Prioritize what attackers can use now
Start with critical and known-exploited vulnerabilities, then narrow by vendor, product, weakness, sector signal, and update recency.
CVE Intelligence
CVE Intelligence Workbench
A structured vulnerability intelligence surface for security teams: natural-language CVE discovery, precise filters, affected products, CVSS/CWE context, KEV signals, source attribution, and Glexia's expert analysis where available.
Published CVEs only
Searchable vulnerability context without the noise
The public library indexes published CVE records from the official CVE List V5 source. Natural-language discovery and precise filters work together so every displayed result stays grounded in published records.
- 361,489
- Published records
- Official CVE List V5 records indexed for public search
- 21,367
- Critical severity
- 1,652
- Known exploited
- 360,484
- Glexia takes
Review KEV CVEs
Use the official record, not copied article text
Every page links back to CVE List V5 source data and exposes official record downloads when the source payload is available.
Pivot from CVEs and CWEs into ATT&CK behavior
Use the ATT&CK reference to review likely behavior context, telemetry, and mitigations without treating inferred lookups as official mappings.
Read source-backed analysis with clear review status
Long-tail automation is labelled explicitly; named human review appears only when the review hash matches the source version currently shown.
Recently updated CVEs
- CVE-2026-16897Medium
- CVE-2026-16894Critical
- CVE-2026-16891Low
Critical records
CISA KEV signal
Most viewed in 30 days
Trending view data will appear after public CVE detail traffic is recorded.
Official CVE downloads
Official CVE source files, separated by update type.
Search and detail pages stay grounded in published CVE List V5 records. Download the latest full baseline, the latest hourly differential, and the delta log when source files are available.
Download manifestSource file 01Full baseline
Latest full CVE List V5 baseline
Daily all_CVEs_at_midnight ZIP from the official cvelistV5 GitHub release.
- Filename
- 2026-08-20_all_CVEs_at_midnight.zip.zip
- Size
- 557 MB
- Updated
- Aug 20, 2026
Source file 02Hourly changes
Latest hourly CVE differential
Hourly delta_CVEs ZIP from the official cvelistV5 GitHub release.
- Filename
- 2026-08-20_delta_CVEs_at_1400Z.zip
- Size
- 2.0 MB
- Updated
- Aug 20, 2026
Source file 03Change log
Rolling CVE delta log
Official cvelistV5 deltaLog.json for recently changed CVE records.
- Filename
- deltaLog.json
- Size
- 19 MB
- Updated
- Aug 20, 2026
Results
361,489 matching CVEs
Every result starts with the official CVE record. Glexia's analysts work across the library to add plain-English context, helping teams understand exposure, urgency, and practical next steps without wading through raw record text.
Showing 1-25 of 361,489 records · Page 1 of 14,460
Key signals
Official summary
Vulnerabilities in IBM AIX and PowerVM VIOS
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to cause a denial of service due to an out-of-bounds write.
Related terms
CWE-369vendor-advisorypatchplatformAIXPowerVM VIOS
CVE-2026-16894Critical
View detailKey signals
Official summary
Vulnerabilities in IBM AIX and PowerVM VIOS
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a stack buffer overflow.
Related terms
CWE-787vendor-advisorypatchplatformAIXPowerVM VIOS
Key signals
Official summary
Vulnerabilities in IBM AIX and PowerVM VIOS
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to obtain sensitive information due to an out-of-bounds read.
Related terms
CWE-125vendor-advisorypatchplatformAIXPowerVM VIOS
Key signals
Official summary
Vulnerabilities in IBM AIX and PowerVM VIOS
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to obtain sensitive information or cause a denial of service due to an integer overflow.
Related terms
CWE-190vendor-advisorypatchplatformAIXPowerVM VIOS
CVE-2026-73388Critical
View detailKey signals
Official summary
WordPress Nikstore Core plugin <= 1.5 - SQL Injection vulnerability
Unauthenticated SQL Injection in Nikstore Core <= 1.5 versions.
Related terms
CWE-89vdb-entryNikstore Core
Key signals
Official summary
Logto: OS command injection vulnerability exists in the Commitlint workflow
Logto is the modern, open-source auth infrastructure for SaaS and AI apps. From 1.40.1 until 1.41.0, Logto's .github/workflows/commitlint.yml directly interpolated github.event.pull_request.title into the Commitlint on PR title step's inline echo command before piping the title to npx commitlint. A pull request title containing a single quote could terminate the echo string and append arbitrary shell commands on the GitHub Actions runner. The pull_request trigger used a read-only GITHUB_TOKEN and did not expose repository secrets, but injected commands could alter or disrupt the ephemeral workflow execution. This issue is fixed in version 1.41.0.
Related terms
CWE-94x_refsource_confirmx_refsource_miscot-icsremote-code-executionlogto
CVE-2026-55089Critical
View detailKey signals
Official summary
Etherpad: JWT `admin` claim presence-only check lets non-admin OAuth users invoke every Etherpad HTTP API endpoint
Etherpad is a real-time collaborative editor. From 2.1.0 until 3.1.0, Etherpad's src/node/handler/APIHandler.ts authorizes requests to /api/2/* in the authorization_code OAuth path by using requiredClaims with the admin claim. This check requires only that the claim exists, while src/node/security/OAuth2Provider.ts issues admin: false for configured non-admin users. A non-admin user with a valid signed token can therefore invoke administrative functions including setHTML, setText, appendText, deletePad, copyPad, movePad, restoreRevision, anonymizeAuthor, listAllPads, and listAuthorsOfPad, allowing disclosure, modification, or deletion of pads across the instance. This issue is fixed in version 3.1.0.
Related terms
CWE-863x_refsource_confirmx_refsource_miscidentityetherpad
Key signals
Official summary
Power System Out-of-bounds Read
IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in partition firmware during network boot. An unauthenticated attacker with access to the same network as a partition undergoing iSCSI SAN network boot can prevent that partition from completing its boot sequence. Other partitions and the managed system are not affected. Only partitions actively performing an iSCSI SAN network boot are affected, resulting in an availability impact.
Related terms
CWE-125vendor-advisorypatchot-icsPowerVM Hypervisor
Key signals
Official summary
logto-tunnel serves files outside --experience-path via path traversal
Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 0.3.9, the Logto Tunnel npm package enabled createStaticFileProxy from packages/tunnel/src/commands/tunnel/index.ts and passed request.url from static asset requests through packages/tunnel/src/commands/tunnel/utils.ts using path.join(staticPath, request.url) and then fs.open(requestPath, "r") without URL normalization or a containment check. When --experience-path was enabled and the tunnel port was reachable, an unauthenticated requester could send a path containing ../ to createStaticFileProxy and read files outside the configured static directory that were readable by the logto-tunnel process. The service used server.listen(port), which could expose the tunnel to other hosts depending on the platform and deployment. This issue is fixed in version 0.3.9.
Related terms
CWE-22x_refsource_confirmx_refsource_miscsupply-chainremote-code-executionlogto
Key signals
Official summary
Power System Out-of-bounds Read
IBM Power Systems Firmware FW950.00 through FW950.H2, OP940.00 through OP940.a1 (Power9), and OP940.00 - OP940.81 (Power HMC) is affected by a vulnerability in host firmware NVRAM parsing. An attacker with root access to a guest partition on an OpenPOWER system can write a specially crafted NVRAM image, causing the host firmware boot stage to crash with possible memory corruption. This condition persists until operator intervention — clearing NVRAM via the service processor — to restore normal operation. This vulnerability only affects OpenPOWER systems; systems running PowerVM are not affected. Successful exploitation results in an integrity and availability impact to the managed system.
Related terms
CWE-125vendor-advisorypatchidentityot-icsPower Systems Firmware
Key signals
Official summary
Power System Integer Overflow
IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the PowerVM hypervisor call interface. An attacker with root access to a guest partition can issue a specially crafted hypervisor call to inject an arbitrary amount of data into hypervisor or partition memory, resulting in either a crash causing a full platform re-IPL and terminating all hosted partitions, or corruption of hypervisor or partition memory. The PowerVM hypervisor will restart automatically; however, repeated exploitation could result in a sustained availability impact. Successful exploitation results in an integrity and availability impact to the managed system.
Related terms
CWE-190vendor-advisorypatchot-icsPowerVM Hypervisor
Key signals
Official summary
Wekan: SSRF filter bypass via DNS-resolving hostname in outgoing webhooks (incomplete fix of CVE-2026-53446)
Wekan is open source kanban built with Meteor. From 8.36 until 9.74, the outgoing webhook Integration URL validator in models/integrations.js checked only the literal URL.hostname against regular expressions, so DNS names such as 169-254-169-254.nip.io passed that first-line check. The delivery path's fetchSafe guard already blocked the reported IPv4 destination, but its separate IPv4-only resolver and duplicated blocklist created inconsistent all-address-family enforcement and drift risk between input-time and connection-time validation. Version 9.74 makes server/lib/ssrfGuard.js resolve all addresses with `dns.lookup({ all: true })`, validate every result through the shared isIpBlocked logic, pin the connection, and block redirects. This issue is fixed in version 9.74.
Related terms
CWE-918x_refsource_confirmx_refsource_miscremote-code-executionwekan
Key signals
Official summary
Vulnerabilities in IBM AIX and PowerVM VIOS
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to obtain sensitive information due to an out-of-bounds read.
Related terms
CWE-125vendor-advisorypatchplatformAIXPowerVM VIOS
Key signals
Official summary
Power System Improper Validation
IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the PowerVM hypervisor call interface. An attacker with root access to a guest partition can issue a specially crafted hypervisor call causing a virtual processor to become permanently unresponsive, requiring a full platform re-IPL to restore normal operation. In some cases this may also cause the guest to inject a small amount of data into hypervisor or partition memory with no attacker control over the target location. Successful exploitation results in an integrity and availability impact to the managed system.
Related terms
CWE-129vendor-advisorypatchidentityot-icsPowerVM Hypervisor
CVE-2026-16882Critical
View detailKey signals
Official summary
Vulnerabilities in IBM AIX and PowerVM VIOS
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.
Related terms
CWE-78vendor-advisorypatchplatformAIXPowerVM VIOS
Key signals
Official summary
Vulnerabilities in IBM AIX and PowerVM VIOS
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated attacker to execute arbitrary code due to a stack-based buffer overflow.
Related terms
CWE-121vendor-advisorypatchplatformAIXPowerVM VIOS
Key signals
Official summary
Wekan: Stored XSS in HTML board exports through a card-title second parse
Wekan is open source kanban built with Meteor. From 8.72 until 10.23, addBoardHTMLToZip() in client/lib/exportHTML.js read a card title and body through textContent, which decoded entity-encoded markup, and then interpolated titleText and allText into content.innerHTML in the exported index.html. A board member could store an entity-encoded event-handler payload in a card title that remained inert on the live board but was reparsed and executed when a recipient clicked the card in the downloaded HTML export, allowing the script to read and transmit all board data contained in that export, including content added after the attacker's membership was removed. Version 10.23 builds the modal with DOM nodes and assigns untrusted values through textContent. This issue is fixed in version 10.23.
Related terms
CWE-79x_refsource_confirmx_refsource_miscremote-code-executionwekan
Key signals
Official summary
Vulnerabilities in IBM AIX and PowerVM VIOS
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to obtain root privileges due to improper enforcement of RBAC authentication roles.
Related terms
CWE-269vendor-advisorypatchidentityot-icsplatformremote-code-executionAIX
Key signals
Official summary
Vulnerabilities in IBM AIX and PowerVM VIOS
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to achieve local privilege escalation due to an out-of-bounds write.
Related terms
CWE-787vendor-advisorypatchplatformAIXPowerVM VIOS
Key signals
Official summary
Power System Out-of-bounds Write
IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 Power Systems Firmware is affected by a vulnerability in partition firmware during network boot. An unauthenticated attacker on the same network as a partition undergoing network boot can send a malformed packet, allowing arbitrary code to be executed in the partition firmware and compromising everything subsequently loaded by that partition. Other partitions and the managed system are not affected. Only partitions actively performing a network boot are affected, resulting in a confidentiality, integrity, and availability impact.
Related terms
CWE-787vendor-advisorypatchot-icsPowerVM Hypervisor
Key signals
Official summary
Logto: ReDoS via unescaped user input in email subaddressing regex (blockSubaddressing)
Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, Logto's email subaddressing blocklist in packages/core/src/libraries/sign-in-experience/email-blocklist-policy.ts used the attacker-controlled domain from email input to construct subaddressingRegex when blockSubaddressing was enabled. The permissive emailRegEx accepted multiple at signs and regular expression metacharacters, and POST /api/experience/verification/verification-code could therefore cause catastrophic backtracking in subaddressingRegex.test(email). The resulting event-loop stall could make authentication, token issuance, SSO, and the administrative console unavailable. This issue is fixed in version 1.41.0.
Related terms
CWE-1333x_refsource_confirmx_refsource_miscidentitysupply-chainremote-code-executionlogto
Key signals
Official summary
Vulnerabilities in IBM AIX and PowerVM VIOS
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary code due to improperly scrubbed environment variables.
Related terms
CWE-426vendor-advisorypatchplatformAIXPowerVM VIOS
Key signals
Official summary
WeKan Board Export REST Endpoints: NULL Pointer Dereference on Invalid authToken Leads to Uncaught Exception / Remote Denial of Service
Wekan is open source kanban built with Meteor. Prior to 10.38, the /api/boards/:boardId/export, /api/boards/:boardId/attachments/:attachmentId/export, /api/boards/:boardId/export/csv, and /api/boards/:boardId/exportExcel handlers in models/export.js and models/exportExcel.js looked up a user from the attacker-controlled authToken query parameter and immediately called user._id.toString() without checking whether ReactiveCache.getUser() returned undefined. A request for a private board with an unknown token therefore threw a TypeError from an asynchronous route, producing an unhandled rejection that could terminate the Wekan process and deny service to all users. Version 10.38 adds a 401 guard after every export token lookup and wraps export handlers with safeRoute() so unexpected exceptions become controlled responses. This issue is fixed in version 10.38.
Related terms
CWE-476x_refsource_confirmx_refsource_miscremote-code-executionwekan
Key signals
Official summary
Vulnerabilities in IBM AIX and PowerVM VIOS
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to an out-of-bounds read.
Related terms
CWE-125vendor-advisorypatchplatformAIXPowerVM VIOS
Key signals
Official summary
Vulnerabilities in IBM AIX and PowerVM VIOS
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to command injection.
Related terms
CWE-78vendor-advisorypatchplatformAIXPowerVM VIOS