Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 3 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 400,985All CVEsplus 19,118 rejected
- 417Last 24 hours2,843 in the last 7 days
- 16,805Last 30 days1,543 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 44 | 95 | 178 | 21 | 0 | 338 | 597 |
| 2025 | 27 | 43 | 90 | 7 | 0 | 167 | 259 |
| 2024 | 20 | 31 | 35 | 0 | 0 | 86 | 92 |
| 2023 | 1 | 4 | 1 | 0 | 0 | 6 | 6 |
| Title | ||
|---|---|---|
| CVE-2026-105454 | Stored XSS via crafted URLs in HTML ticket content in Request TrackerBest Practical Solutions · Request Tracker | Medium5.3 |
| CVE-2026-105455 | Stored XSS via related ticket subject on RTIR Split and Create Incident formsBest Practical Solutions · RT for Incident Response | Medium5.3 |
| CVE-2026-105456 | Stored XSS via HTML scrubber rule in RTIRBest Practical Solutions · RT for Incident Response | Medium5.3 |
| CVE-2026-110972 | Use of Client-Side Authentication in PłatnikZakład Ubezpieczeń Społecznych · Płatnik | High8.6 |
| CVE-2026-110971 | Weak password encoding in PłatnikZakład Ubezpieczeń Społecznych · Płatnik | High7.7 |
| CVE-2026-110970 | Lack of traffic encryption in PłatnikZakład Ubezpieczeń Społecznych · Płatnik | Low2.3 |
| CVE-2025-68395 | Stored XSS in ProtectelARKETEAM · PROTECTELMAJ | Medium5.1 |
| CVE-2025-68394 | SQL Injection in ProtectelARKETEAM · PROTECTELMAJ | High8.4 |
| CVE-2025-68393 | SQL Injection in ProtectelARKETEAM · PROTECTELMAJ | High8.4 |
| CVE-2025-68392 | Incorrect authorization in ProtectelARKETEAM · PROTECTELMAJ | Medium5.1 |
| CVE-2025-68391 | Arbitrary File Upload in ProtectelARKETEAM · PROTECTELMAJ | Medium5.3 |
| CVE-2026-66912 | Stored Cross-Site Scripting in ZimbraSynacor · Zimbra Collaboration | Medium5.3 |
| CVE-2026-66911 | Stored Cross-Site Scripting in ZimbraSynacor · Zimbra Collaboration | Medium5.3 |
| CVE-2026-106036 | Improper certificate validation in SzafirKrajowa Izba Rozliczeniowa · Szafir | Medium6.9 |
| CVE-2026-93571 | Path Traversal in SzafirKrajowa Izba Rozliczeniowa · Szafir | Low2.3 |
| CVE-2026-93570 | XML External Entity injection in Szafir and Szafir WeryfikującaKrajowa Izba Rozliczeniowa · Szafir | High8.2 |
| CVE-2026-105420 | Path Traversal in Wing WFTP Server leading to Remote Code ExecutionWing Soft Technology · Wing FTP Server | Critical9.4 |
| CVE-2026-105987 | Stored XSS in KGS Software tia ViewerKGS Software · tia Viewer | Medium5.1 |
| CVE-2026-107147 | Authentication bypass by spoofing in twofactor_gauthenticatoralexandregz · twofactor_gauthenticator | Medium6.3 |
| CVE-2026-107146 | Insufficient session expiration in twofactor_gauthenticatoralexandregz · twofactor_gauthenticator | Medium6.3 |
| CVE-2026-107145 | Lack of rate-limiting in 2fa code check mechanism in twofactor_gauthenticatoralexandregz · twofactor_gauthenticator | Medium6.3 |
| CVE-2026-77062 | Clickjacking in boneIOboneIO · boneIO | Medium6.9 |
| CVE-2026-77061 | Missing Authentication for Critical Function in boneIOboneIO · boneIO | Medium5.3 |
| CVE-2026-77060 | Incorrect Permission Assignment for Critical Resource in boneIOboneIO · black_debian_images | Medium6.8 |
| CVE-2026-77059 | TOCTOU Race Condition in boneIOboneIO · boneIO | High8.8 |
| CVE-2026-77058 | Cross-Site Request Forgery (CSRF) in boneIOboneIO · boneIO | Medium5.1 |
| CVE-2026-77057 | Improper Restriction of Excessive Authentication Attempts in boneIOboneIO · boneIO | Low2.3 |
| CVE-2026-77056 | Use of Default Credentials in boneIOboneIO · black_debian_images | High7.1 |
| CVE-2026-77055 | Improper Privilege Assignment in boneIOboneIO · black_debian_images | Critical9.3 |
| CVE-2026-77054 | Cleartext Storage of Sensitive Information in boneIOboneIO · boneIO | Medium6.9 |
| CVE-2026-77053 | Missing Authentication in Default Configuration in boneIOboneIO · boneIO | High8.7 |
| CVE-2026-77052 | Missing Authentication for Node-RED in boneIOboneIO · boneIO | High8.7 |
| CVE-2025-58403 | Reflected Cross-Site Scripting (XSS) in CGM CLININETCGM · CGM CLININET | Medium5.1 |
| CVE-2025-30054 | Local Privilege Escalation in CGM CLININETCGM · CGM CLININET | Critical9.3 |
| CVE-2025-30053 | Missing Authentication in CGM CLININETCGM · CGM CLININET | Medium6.9 |
| CVE-2025-30052 | Authentication Bypass via IP Spoofing in CGM CLININET rsyncdCGM · CGM CLININET | High8.8 |
| CVE-2025-30051 | Insecure File Permissions in CGM CLININETCGM · CGM CLININET | Medium6.8 |
| CVE-2025-30050 | Remote Code Execution in CGM CLININETCGM · CGM CLININET | Critical9.4 |
| CVE-2025-30049 | Use of Unsalted MD5 Password Hashes in CGM CLININETCGM · CGM CLININET | High8.2 |
| CVE-2025-30047 | Remote Code Execution via Java Deserialization in CGM CLININETCGM · CGM CLININET | Critical9.4 |
| CVE-2025-30046 | Remote Code Execution in CGM CLININETCGM · CGM CLININET | Critical9.0 |
| CVE-2025-30045 | Code Injection in CGM CLININETCGM · CGM CLININET | High8.6 |
| CVE-2025-30043 | Missing Authentication in CGM CLININETCGM · CGM CLININET | High7.1 |
| CVE-2026-16477 | Insecure Deserialization of .cleanshot Files in CleanShot XMTW · CleanShot X | High8.4 |
| CVE-2026-106030 | Missing Authorization in NordVPN for WindowsNord Security · NordVPN | Medium6.8 |
| CVE-2026-88794 | XML External Entity injection in Sparx Enterprise ArchitectSparx Systems · Enterprise Architect | High8.2 |
| CVE-2026-63315 | Plaintext storage of a password in WebCTISlican · IPx | High8.2 |
| CVE-2026-63314 | SQL Injection in WebCTISlican · IPx | High8.7 |
| CVE-2026-35088 | Inadequate Encryption Strength in Slican telephone exchangesSlican · IPx | High8.2 |
| CVE-2026-63316 | SQL Injection in Payload CMSPayload · Payload CMS | High8.7 |