01 Search console

The CVE corpus, on scope in milliseconds.

416,276 records · updated every 15 minutes

02 Telemetry

Total CVEs416,276

New today12

Known-exploited (KEV)1,762

Sync lag20 MIN

03 Severity mix

04 Latest published

CVE IDCVSSSeverityKEVSummaryVendor / ProductPublished

CVE-2026-1134094.8Medium—4.8MediumThe Ortto plugin for WordPress before 1.0.25 did not escape stored settings on its admin settings page, leading to stored cross-site scripting. A threat actor able to modify the plugin's configurationcanva ortto38 MIN AGO

CVE-2026-1141735.3Medium—5.3MediumThe Ortto plugin for WordPress before 1.0.25 did not filter the WooCommerce product data it embedded in public storefront pages. An unauthenticated threat actor could read product passwords andcanva ortto39 MIN AGO

CVE-2026-1133878.6High—8.6HighThe Ortto plugin for WordPress before 1.0.25 did not authenticate configuration update requests, relying only on a secret exposed in public HTML. An unauthenticated threat actor could overwrite thecanva ortto41 MIN AGO

CVE-2026-660924.8Medium—4.8MediumStored XSS in pre-login notice via reachable legacy logon routeapereo foundation openequella42 MIN AGO

CVE-2026-660916.9Medium—6.9MediumUnauthenticated IDOR Enables Disclosure of Other Users’ last-known detailsapereo foundation openequella43 MIN AGO

CVE-2026-660907.1High—7.1HighXML External Entity (XXE) Injection in Metadata Field Allows Arbitrary File Readapereo foundation openequella44 MIN AGO

CVE-2026-660896.1Medium—6.1MediumXML External Entity (XXE) Vulnerability in SOAP Interface Allows External Entity Expansionapereo foundation openequella45 MIN AGO

CVE-2026-660889.4Critical—9.4CriticalUnrestricted Command Execution via system.executeapereo foundation openequella46 MIN AGO

CVE-2026-168894.8Medium—4.8MediumStored XSS via Pre-Login Notice Image Upload Serves Attacker HTML from Application Originapereo foundation openequella49 MIN AGO

CVE-2026-211578.3High—8.3HighImproper input validation in Bixby prior to version 4.0.85.6 allows privileged local attackers to launch arbitrary activity.samsung mobile bixby1 HR AGO

CVE-2026-113957—Unrated——UnratedAn attacker who controls the registry, a mirror, or the network path to it may be able to serve arbitrary image content in response to a pull by digest, so that a user runs an image other than the oneapple container apple containerization2 HR AGO

CVE-2026-1185906.9Medium—6.9Mediumnipy nibabel Header volumeutils.py array_from_file memory allocationnipy nibabel2 HR AGO

CVE-2026-1185896.9Medium—6.9Mediumnschloe meshio VTK Reader _vtk_42.py memory allocationnschloe meshio2 HR AGO

CVE-2026-1185866.9Medium—6.9Mediumdfm feedfinder2 feedfinder2.py find_feeds server-side request forgerydfm feedfinder22 HR AGO

CVE-2026-1185855.1Medium—5.1Mediumconfiguroweb inventariobasico Add Product addlist.php cross site scriptingconfiguroweb inventariobasico3 HR AGO

View all 416,276 records

05 Recently added to KEV

KEVCVE-2026-46300linux linuxAdded 2026-10-28

KEVCVE-2026-41709vmware cloud foundation vmware esx vmware telco cloud platform vmware vsphere foundationAdded 2026-10-28

KEVCVE-2026-48356adobe adobe commerce adobe adobe commerce b2b adobe adobe commerce events adobe magento open sourceAdded 2026-10-27

KEVCVE-2026-111497google brotliAdded 2026-10-27

KEVCVE-2026-109619php group phpAdded 2026-10-26

KEVCVE-2026-109618php group phpAdded 2026-10-26