Vulnerability Intelligence · All CVEs
Every Published CVE, Searchable.
Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status.
Synced hourly · figures as of Oct 19, 2026
138,360 vulnerabilities · newest first
- CVE-2026-112295Medium 5.3FlyCms through commit edfdf724 contains a mass assignment vulnerability that allows authenticated users to overwrite protected account columns by submitting extra User bean fields to /ucenter/account_update.Published Oct 19, 2026
- CVE-2026-112294Medium 5.3FlyCms through commit edfdf724 contains a missing authorization vulnerability in ActionService.counter() that allows authenticated users to modify other users' content rows because checkRowOwner never verifies ownership.Published Oct 19, 2026
- CVE-2026-112293Medium 5.3BoxyHQ Enterprise SaaS Starter Kit through 1.6.0 contains a missing authorization vulnerability that allows non-owner team members to manage billing because payment routes skip the team_payments permission check.Published Oct 19, 2026
- CVE-2026-112291Medium 6.9Flarum Extension Manager 2.0.0-beta.1 before 2.0.0-beta.8 lacks authentication and admin checks on the TaskResource index endpoint, allowing unauthenticated information disclosure.Published Oct 19, 2026
- CVE-2026-112289Medium 5.1Koalixcrm through 1.14.0 contains a stored cross-site scripting vulnerability that allows staff users to inject script by storing malicious task titles rendered unescaped by Task.link_to_task().Published Oct 19, 2026
- CVE-2026-112285Medium 5.3Thelia before 3.1.5 and 3.2.x before 3.2.4 contains a business logic vulnerability that allows authenticated customers to bypass coupon usage limits because usage is counted only when orders become paid.Published Oct 19, 2026
- CVE-2026-112284Medium 4.8libaribcaption 1.1.0 through 1.1.2 contains a global out-of-bounds read in DecoderImpl::HandleGLGR() that reads past the 78-entry kLatinSpecialTable without an upper bound check.Published Oct 19, 2026
- CVE-2026-112283Medium 6.8VideoLAN libbluray through 1.5.1 contains an uncontrolled memory allocation vulnerability in _parse_extent_start_points() in clpi_parse.c that trusts the num_point field without bounds checking.Published Oct 19, 2026
- CVE-2026-112282Medium 6.8VideoLAN libbluray through 1.5.1 contains an out-of-bounds read vulnerability in clpi_access_point() that allows attackers to crash applications by supplying a ClipInfo file with an empty EP-map fine table.Published Oct 19, 2026
- CVE-2026-112281Medium 6.9libaribb24 (aribb24) through 1.0.3 contains a stack-based buffer overflow vulnerability in decoder_handle_csi() in src/decoder.c that allows attackers to write past a fixed 256-entry array by supplying unbounded CSI parameter bytes.Published Oct 19, 2026
- CVE-2026-112280Medium 6.9libaribb24 (aribb24) through 1.0.3 contains a heap-based buffer overflow vulnerability in src/parser.c that allows attackers to corrupt heap memory via an oversized caption data unit.Published Oct 19, 2026
- CVE-2026-112276Medium 6.9Netpbm through 11.16.00 contains a heap out-of-bounds read vulnerability in rasttopnm that allows attackers to read heap memory by supplying Sun rasterfiles with short colormaps.Published Oct 19, 2026
- CVE-2026-112275Medium 6.9Netpbm through 11.16.00 contains a heap out-of-bounds write vulnerability in the rasttopnm Sun rasterfile run-length decoder pr_load_image in converter/other/rast.c.Published Oct 19, 2026
- CVE-2026-112274Medium 6.3libtins through 4.6 contains an out-of-bounds read vulnerability in DNS::soa_record::init that allows remote attackers to read past buffer bounds by supplying SOA data lacking NUL terminators.Published Oct 19, 2026
- CVE-2026-112273Medium 6.9libtins through 4.6 contains a heap out-of-bounds read vulnerability in DNS::compose_name in src/dns.cpp that allows remote attackers to read past the packet buffer by sending a label ending exactly at the packet end.Published Oct 19, 2026
- CVE-2026-112272Medium 6.8Libdisplay-info 0.4.0 contains a heap out-of-bounds read vulnerability in the DisplayID v2 section parser in displayid2.c that allows attackers to read past the EDID buffer via oversized data block lengths.Published Oct 19, 2026
- CVE-2026-112271Medium 6.8libdisplay-info through 0.4.0 contains a heap out-of-bounds read vulnerability in the DisplayID v1 section parser in displayid.c that occurs when a data block's declared length exceeds the section.Published Oct 19, 2026
- CVE-2026-112268Medium 5.3sglang-router (sgl-model-gateway) through 0.3.2 contains an authorization bypass vulnerability that allows holders of the data-plane API key to access mesh HA management routes because /ha/* endpoints skip control-plane Admin role checks.Published Oct 19, 2026
- CVE-2026-112267Medium 6.9SGLang through 0.5.22 in prefill/decode disaggregation mode contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger outbound requests via client-supplied bootstrap_host and bootstrap_port…Published Oct 19, 2026
- CVE-2026-112222Medium 5.4Missing Authorization vulnerability in Surfer Surfer surferseo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Surfer: from n/a through 1.8.0.744.Published Oct 19, 2026
- CVE-2026-112145Medium 5.5A security vulnerability has been detected in speaches-ai speaches up to 0.9.0-rc.3.Published Oct 19, 2026
- CVE-2026-112144Medium 5.5A weakness has been identified in satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f46f7871b83f425383a.Published Oct 19, 2026
- CVE-2026-112143Medium 5.5Affected by this issue is some unknown functionality.Published Oct 19, 2026
- CVE-2026-111939Medium 5.1Frappe Helpdesk before 1.26.0 contains an authorization bypass vulnerability that allows authenticated portal users to create tickets impersonating other customers by supplying a raised_by value.Published Oct 19, 2026
- CVE-2026-111938Medium 5.3Frappe CRM before 1.74.0 contains a missing authorization vulnerability that allows authenticated Sales Users to modify other users' call logs by supplying arbitrary call_sid values.Published Oct 19, 2026
- CVE-2026-111937Medium 5.3Frappe CRM before 1.81.2 contains a missing authorization vulnerability that allows authenticated Sales Users to access other users' CRM Notification records due to absent permission hooks.Published Oct 19, 2026
- CVE-2026-111936Medium 5.3Sigma File Manager through 2.2.0 contains a server-side request forgery vulnerability because validate_remote_url() in security.rs never checks resolved IP addresses for extension download commands.Published Oct 19, 2026
- CVE-2026-111925Medium 6.9Mopidy before 4.0.5 contains a path traversal vulnerability that allows unauthenticated clients to access local files outside file/media_dirs because FileLibraryProvider.lookup() lacks a containment check.Published Oct 19, 2026
- CVE-2026-111899Medium 5.3KitchenOwl through 0.7.10 contains a server-side request forgery vulnerability in recipe import that allows authenticated household members to bypass IP filtering via a second unfiltered fetch.Published Oct 19, 2026
- CVE-2026-111883Medium 5.3Locust through 2.46.7 contains a cross-site request forgery vulnerability that allows remote attackers to stop load tests or reset statistics via GET requests to /stop and /stats/reset.Published Oct 19, 2026
- CVE-2026-111829Medium 6.5Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WP Mailster WP Mailster wp-mailster allows PHP Local File Inclusion.This issue affects WP Mailster: from n/a through 1.Published Oct 19, 2026
- CVE-2026-111828Medium 4.3Improper Validation of Specified Quantity in Input vulnerability in Mamunur Rashid Classified Listing classified-listing allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Classified Listing: from n/a…Published Oct 19, 2026
- CVE-2026-110902Medium 4.3Authorization Bypass Through User-Controlled Key vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a…Published Oct 19, 2026
- CVE-2026-110008Medium 4.2In versions 7.2.0 through 8.3.1, the state and code-verifier cookies are set without a Path attribute at a login route with two or more path segments, while the clearing step at…Published Oct 19, 2026
- CVE-2026-112214Medium 6.5When parsing a Simple Index object, an attacker-controlled entry count is used to size a heap allocation without being limited to the payload available in the object.Published Oct 19, 2026
- CVE-2026-112199Medium 6.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITH YITH WooCommerce Wishlist yith-woocommerce-wishlist allows Stored XSS.This issue affects YITH WooCommerce Wishlist: from n/a…Published Oct 19, 2026
- CVE-2026-112142Medium 5.5Affected by this vulnerability is an unknown functionality of the file dodelete.php of the component…Published Oct 19, 2026
- CVE-2026-112141Medium 5.5A vulnerability was determined in satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f46f7871b83f425383a.Published Oct 19, 2026
- CVE-2026-111845Medium 5.3Missing Authorization vulnerability in YITH YITH WooCommerce Product Bundles yith-woocommerce-product-bundles allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH WooCommerce Product Bundles:…Published Oct 19, 2026
- CVE-2026-111839Medium 5.3Missing Authorization vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Broadcast Live Video: from n/a…Published Oct 19, 2026
- CVE-2026-111836Medium 4.3Missing Authorization vulnerability in WP ManageNinja LLC FluentCommunity fluent-community allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FluentCommunity: from n/a through 2.11.0.Published Oct 19, 2026
- CVE-2026-111831Medium 5.3Missing Authorization vulnerability in WP ManageNinja LLC FluentForm fluentform allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FluentForm: from n/a through 6.2.15.Published Oct 19, 2026
- CVE-2026-111414Medium 6.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through…Published Oct 19, 2026
- CVE-2026-111410Medium 6.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in E2Pdf.com e2pdf e2pdf allows Stored XSS.This issue affects e2pdf: from n/a through 1.32.57.Published Oct 19, 2026
- CVE-2026-110363Medium 5.4Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnPress: from n/a through 4.4.10.Published Oct 19, 2026
- CVE-2026-112210Medium 6.0The service runs as root and operates on a file inside a directory owned by an unprivileged system user without verifying that the file is not a symbolic…Published Oct 19, 2026
- CVE-2026-112139Medium 5.5TPublished Oct 19, 2026
- CVE-2026-91858Medium 6.5FopProducer transforms the incoming XSL-FO message body by creating a javax.xml.transform.TransformerFactory through TransformerFactory.newInstance() and enabling only FEATURE_SECURE_PROCESSING before running an identity transform over…Published Oct 19, 2026
- CVE-2026-85317Medium 4.8Use of Cache Containing Sensitive Information vulnerability in Apache Camel HTTP component.Published Oct 19, 2026
- CVE-2026-85316Medium 4.8Insufficient Granularity of Access Control vulnerability in Apache Camel Platform HTTP component.Published Oct 19, 2026
| CVE | Title | Severity | Published |
|---|---|---|---|
| CVE-2026-112295 | FlyCms through commit edfdf724 contains a mass assignment vulnerability that allows authenticated users to overwrite protected account columns by submitting extra User bean fields to /ucenter/account_update. | Medium 5.3 | |
| CVE-2026-112294 | FlyCms through commit edfdf724 contains a missing authorization vulnerability in ActionService.counter() that allows authenticated users to modify other users' content rows because checkRowOwner never verifies ownership. | Medium 5.3 | |
| CVE-2026-112293 | BoxyHQ Enterprise SaaS Starter Kit through 1.6.0 contains a missing authorization vulnerability that allows non-owner team members to manage billing because payment routes skip the team_payments permission check. | Medium 5.3 | |
| CVE-2026-112291 | Flarum Extension Manager 2.0.0-beta.1 before 2.0.0-beta.8 lacks authentication and admin checks on the TaskResource index endpoint, allowing unauthenticated information disclosure. | Medium 6.9 | |
| CVE-2026-112289 | Koalixcrm through 1.14.0 contains a stored cross-site scripting vulnerability that allows staff users to inject script by storing malicious task titles rendered unescaped by Task.link_to_task(). | Medium 5.1 | |
| CVE-2026-112285 | Thelia before 3.1.5 and 3.2.x before 3.2.4 contains a business logic vulnerability that allows authenticated customers to bypass coupon usage limits because usage is counted only when orders become paid. | Medium 5.3 | |
| CVE-2026-112284 | libaribcaption 1.1.0 through 1.1.2 contains a global out-of-bounds read in DecoderImpl::HandleGLGR() that reads past the 78-entry kLatinSpecialTable without an upper bound check. | Medium 4.8 | |
| CVE-2026-112283 | VideoLAN libbluray through 1.5.1 contains an uncontrolled memory allocation vulnerability in _parse_extent_start_points() in clpi_parse.c that trusts the num_point field without bounds checking. | Medium 6.8 | |
| CVE-2026-112282 | VideoLAN libbluray through 1.5.1 contains an out-of-bounds read vulnerability in clpi_access_point() that allows attackers to crash applications by supplying a ClipInfo file with an empty EP-map fine table. | Medium 6.8 | |
| CVE-2026-112281 | libaribb24 (aribb24) through 1.0.3 contains a stack-based buffer overflow vulnerability in decoder_handle_csi() in src/decoder.c that allows attackers to write past a fixed 256-entry array by supplying unbounded CSI parameter bytes. | Medium 6.9 | |
| CVE-2026-112280 | libaribb24 (aribb24) through 1.0.3 contains a heap-based buffer overflow vulnerability in src/parser.c that allows attackers to corrupt heap memory via an oversized caption data unit. | Medium 6.9 | |
| CVE-2026-112276 | Netpbm through 11.16.00 contains a heap out-of-bounds read vulnerability in rasttopnm that allows attackers to read heap memory by supplying Sun rasterfiles with short colormaps. | Medium 6.9 | |
| CVE-2026-112275 | Netpbm through 11.16.00 contains a heap out-of-bounds write vulnerability in the rasttopnm Sun rasterfile run-length decoder pr_load_image in converter/other/rast.c. | Medium 6.9 | |
| CVE-2026-112274 | libtins through 4.6 contains an out-of-bounds read vulnerability in DNS::soa_record::init that allows remote attackers to read past buffer bounds by supplying SOA data lacking NUL terminators. | Medium 6.3 | |
| CVE-2026-112273 | libtins through 4.6 contains a heap out-of-bounds read vulnerability in DNS::compose_name in src/dns.cpp that allows remote attackers to read past the packet buffer by sending a label ending exactly at the packet end. | Medium 6.9 | |
| CVE-2026-112272 | Libdisplay-info 0.4.0 contains a heap out-of-bounds read vulnerability in the DisplayID v2 section parser in displayid2.c that allows attackers to read past the EDID buffer via oversized data block lengths. | Medium 6.8 | |
| CVE-2026-112271 | libdisplay-info through 0.4.0 contains a heap out-of-bounds read vulnerability in the DisplayID v1 section parser in displayid.c that occurs when a data block's declared length exceeds the section. | Medium 6.8 | |
| CVE-2026-112268 | sglang-router (sgl-model-gateway) through 0.3.2 contains an authorization bypass vulnerability that allows holders of the data-plane API key to access mesh HA management routes because /ha/* endpoints skip control-plane Admin role checks. | Medium 5.3 | |
| CVE-2026-112267 | SGLang through 0.5.22 in prefill/decode disaggregation mode contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger outbound requests via client-supplied bootstrap_host and bootstrap_port… | Medium 6.9 | |
| CVE-2026-112222 | Missing Authorization vulnerability in Surfer Surfer surferseo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Surfer: from n/a through 1.8.0.744. | Medium 5.4 | |
| CVE-2026-112145 | A security vulnerability has been detected in speaches-ai speaches up to 0.9.0-rc.3. | Medium 5.5 | |
| CVE-2026-112144 | A weakness has been identified in satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f46f7871b83f425383a. | Medium 5.5 | |
| CVE-2026-112143 | Affected by this issue is some unknown functionality. | Medium 5.5 | |
| CVE-2026-111939 | Frappe Helpdesk before 1.26.0 contains an authorization bypass vulnerability that allows authenticated portal users to create tickets impersonating other customers by supplying a raised_by value. | Medium 5.1 | |
| CVE-2026-111938 | Frappe CRM before 1.74.0 contains a missing authorization vulnerability that allows authenticated Sales Users to modify other users' call logs by supplying arbitrary call_sid values. | Medium 5.3 | |
| CVE-2026-111937 | Frappe CRM before 1.81.2 contains a missing authorization vulnerability that allows authenticated Sales Users to access other users' CRM Notification records due to absent permission hooks. | Medium 5.3 | |
| CVE-2026-111936 | Sigma File Manager through 2.2.0 contains a server-side request forgery vulnerability because validate_remote_url() in security.rs never checks resolved IP addresses for extension download commands. | Medium 5.3 | |
| CVE-2026-111925 | Mopidy before 4.0.5 contains a path traversal vulnerability that allows unauthenticated clients to access local files outside file/media_dirs because FileLibraryProvider.lookup() lacks a containment check. | Medium 6.9 | |
| CVE-2026-111899 | KitchenOwl through 0.7.10 contains a server-side request forgery vulnerability in recipe import that allows authenticated household members to bypass IP filtering via a second unfiltered fetch. | Medium 5.3 | |
| CVE-2026-111883 | Locust through 2.46.7 contains a cross-site request forgery vulnerability that allows remote attackers to stop load tests or reset statistics via GET requests to /stop and /stats/reset. | Medium 5.3 | |
| CVE-2026-111829 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WP Mailster WP Mailster wp-mailster allows PHP Local File Inclusion.This issue affects WP Mailster: from n/a through 1. | Medium 6.5 | |
| CVE-2026-111828 | Improper Validation of Specified Quantity in Input vulnerability in Mamunur Rashid Classified Listing classified-listing allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Classified Listing: from n/a… | Medium 4.3 | |
| CVE-2026-110902 | Authorization Bypass Through User-Controlled Key vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a… | Medium 4.3 | |
| CVE-2026-110008 | In versions 7.2.0 through 8.3.1, the state and code-verifier cookies are set without a Path attribute at a login route with two or more path segments, while the clearing step at… | Medium 4.2 | |
| CVE-2026-112214 | When parsing a Simple Index object, an attacker-controlled entry count is used to size a heap allocation without being limited to the payload available in the object. | Medium 6.5 | |
| CVE-2026-112199 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITH YITH WooCommerce Wishlist yith-woocommerce-wishlist allows Stored XSS.This issue affects YITH WooCommerce Wishlist: from n/a… | Medium 6.5 | |
| CVE-2026-112142 | Affected by this vulnerability is an unknown functionality of the file dodelete.php of the component… | Medium 5.5 | |
| CVE-2026-112141 | A vulnerability was determined in satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f46f7871b83f425383a. | Medium 5.5 | |
| CVE-2026-111845 | Missing Authorization vulnerability in YITH YITH WooCommerce Product Bundles yith-woocommerce-product-bundles allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH WooCommerce Product Bundles:… | Medium 5.3 | |
| CVE-2026-111839 | Missing Authorization vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Broadcast Live Video: from n/a… | Medium 5.3 | |
| CVE-2026-111836 | Missing Authorization vulnerability in WP ManageNinja LLC FluentCommunity fluent-community allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FluentCommunity: from n/a through 2.11.0. | Medium 4.3 | |
| CVE-2026-111831 | Missing Authorization vulnerability in WP ManageNinja LLC FluentForm fluentform allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FluentForm: from n/a through 6.2.15. | Medium 5.3 | |
| CVE-2026-111414 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through… | Medium 6.5 | |
| CVE-2026-111410 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in E2Pdf.com e2pdf e2pdf allows Stored XSS.This issue affects e2pdf: from n/a through 1.32.57. | Medium 6.5 | |
| CVE-2026-110363 | Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnPress: from n/a through 4.4.10. | Medium 5.4 | |
| CVE-2026-112210 | The service runs as root and operates on a file inside a directory owned by an unprivileged system user without verifying that the file is not a symbolic… | Medium 6.0 | |
| CVE-2026-112139 | T | Medium 5.5 | |
| CVE-2026-91858 | FopProducer transforms the incoming XSL-FO message body by creating a javax.xml.transform.TransformerFactory through TransformerFactory.newInstance() and enabling only FEATURE_SECURE_PROCESSING before running an identity transform over… | Medium 6.5 | |
| CVE-2026-85317 | Use of Cache Containing Sensitive Information vulnerability in Apache Camel HTTP component. | Medium 4.8 | |
| CVE-2026-85316 | Insufficient Granularity of Access Control vulnerability in Apache Camel Platform HTTP component. | Medium 4.8 |
Showing 1–50 of 138,360. Narrow the filters to see the rest.
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Every published CVE keeps a row, so any identifier resolves to its severity, dates and exploitation status. Filter by severity and year here; the other filters work on the curated lists.