01 Search console

The CVE corpus, on scope in milliseconds.

407,350 records · updated every 15 minutes

02 Telemetry

Total CVEs407,350

New today23

Known-exploited (KEV)1,740

Sync lag19 MIN

03 Severity mix

04 Latest published

CVE IDCVSSSeverityKEVSummaryVendor / ProductPublished

CVE-2026-147657.7High—7.7HighEpic Games Unreal Engine Insecure Default URL Scheme Allowance in LaunchURLepic games unreal engine29 MIN AGO

CVE-2026-1104479.2Critical—9.2CriticalCollabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a differentcollabora collabora online - built-in code server33 MIN AGO

CVE-2026-1034227.2High—7.2HighAnyComment <= 0.3.6 - Unauthenticated Stored Cross-Site Scripting via 'email' Parameterateshabaev anycomment33 MIN AGO

CVE-2026-976579.8Critical—9.8CriticalAbandoned Cart Pro for WooCommerce <= 10.8.0 - Unauthenticated Authentication Bypass via Malleable Encryption and Bypassable HMAC via Recovery Link 'validate' Parametertyche softwares abandoned cart pro for woocommerce33 MIN AGO

CVE-2026-1022517.5High—7.5HighAbandoned Cart Pro for WooCommerce <= 10.8.0 - Unauthenticated SQL Injection via AES-CTR Ciphertext Forgery in 'validate' Parametertyche softwares abandoned cart pro for woocommerce33 MIN AGO

CVE-2026-976689.8Critical—9.8CriticalAbandoned Cart Pro for WooCommerce <= 10.8.0 - Unauthenticated SQL Injection via Guest Persistent Cart meta_valuetyche softwares abandoned cart pro for woocommerce33 MIN AGO

CVE-2026-1100029.8Critical—9.8CriticalSnazzy Social Media Feed <= 2.5 - Unauthenticated Arbitrary File Upload via 'pluginURL' Parametersnazzyplugins snazzy social media feed33 MIN AGO

CVE-2026-827157.9High—7.9HighInsecure Temporary File Vulnerability in Hitachi Disk Array Driver for AIX, Hitachi Disk Array Driver for Virtual I/O Serverhitachi hitachi disk array driver for aix hitachi hitachi disk array driver for virtual i/o server1 HR AGO

CVE-2026-865735.1Medium—5.1MediumOut-of-bounds Write Vulnerability in Hitachi Disk Array Driver for AIX, Hitachi Disk Array Driver for Virtual I/O Serverhitachi hitachi disk array driver for aix hitachi hitachi disk array driver for virtual i/o server1 HR AGO

CVE-2026-866074.3Medium—4.3MediumInternal Application Information Exposure Vulnerability in Hitachi Ops Center Administratorhitachi hitachi ops center administrator1 HR AGO

CVE-2026-1103929.8Critical—9.8CriticalSamsung QA-Board — Unauthenticated OS command injection via output redo/tuningsamsung open source qa-board1 HR AGO

CVE-2026-920979.1Critical—9.1CriticalClick to Chat <= 4.44 - Unauthenticated Arbitrary Shortcode Execution via REQUEST_URI via {url} Placeholderholithemes click to chat – holithemes1 HR AGO

CVE-2026-170928.1High—8.1HighDirectorist: AI-Powered Business Directory, Listings & Classified Ads <= 8.10.2.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Listing Deletion via 'listing_id' Parameterwpwax directorist: ai-powered business directory, listings & classified ads1 HR AGO

CVE-2026-1049958.1High—8.1HighBP Profile Search <= 5.9 - Unauthenticated Local File Inclusion to Remote Code Execution via 'bps_directory' Cookie 'ajax_template' Valuedontdream bp profile search1 HR AGO

CVE-2026-1047677.5High—7.5HighMembership & User Roles for WooCommerce (Automatic Role Changer) <= 20260828 - Authenticated (Subscriber+) Privilege Escalation to Stale Foreign Role Cachedavefx membership & user roles for woocommerce (automatic role changer)1 HR AGO

View all 407,350 records

05 Recently added to KEV

KEVCVE-2026-104935ivanti connect secureAdded 2026-10-13

KEVCVE-2023-22894Strapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter. The attacker can filter users by columns that containAdded 2026-10-08

KEVCVE-2021-3199Directory traversal with remote code execution can occur in /upload in ONLYOFFICE Document Server before 5.6.3, when JWT is used, via a /.. sequence in an image upload parameter.Added 2026-10-08

KEVCVE-2016-3081Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related toAdded 2026-10-08

KEVCVE-2015-5477named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via TKEY queries.Added 2026-10-08

KEVCVE-2015-3306The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.Added 2026-10-08