01 Search console

The CVE corpus, on scope in milliseconds.

409,157 records · updated every 15 minutes

02 Telemetry

Total CVEs409,157

New today435

Known-exploited (KEV)1,746

Sync lag17 MIN

03 Severity mix

04 Latest published

CVE IDCVSSSeverityKEVSummaryVendor / ProductPublished

CVE-2026-966278.8High—8.8HighArcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)getarcaneapp arcane10 MIN AGO

CVE-2026-684987.5High—7.5Highjackson-core: Delayed maxNameLength enforcement for char-backed input (ReaderBasedJsonParser) allows memory-exhaustion denial of servicefasterxml jackson-core12 MIN AGO

CVE-2026-966284.3Medium—4.3MediumArcane: Environment access token bypasses the admin-required authorization gate on `/api/debug/pprof`getarcaneapp arcane13 MIN AGO

CVE-2026-966268.5High—8.5HighArcane: Container-registry credential exfiltration via URL repoint + test to attacker hostgetarcaneapp arcane16 MIN AGO

CVE-2026-965425.0Medium—5.0MediumEA Javelin Anticheat Installer Local Privilege Escalationelectronic arts ea javelin anticheat (ea javelin anticheat installer)23 MIN AGO

CVE-2026-648626.5Medium—6.5MediumFrappe HR: Missing Authorization on PWA API Endpoints enables Cross-Employee Data access in HRMSfrappe hrms31 MIN AGO

CVE-2026-557966.5Medium—6.5MediumFrappe HR: SQL Injection in HRMS Salary Payments via ECS Reportfrappe hrms34 MIN AGO

CVE-2026-1083736.5Medium—6.5MediumERPNext: Unauthorised access to financial data due to missing validationfrappe erpnext35 MIN AGO

CVE-2026-1083747.7High—7.7HighERPNext: Unauthorised status modification due to missing validationfrappe erpnext45 MIN AGO

CVE-2026-1028347.5High—7.5HighJavaCV: Integer Overflow in IPCameraFrameGrabber Causes Infinite-Loop DoSbytedeco javacv1 HR AGO

CVE-2026-108743—Unrated——UnratedApache Kylin: spark job OS command injectionapache software foundation apache kylin1 HR AGO

CVE-2026-966209.2Critical—9.2CriticalClaude Agent SDK: Argument Injection via resume Option Allows Arbitrary Command Executionanthropics claude-agent-sdk-python1 HR AGO

CVE-2026-309718.8High—8.8HighZoneMinder: Authenticated RCE via command injection in monitor Device Pathzoneminder zoneminder1 HR AGO

CVE-2026-108709—Unrated——UnratedApache Kylin: Unauthenticated Metadata Broadcast (inside in-house network)apache software foundation apache kylin1 HR AGO

CVE-2026-69080—Unrated——UnratedApache Kylin: Broken Access Control in QuerySQLBlacklistControllerapache software foundation apache kylin1 HR AGO

View all 409,157 records

05 Recently added to KEV

KEVCVE-2026-21589This CVE's publication may have been a false positive or a mistake. As a result, we have rejected this record.Added 2026-10-15

KEVCVE-2026-76519cisco cisco secure emailAdded 2026-10-14

KEVCVE-2026-105134ahsay ahsaycbsAdded 2026-10-14

KEVCVE-2026-105133ahsay ahsaycbsAdded 2026-10-14

KEVCVE-2026-0322palo alto networks cloud ngfw palo alto networks pan-os palo alto networks prisma accessAdded 2026-10-14

KEVCVE-2026-96951microsoft outlook.com microsoft windows 10 version 1607 microsoft windows 10 version 1809 microsoft windows 10 version 21h2 microsoft windows 10 version 22h2 microsoft windows 11 version 23h2 microsoft windows 11 version 24h2 microsoft windows 11 version 25h2 microsoft windows 11 version 26h1 microsoft windows 11 version 26h2 microsoft windows server 2012 r2 microsoft windows server 2012 r2Added 2026-10-13