.20, the cupsdCreateJob option-string builder in scheduler/job.c maps attacker-controlled destination-uri and pre-dial-string…Published Oct 15, 2026
- CVE-2026-55453Low 3.3Prior to 2.4.20, the backend/ipp.c quote_string() function preserves carriage-return and line-feed characters in a remote…Published Oct 15, 2026
- CVE-2026-61610Low 2.3Lychee: unauthenticated photo starring reveals existence of private photos when photos_star_visibility=anonymousPublished Oct 15, 2026
- CVE-2026-57569Low 2.3Lychee: Distinct post-fix SSRF variant in Photo::fromUrl due to missing IP pinning after DNS-based validationPublished Oct 15, 2026
- CVE-2026-55184Low 3.5EspoCRM: Stored XSS in wysiwyg template fields if CSP is disabledPublished Oct 15, 2026
- CVE-2026-53575Low 2.7EspoCRM: Persistent XSS via CSP nonce injection in applicationName setting by admin userPublished Oct 15, 2026
- CVE-2026-79835Low 2.8HPE Nonstop KMS Server - Buffer overflow vulnerabilityPublished Oct 15, 2026
- CVE-2025-29897Low 2.3Stack-based Buffer Overflow in qsyncsrv.cgiPublished Oct 15, 2026
- CVE-2025-29896Low 2.3NULL Pointer Dereference in qsyncsrv.cgiPublished Oct 15, 2026
- CVE-2025-29895Low 2.3NULL Pointer Dereference in qsyncsrv.cgiPublished Oct 15, 2026
| CVE | Title | Severity | Published |
|---|---|---|---|
| CVE-2026-112290 | Intelligence Community UI Kit @ukic/canary-web-components 3.0.0-canary.12 before 3.0.0-canary.48 contains a DOM-based cross-site scripting vulnerability in ic-tree-item that re-parses router-item slot text as HTML. | Low 2.3 | |
| CVE-2026-112288 | Krayin CRM 2.2.5 before 2.2.7 contains a server-side request forgery filter bypass that allows users with webhook permissions to reach internal addresses via DNS rebinding. | Low 2.1 | |
| CVE-2026-112146 | A vulnerability was detected in D-Link E15, M32, R15 and R32. | Low 2.1 | |
| CVE-2026-111935 | NoteGen through 0.38.3 contains an external control of file path vulnerability in chat image analysis that allows attackers to read local image files via unvalidated synced sourceUrl paths. | Low 2.1 | |
| CVE-2026-112140 | This impacts the function _get_lib_module of the file python/mlc_chat/chat_module.py. | Low 2.1 | |
| CVE-2026-112138 | Executing a manipulation can… | Low 2.0 | |
| CVE-2026-112108 | A vulnerability was determined in ztxz16 fastllm up to 0.1.8.2. | Low 2.1 | |
| CVE-2026-112107 | Affected by this issue is the function SafeTensorItem::CreateBuffer of the file src/model.cpp of the component Safetensors Weight Loading. | Low 2.1 | |
| CVE-2026-91831 | The Subscribe to Comments WordPress plugin before 2.3.3 does not sanitise newline characters from a notification sender-name setting before using it in e-mail headers, allowing users with Author-level access and above to inject arbitrary… | Low 3.8 | |
| CVE-2026-110034 | The Salon Booking System WordPress plugin before 10.31.11 does not enforce a minimum of zero when subtracting a fixed-amount discount from a booking's total, allowing an unauthenticated visitor who knows a valid discount code to create a… | Low 3.7 | |
| CVE-2026-112112 | An IPv6 FlowSpec validation bypass in the CZ.NIC BIRD Internet Routing Daemon allows an established BGP peer to inject FlowSpec rules matching destinations outside the address space authorized by the unicast-route validation procedure. | Low 2.3 | |
| CVE-2026-112029 | Such manipulation of the argument salt/password leads to… | Low 2.0 | |
| CVE-2026-112050 | Gitify before 7.10.0 contains a login cross-site request forgery vulnerability that allows remote attackers to bind a victim's client to their account because performGitHubWebOAuth() omits OAuth state validation. | Low 2.3 | |
| CVE-2026-112004 | Teable before 2026-10-12T12-45-53Z.3331 contains an authorization bypass vulnerability that allows authenticated users to rename folders in other bases by supplying a foreign folderId. | Low 2.3 | |
| CVE-2025-71435 | Coder before 2.23.0 contains a session expiration bypass vulnerability that allows authenticated users to retain access after OIDC token expiry when no refresh token is issued. | Low 2.3 | |
| CVE-2026-92431 | The Patreon WordPress plugin before 1.10.0 does not perform an authorization check on some of its functionality, allowing unauthenticated users to enumerate the names of terms in any taxonomy, including non-public taxonomies that… | Low 3.7 | |
| CVE-2026-17591 | An attacker can cause a Denial of Service (DoS) or potential information disclosure due to a use-after-free vulnerability, which occurs when a program reads memory that has already been released. | Low 3.6 | |
| CVE-2026-76894 | ckan-mcp-server: DataStore Table UI resource does not validate postMessage origin (in) and posts to targetOrigin "*" (out) | Low 3.1 | |
| CVE-2026-68549 | ClickMigrate has Path Traversal in "revision -m" argument | Low 3.3 | |
| CVE-2026-17275 | IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote attacker to perform unauthorized manipulation of distributed transactions due to improper validation of attacker-supplied transaction identifiers. | Low 3.7 | |
| CVE-2026-111714 | tarteaucitron.js before 1.37.0 ReDoS via Unescaped Cookie Name in cookie.purge | Low 2.3 | |
| CVE-2026-111628 | 10up Distributor before 2.3.2 PHP Object Injection via set_meta() | Low 2.3 | |
| CVE-2026-111608 | Jeepay through 3.2.9 IDOR via DELETE /api/divisionReceivers/{recordId} | Low 2.3 | |
| CVE-2026-109839 | IBM Db2 Genius Hub Missing Cryptographic Step | Low 3.1 | |
| CVE-2026-111581 | The bd_fs_ntfs_set_label() and bd_fs_vfat_set_label() functions pass caller-supplied label values as bare positional arguments to the ntfslabel and fatlabel utilities without end-of-options separators or… | Low 3.3 | |
| CVE-2026-111602 | Appointment Booking Plugin <= 5.7.4 - Unauthenticated Sensitive Information Disclosure via ORM Operator Injection in 'customer[uuid]' Parameter | Low 3.7 | |
| CVE-2026-110805 | Server-side request forgery in PingOne groups endpoint in Devolutions Server 2026.3.8.0 and earlier allows an authenticated low-privileged user to exfiltrate the stored PingOne application secret via an attacker-controlled PingOne… | Low 2.6 | |
| CVE-2026-109401 | WP Mail Logging <= 1.17.0 - Authenticated (Administrator+) Sensitive Information Exposure in LIKE Wildcard in Personal Data Export Email | Low 2.7 | |
| CVE-2026-110191 | Product Delivery Date for WooCommerce – Lite < 3.3.2 - Contributor+ Order Information Disclosure via Calendar View AJAX Actions | Low 2.7 | |
| CVE-2026-110039 | Smush < 4.3.4 - Admin+ Network-Wide Plugin Settings Update on Multisite | Low 2.7 | |
| CVE-2026-111448 | Wheels 4.0.0 through 4.1.2 uses case-insensitive comparisons in path-containment checks on case-sensitive filesystems. | Low 3.7 | |
| CVE-2026-111376 | FreeRDP 3.30.0 before 3.32.0 Heap Over-Read via Windows cliprdr FILECONTENTS_SIZE | Low 2.3 | |
| CVE-2026-111212 | ImprintLab Medical-SAM-Adapter AutoBackend Model Loading autobackend.py session.get_modelmeta.custom_metadata_map eval injection | Low 2.4 | |
| CVE-2026-111354 | crmeb_java through 3.1 Authorization Bypass via Front Order Express and Refund Endpoints | Low 2.3 | |
| CVE-2026-111351 | metasfresh through 5.175 Authorization Bypass via /rest/api/board REST API | Low 2.3 | |
| CVE-2026-111350 | Papermark through 0.22.0 Missing Authorization in Data Room Viewer Group API | Low 2.3 | |
| CVE-2026-111169 | La Suite Docs through 6.0.0 Authorization Bypass via Comment Thread Creation | Low 2.3 | |
| CVE-2026-111233 | Netgate pfSense CE 2.7.1 through 2.9.0 Reflected XSS via firewall_rules.php | Low 2.3 | |
| CVE-2026-111225 | Netgate pfSense CE 2.5.0 through 2.9.0 OS Command Injection via openvpn.learn-address.sh | Low 2.3 | |
| CVE-2026-55876 | Prior to 2.2.60, the POST /planner/attachments/ endpoint allows authenticated users to upload SVG and HTML attachments because conf/configs/common.py omits… | Low 3.5 | |
| CVE-2026-55467 | Prior to 2.4.20, the cupsdCreateJob option-string builder in scheduler/job.c maps attacker-controlled destination-uri and pre-dial-string… | Low 2.5 | |
| CVE-2026-55453 | Prior to 2.4.20, the backend/ipp.c quote_string() function preserves carriage-return and line-feed characters in a remote… | Low 3.3 | |
| CVE-2026-61610 | Lychee: unauthenticated photo starring reveals existence of private photos when photos_star_visibility=anonymous | Low 2.3 | |
| CVE-2026-57569 | Lychee: Distinct post-fix SSRF variant in Photo::fromUrl due to missing IP pinning after DNS-based validation | Low 2.3 | |
| CVE-2026-55184 | EspoCRM: Stored XSS in wysiwyg template fields if CSP is disabled | Low 3.5 | |
| CVE-2026-53575 | EspoCRM: Persistent XSS via CSP nonce injection in applicationName setting by admin user | Low 2.7 | |
| CVE-2026-79835 | HPE Nonstop KMS Server - Buffer overflow vulnerability | Low 2.8 | |
| CVE-2025-29897 | Stack-based Buffer Overflow in qsyncsrv.cgi | Low 2.3 | |
| CVE-2025-29896 | NULL Pointer Dereference in qsyncsrv.cgi | Low 2.3 | |
| CVE-2025-29895 | NULL Pointer Dereference in qsyncsrv.cgi | Low 2.3 |
Showing 1–50 of 11,289. Narrow the filters to see the rest.
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status. Filter by severity and year here; the other filters work on the curated lists.