BaselineWatch
58789 CVEs · 135 in KEV
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in
CVEs known58,789 New, 24 h662 Changed, 24 h849 In KEV135 Public exploit1,592 Match watchlist0

Vulnerabilities

All My stack Known exploited Public exploit Critical (9+) Likely exploited (EPSS ≥ 50%) Changed, 24 h New, 24 h Sort: risk modified published CVSS EPSS
CVECVSSEPSSVendor, productDescriptionModified
CVE-2026-96741 7.2 high 0.00% mlfactory, dsgvo all in one for wp The DSGVO All in one for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Output Buffer Regex Corruption in all versions up to, and including, 5.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable when the administrator has enabled both the 'Google Tag Manager' integration and the 'Replace integration automatically [Beta]' option, and requires the crafted comment to be approved by an administrator. 16 h ago
CVE-2026-85167 6.3 medium 0.00% n8n-io, n8n n8n before 2.35.4 and 2.36.x before 2.36.2 contain a query injection vulnerability in the Elasticsearch Document Get All and Google Cloud Firestore Document Query operations, which build their JSON query by interpolating expression values directly into the query string before parsing. A value containing quote and brace characters can close the intended field and introduce new query operators, turning an intended single-document lookup into a full-collection read. 5 h ago
CVE-2026-117627 5.4 medium 0.00% red hat, red hat build of keycloak, red hat single sign-on 7 A flaw was found in the JWT Authorization Grant implementation of the keycloak-services component. When an OIDC or Google identity provider is configured with specific login restrictions, such as claim filtering, these checks are correctly applied during standard browser logins but are skipped during the JWT-based grant flow. This allows an authenticated client to obtain access tokens for a user even if their identity provider claims should have blocked the login. 20 h ago
CVE-2026-118322 unscored 0.00% no CPE yet Memory corruption in ANGLE in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: High) 12 h ago
CVE-2026-118319 unscored 0.00% no CPE yet Memory corruption in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: High) 12 h ago
CVE-2026-118318 unscored 0.00% no CPE yet Improper access control in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to read memory via a crafted HTML page. (Chromium security severity: High) 12 h ago

6 of 6

Download these 6 as CSV · subscribe to this list.

EPSS scores: 2026-10-29. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.