Vigilbase CVEConnect your agent

Trending CVEs

Ranked by distinct people posting on X, Bluesky, Mastodon and Hacker News, plus new exploit repos. Feed bots excluded.

  1. 1
    ipv4: free inet_opt and ireq_opt after an RCU grace period
    CVE-2026-98432Exploit code9.8
    68 peopleX, Bluesky, GitHub, Hacker News↑ 60
  2. 2
    Google Brotli Unchecked Return Value Vulnerability
    CVE-2026-111497KEVExploit code9.2
    CloudflareLogsFastlyRule
    7 peopleBluesky, X, Hacker News, GitHub↑ 6
  3. 3
    GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability
    CVE-2026-97229KEV10.0
    7 peopleBluesky, X↑ 7
  4. 4
    CSRF in Secure Access Server v14.60
    CVE-2026-977189.4
    5 peopleBluesky, Mastodon, X↑ 5
  5. 5
    PHP Stale Internal Request-State Vulnerability
    CVE-2026-109619KEVExploit code9.2
    CloudflareBlocksAWSRuleFastlyRuleF5Rule
    3 peopleX, GitHub↑ 3
  6. 6
    Ultra Addons for Contact Form 7 <= 3.5.54 - Unauthenticated PHP Object Injection to Arbitrary File Deletion via CF7 Form Field
    CVE-2026-1024359.8
    2 peopleBluesky, X↑ 2
  7. 7
    Joomla Extension - joomlaboat.com - Unauthenticated arbitrary file upload in Custom Tables < 3.7.8
    CVE-2026-1056069.5
    4 peopleBluesky, X↑ 4
  8. 8
    PHP Memory Corruption Vulnerability
    CVE-2026-109618KEV9.2
    CloudflareBlocksAWSRuleFastlyRuleF5Rule
    4 peopleBluesky, X↑ 3
  9. 9
    Langflow OSS is affected by multiple vulnerabilities
    CVE-2026-936809.8
    3 peopleX, Bluesky↑ 3
  10. 10
    Perses: Unvalidated project parameter enables filesystem path traversal
    CVE-2026-634457.1
    3 peopleMastodon, Bluesky, X↑ 3
  11. 11
    SysReptor: Session Fixation in Password-Protected Shared Notes
    CVE-2026-811813.7
    3 peopleBluesky, Mastodon, X↑ 3
  12. 12
    Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability
    CVE-2026-111357KEV7.0
    3 peopleX, Bluesky↑ 3
  13. 13
    Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability
    CVE-2026-118527KEV
    3 peopleX, Bluesky↑ 3
  14. 14
    Full RCE using EasyTimeline Extension
    CVE-2026-88570.0
    3 peopleBluesky, X↑ 3
  15. 15
    Jenkins Project Jenkins Script Security Plugin
    CVE-2026-921228.8
    3 peopleBluesky, X↑ 3
  16. 16
    Authentication bypass with privileged access in Danfoss AK-SM 8xxA Series prior to version 4.2
    CVE-2025-41450Exploit code8.2
    2 peopleX, GitHub↑ 2
  17. 17
    Apple iOS and iPadOS
    CVE-2026-112688Exploit code8.8
    1 personGitHub↑ 1
  18. 18
    Authentication bypass in Secure Access Servers
    CVE-2026-1167699.3
    3 peopleBluesky, Mastodon↑ 3
  19. 19
    Google Chrome
    CVE-2026-1183069.6
    3 peopleBluesky, X↑ 3
  20. 20
    ReadyMedia 1.3.0 - 1.3.3 Stack Buffer Overflow via DFF Parser
    CVE-2026-295088.7
    3 peopleBluesky, Mastodon↑ 3
  21. 21
    Dell Alienware Command Center (AWCC)
    CVE-2026-918988.1
    3 peopleBluesky, Mastodon↑ 3
  22. 22
    Apache Syncope: RCE via ProcessGroovyMethodsSandbox bypass
    CVE-2026-113687
    2 peopleX, Bluesky↑ 2
  23. 23
    Joomla Extension - dj-extensions.com - Unauthenticated SQL injection in DJ-Classifieds < 3.11.3
    CVE-2026-1056049.3
    3 peopleBluesky↑ 3
  24. 24
    Control Web Panel (CWP) < 1.16 OS Command Injection via protected_directory
    CVE-2026-778769.3
    3 peopleX↑ 3
  25. 25
    kaniko can send the build's Azure (Entra ID) access token to lookalike ACR registry hosts
    CVE-2026-1057699.3
    2 peopleX↑ 2
  26. 26
    Topluyo Desktop for Linux has an OS Command Injection issue
    CVE-2026-115904Exploit code9.6
    1 personGitHub↑ 1
  27. 27
    Microsoft Exchange Server Elevation of Privilege Vulnerability
    CVE-2026-62911Exploit code8.0
    F5Rule
    1 personGitHub↑ 1
  28. 28
    Google Chrome
    CVE-2026-1183318.8
    2 peopleBluesky, X↑ 2
  29. 29
    Google Chrome
    CVE-2026-1183448.8
    2 peopleBluesky, X↑ 2
  30. 30
    Google Chrome
    CVE-2026-1183488.8
    2 peopleBluesky, X↑ 2
  31. 31
    Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass Vulnerability
    CVE-2026-20127KEV10.0
    2 peopleBluesky, X↑ 2
  32. 32
    Dell Alienware Command Center (AWCC)
    CVE-2026-918937.8
    2 peopleBluesky, Mastodon↑ 2
  33. 33
    Pillow multi-frame loaders can reuse stale native image storage after mode transitions
    CVE-2026-966399.8
    2 peopleX, Bluesky↑ 2
  34. 34
    Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability
    CVE-2026-104935KEV8.6
    F5Rule
    2 peopleX↑ 2
  35. 35
    Sudo Heap-Based Buffer Overflow Vulnerability
    CVE-2021-3156KEVExploit code7.8
    1 personGitHub↑ 1
  36. 36
    CVE-2023-34634
    CVE-2023-34634Exploit code
    1 personGitHub↑ 1
  37. 37
    Path traversal in copyparty
    CVE-2023-37474Exploit code7.5
    1 personGitHub↑ 1
  38. 38
    Mozilla Firefox
    CVE-2024-4367Exploit code5.6
    1 personGitHub↑ 1
  39. 39
    Gogs Path Traversal Vulnerability
    CVE-2025-8110KEVExploit code8.7
    1 personGitHub↑ 1
  40. 40
    Payload authentication token field handling issue
    CVE-2026-105863Exploit code9.2
    1 personGitHub↑ 1
  41. 41
    Collabora Online – Built-in CODE Server OS Command Injection Vulnerability
    CVE-2026-110447KEVExploit code9.2
    1 personGitHub↑ 1
  42. 42
    sf-mcp through 1.3.2 OS Command Injection via Salesforce CLI Flag Values
    CVE-2026-117561Exploit code8.5
    1 personGitHub↑ 1
  43. 43
    Product Gallery Slider for WooCommerce 2.3.23 before 2.3.26 Missing Authorization via Codestar AJAX
    CVE-2026-120318Exploit code8.6
    1 personGitHub↑ 1
  44. 44
    Cost Calculator Builder PRO <= 4.0.3 - Unauthenticated Remote Code Execution via 'orderDetails' Parameter
    CVE-2026-14900Exploit code9.8
    1 personGitHub↑ 1
  45. 45
    gRPC-Go has an authorization bypass via missing leading slash in :path
    CVE-2026-33186Exploit code9.1
    1 personGitHub↑ 1
  46. 46
    NGINX ngx_http_rewrite_module vulnerability
    CVE-2026-42945Exploit code9.2
    CloudflareBlocksF5Rule
    1 personGitHub↑ 1
  47. 47
    Widget Factory Joomla Content Editor Improper Access Control Vulnerability
    CVE-2026-48907KEVExploit code10.0
    F5Rule
    1 personGitHub↑ 1
  48. 48
    net: phonet: free phonet_device after RCU grace period
    CVE-2026-53157Exploit code
    1 personGitHub↑ 1
  49. 49
    Remote Desktop Protocol Remote Code Execution Vulnerability
    CVE-2026-56190Exploit code9.8
    1 personGitHub↑ 1
  50. 50
    WordPress Core SQL Injection Vulnerability
    CVE-2026-60137KEVExploit code5.9
    CloudflareBlocksF5Rule
    1 personGitHub↑ 1

Score: people × 3 + damped engagement + 4 per exploit repo + 2 per platform. Authors naming 12+ CVEs count as bots. JSON