Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 10 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 399,135All CVEsplus 18,861 rejected
- 322Last 24 hours3,391 in the last 7 days
- 16,560Last 30 days1,492 of them critical
- 0Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 9,960 | 35,979 | 35,135 | 3,424 | 5,759 | 90,257 | 399,135 |
| 2025 | 4,111 | 15,769 | 23,783 | 1,591 | 2,897 | 48,151 | 308,878 |
| 2024 | 3,797 | 14,237 | 20,400 | 1,473 | 17 | 39,924 | 260,727 |
| 2023 | 3,449 | 10,002 | 13,984 | 1,407 | 5 | 28,847 | 220,803 |
| 2022 | 3,784 | 9,612 | 10,564 | 1,035 | 4 | 24,999 | 191,956 |
| 2021 | 2,539 | 8,322 | 8,645 | 671 | 0 | 20,177 | 166,957 |
| 2020 | 2,641 | 7,534 | 7,664 | 524 | 0 | 18,363 | 146,780 |
| 2019 | 2,561 | 7,062 | 7,310 | 375 | 0 | 17,308 | 128,417 |
| 2018 | 2,530 | 7,395 | 6,336 | 249 | 0 | 16,510 | 111,109 |
| 2017 | 2,116 | 6,601 | 5,690 | 235 | 0 | 14,642 | 94,599 |
| 2016 | 883 | 2,905 | 2,448 | 221 | 0 | 6,457 | 79,957 |
| 2015 | 51 | 2,352 | 3,503 | 588 | 0 | 6,494 | 73,500 |
| 2014 | 27 | 1,926 | 5,318 | 657 | 0 | 7,928 | 67,006 |
| 2013 | 22 | 1,736 | 2,913 | 516 | 0 | 5,187 | 59,078 |
| 2012 | 25 | 1,720 | 3,035 | 508 | 0 | 5,288 | 53,891 |
| 2011 | 4 | 1,785 | 2,101 | 260 | 0 | 4,150 | 48,603 |
| 2010 | 27 | 2,093 | 2,241 | 278 | 0 | 4,639 | 44,453 |
| 2009 | 15 | 2,734 | 2,786 | 197 | 0 | 5,732 | 39,814 |
| 2008 | 19 | 2,854 | 2,613 | 187 | 0 | 5,673 | 34,082 |
| 2007 | 22 | 3,446 | 3,478 | 265 | 0 | 7,211 | 28,409 |
| 2006 | 12 | 2,828 | 3,491 | 554 | 0 | 6,885 | 21,198 |
| 2005 | 26 | 2,594 | 3,498 | 590 | 0 | 6,708 | 14,313 |
| 2004 | 6 | 829 | 630 | 147 | 0 | 1,612 | 7,605 |
| 2003 | 11 | 638 | 501 | 73 | 0 | 1,223 | 5,993 |
| 2002 | 8 | 862 | 705 | 115 | 0 | 1,690 | 4,770 |
| 2001 | 6 | 594 | 578 | 145 | 0 | 1,323 | 3,080 |
| 2000 | 2 | 715 | 564 | 156 | 0 | 1,437 | 1,757 |
| 1999 | 3 | 172 | 121 | 24 | 0 | 320 | 320 |
| Title | ||
|---|---|---|
| CVE-2026-120067 | psqlODBC stack buffer overflow copying ctid and oid values for updatable cursorsPostgreSQL · psqlODBC | Medium5.9 |
| CVE-2026-120066 | psqlODBC log files are created with default permissions at a predictable path and follow symbolic linksPostgreSQL · psqlODBC | Medium5.3 |
| CVE-2026-120065 | psqlODBC does not escape a server-supplied column name in its updatable-cursor queriesPostgreSQL · psqlODBC | High7.1 |
| CVE-2026-120064 | psqlODBC does not validate column numbers and row indexes in binding and descriptor functionsPostgreSQL · psqlODBC | High7.5 |
| CVE-2026-120063 | psqlODBC stack buffer overflow when quoting long schema and table namesPostgreSQL · psqlODBC | Medium5.9 |
| CVE-2026-120062 | psqlODBC SQL injection through SQLSpecialColumns table and schema namesPostgreSQL · psqlODBC | High7.5 |
| CVE-2026-120061 | psqlODBC ODBC escape parser stack buffer overflowPostgreSQL · psqlODBC | High7.5 |
| CVE-2026-120060 | psqlODBC does not validate server-supplied counts and lengthsPostgreSQL · psqlODBC | Medium5.9 |
| CVE-2026-120059 | psqlODBC uses a server-supplied column name as a format stringPostgreSQL · psqlODBC | Medium6.8 |
| CVE-2026-120058 | psqlODBC row cache overflow when a later FETCH changes the column countPostgreSQL · psqlODBC | High7.5 |
| CVE-2026-120057 | psqlODBC large-object read overflows the application bufferPostgreSQL · psqlODBC | High7.5 |
| CVE-2026-120497 | Stored cross-site scripting in the HTML report generator of aidlc-traceability in AWS AI-DLC WorkflowsAWS · aidlc-traceability | Medium4.6 |
| CVE-2026-119736 | Attendo Admin Android 3.0.13 Hard-coded MQTT Broker CredentialsPetpooja · Munshi | High8.8 |
| CVE-2026-105606 | Joomla Extension - joomlaboat.com - Unauthenticated arbitrary file upload in Custom Tables < 3.7.8joomlaboat.com · Custom Tables extension for Joomla | Critical9.5 |
| CVE-2026-119735 | Munshi XSS via Purchase Inquiry Thread RenderingPetpooja · Munshi | Medium5.1 |
| CVE-2026-119734 | Munshi IDOR via Purchase Inquiry Thread EndpointPetpooja · Munshi | High7.1 |
| CVE-2026-119733 | Munshi Missing Authorization in Company Deletion APIPetpooja · Munshi | High7.2 |
| CVE-2026-119732 | Munshi Broken Object Level Authorization via Invoice Deletion APIPetpooja · Munshi | High7.1 |
| CVE-2026-119731 | Munshi Payment Bypass via Unauthenticated Webhook EndpointPetpooja · Munshi | High8.7 |
| CVE-2026-120656 | CVE-2026-120656OpenKruise · kruise-manager | Not scored |
| CVE-2026-105605 | Joomla Extension - dj-extensions.com - IDOR vulnerability allowing cross-account ad access in DJ-Classifieds < 3.11.3dj-extensions.com · DJ-Classifieds extension for Joomla | Medium5.3 |
| CVE-2026-105604 | Joomla Extension - dj-extensions.com - Unauthenticated SQL injection in DJ-Classifieds < 3.11.3dj-extensions.com · DJ-Classifieds extension for Joomla | Critical9.3 |
| CVE-2026-105603 | Joomla Extension - dj-extensions.com - Authenticated arbitrary file upload in DJ-Classifieds < 3.11.3dj-extensions.com · DJ-Classifieds extension for Joomla | Critical9.4 |
| CVE-2026-81938 | Arbitrary file read via Alertmanager receiver configuration in Grafana MimirGrafana · Enterprise Metrics (GEM) | High7.7 |
| CVE-2026-120416 | AndyFactory newspaper4k Image Extractor image_extractor.py Article.parse server-side request forgeryAndyFactory · newspaper4k | Medium6.9 |
| CVE-2026-111048 | FOSSBilling: Low-privileged staff can run JavaScript in administrators' browsers via stored XSS in support ticket notesFOSSBilling · FOSSBilling | High8.4 |
| CVE-2026-119085 | Template injection in the publishing component of awslabs Virtual Engineering WorkbenchAWS · virtual-engineering-workbench | Critical9.4 |
| CVE-2026-120630 | CVE-2026-120630CrewAI · CrewAI | Not scored |
| CVE-2024-12139 | Content Spoofing via Error Handling in Multiple WSO2 Products Enables Social Engineering AttacksWSO2 · WSO2 API Manager | Medium4.3 |
| CVE-2026-120627 | CVE-2026-120627Private Internet Access · Firefox extension | Not scored |
| CVE-2026-120596 | CVE-2026-120596Ethernut / egnite GmbH · Nut/Net TCP/IP Stack | High7.5 |
| CVE-2026-65059 | Furl versions through 3.15 for Perl allow memory exhaustion via unbounded decompression of HTTP responsesFurl | Not scored |
| CVE-2026-105769 | kaniko can send the build's Azure (Entra ID) access token to lookalike ACR registry hostschainguard · kaniko | Critical9.3 |
| CVE-2026-88811 | Rancher credentials disclosed to third-party hosts by the Rancher Manager meta proxySUSE · Rancher | Critical9.1 |
| CVE-2026-119301 | Improper neutralization of quoting syntax in Apache Iceberg SQL identifier generation in AWS SDK for pandasAWS · aws-sdk-pandas | Medium5.0 |
| CVE-2026-88810 | Privilege escalation in downstream clusters via GlobalRole inheritedNamespacedRulesSUSE · Rancher | High7.2 |
| CVE-2026-99242 | ntfs: fix race between fallocate and mmap readsLinux · Linux | Not scored |
| CVE-2026-99241 | ntfs: take invalidate_lock in ntfs_filemap_page_mkwrite()Linux · Linux | Not scored |
| CVE-2026-99240 | mm/damon/core: error damos_commit_quota_goal() for zero target_valueLinux · Linux | Not scored |
| CVE-2026-99239 | Bluetooth: L2CAP: refuse __l2cap_chan_add if chan already has connLinux · Linux | High7.8 |
| CVE-2026-99238 | tracing: Hold trace_types_lock when updating modules in persistent instancesLinux · Linux | High7.8 |
| CVE-2026-99237 | tracing: Hold trace_types_lock when resetting last boot data from readersLinux · Linux | High7.8 |
| CVE-2026-99236 | tracing: Reject incomplete event filter expressionsLinux · Linux | High7.8 |
| CVE-2026-99235 | tracing: Save the event file instead of the compatible histogramLinux · Linux | High7.8 |
| CVE-2026-99234 | tracing: Unregister field variable histograms when the command failsLinux · Linux | Not scored |
| CVE-2026-99233 | tracing/histograms: Verify event_call identity when updating synth_event refcountLinux · Linux | High7.8 |
| CVE-2026-99232 | tracing/syscalls: Use copy_from_user for the faultable syscall bufferLinux · Linux | Not scored |
| CVE-2026-99231 | io_uring/waitid: own the request before clearing ->headLinux · Linux | High7.8 |
| CVE-2026-99230 | io_uring/cmd: don't leave list poison in ->hash_nodeLinux · Linux | Not scored |
| CVE-2026-99229 | io_uring/wait: don't spin on a stuck overflow listLinux · Linux | Not scored |