Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 10 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,151All CVEsplus 19,119 rejected
- 489Last 24 hours2,788 in the last 7 days
- 16,900Last 30 days1,554 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 21 | 89 | 137 | 3 | 0 | 250 | 250 |
| Title | ||
|---|---|---|
| CVE-2026-123660 | Vulnerability-Lookup: memory amplification through webhook payload template format specifiersvulnerability-lookup · vulnerability-lookup | Medium5.3 |
| CVE-2026-119682 | Improper Access Control in Multi-Factor Authentication (MFA) Functionality in ManageEngine SharePoint Manager PlusManageEngine · SharePoint Manager Plus | High7.9 |
| CVE-2026-119680 | Stored Cross-Site Scripting (XSS) in SharePoint Manager Plus Chart FeatureManageEngine · SharePoint Manager Plus | High8.5 |
| CVE-2026-118173 | MISP Guard Incomplete Tag Validation Allows Non-Allowed Taxonomy Tags to Bypass Feed Policy EnforcementMISP · misp-guard | Medium6.1 |
| CVE-2026-116469 | MISP Guard Case-Sensitive Policy Bypass Allows Unauthorized Feed Data ForwardingMISP · misp-guard | High7.1 |
| CVE-2026-116372 | MISP mispguard: Feed responses with 2xx status codes other than 200 bypass filtering rulesMISP · misp-guard | High7.7 |
| CVE-2026-112991 | MISP html_to_markdown Module SSRF via Incomplete IP Range Blocking in is_safe_url()MISP · misp-modules | Medium6.3 |
| CVE-2026-112192 | MISP Module Settings Expose Redacted Values and Allow API Modification of CLI-Only SettingsMISP · MISP | Medium5.3 |
| CVE-2026-112188 | MISP Server Settings Lookup Exposes Sensitive Configuration Data via Branch Name ResolutionMISP · MISP | High7.1 |
| CVE-2026-112184 | MISP Workflow Module: Reflected XSS via Unescaped misp-modules Parameter Names in Form LabelsMISP · MISP | Medium4.8 |
| CVE-2026-112183 | MISP CSS Injection via Remote Tag Colour in Event PreviewMISP · MISP | Medium4.8 |
| CVE-2026-112180 | MISP Incomplete Event Deletion Leaves Orphaned Sensitive RecordsMISP · MISP | Medium5.1 |
| CVE-2026-112179 | MISP Event Synchronization Exposes Non-Exportable Tags on Remote InstancesMISP · MISP | Medium5.3 |
| CVE-2026-112178 | MISP Proposal ACL Bypass: Incomplete Distribution Level Check in Shadow Attribute Access ControlMISP · MISP | High7.1 |
| CVE-2026-111458 | ssldump Heap Buffer Overflow in FAN/1 X.509 Fingerprint Formattingadulau · ssldump | Medium6.8 |
| CVE-2026-107278 | MISP Object Sync Drops Objects and Attributes When Description Is EmptyMISP · MISP | Medium5.3 |
| CVE-2026-107276 | MISP Email OTP Race Condition Allows One-Time Password to Be Consumed by Multiple Concurrent RequestsMISP · MISP | Medium6.3 |
| CVE-2026-107180 | MISP: Forced TOTP Enrolment Bypassed via Non-Browser Request Types on otp_required InstancesMISP · MISP | High7.1 |
| CVE-2026-107175 | MISP Correlation Engine Fails to Refresh When Event Distribution or Sharing Group ChangesMISP · MISP | Medium5.3 |
| CVE-2026-106513 | MISP: Site-Admin Can Repoint Redis Workers to Attacker-Controlled Server via UI/API Configuration ChangeMISP · MISP | Medium6.9 |
| CVE-2026-106512 | MISP sachertortephp - CakeResponse::download() HTTP Response Splitting via Unsanitized Filename Enables Stored XSSMISP · sachertortephp | High8.4 |
| CVE-2026-104914 | MISP: Soft-Deleted Attributes from Other Organizations Exposed via Attribute Search and Paginated ViewMISP · MISP | Medium5.3 |
| CVE-2026-104912 | MISP Correlation Authorization Bypass Exposes Restricted Event and Attribute DataMISP · MISP | High7.1 |
| CVE-2026-104910 | MISP Information Disclosure via Related Events Listing Bypassing Per-Event AuthorizationMISP · MISP | Medium5.3 |
| CVE-2026-104908 | MISP Decaying Model Import Mass Assignment Allows Cross-Organization Model Overwrite and Default FlaggingMISP · MISP | High7.1 |
| CVE-2026-104907 | MISP: JavaScript Injection via Remote Tag ID in Event Preview Inline HandlerMISP · MISP | Medium4.8 |
| CVE-2026-104906 | MISP TAXII Object Viewer Stored XSS via Unescaped JSON OutputMISP · MISP | Medium6.2 |
| CVE-2026-104901 | MISP ID Translator: Unescaped Remote Event ID Enables Cross-Site Scripting via Linked ServerMISP · MISP | Medium5.1 |
| CVE-2026-104900 | MISP Stored XSS via Unescaped Count Field Value in Remote Event Preview IndexMISP · MISP | Medium5.3 |
| CVE-2026-103858 | MISP Incomplete Thread Authorization Allows Unauthorized Read and Post Access to DiscussionsMISP · MISP | Medium5.3 |
| CVE-2026-103664 | MISP Reflected Cross-Site Scripting via Unsanitized Analyst Data Seed ParameterMISP · MISP | Medium4.8 |
| CVE-2026-103662 | MISP Reflected XSS in Taxonomy Tag Confirmation FormsMISP · MISP | Medium5.1 |
| CVE-2026-103659 | MISP: Object Distribution ACL Bypass via Event Flattening Exposes Organisation-Only AttributesMISP · MISP | High7.1 |
| CVE-2026-103655 | MISP TOTP Code Replay Allows Duplicate Authentication Within Validity PeriodMISP · MISP | Critical9.3 |
| CVE-2026-103651 | MISP HOTP Token Replay via Stale Session-Cached Counter Allows Second-Factor Authentication BypassMISP · MISP | High7.6 |
| CVE-2026-103389 | MISP Stored Cross-Site Scripting via Unvalidated Galaxy Icon Field in Correlation GraphMISP · MISP | Medium6.2 |
| CVE-2026-103388 | MISP Stored Cross-Site Scripting via JavaScript URL in Galaxy Cluster Source FieldMISP · MISP | Medium6.2 |
| CVE-2026-103321 | MISP Stored Cross-Site Scripting (XSS) via Unvalidated Event Graph Preview ImageMISP · MISP | High8.3 |
| CVE-2026-103239 | MISP Tag Collection Save Allows Privilege Escalation via Sibling Model InjectionMISP · MISP | High8.6 |
| CVE-2026-103237 | MISP: Nested Model Alias Key Bypasses Sanitization to Modify Cross-Tenant RowsMISP · MISP | High8.3 |
| CVE-2026-103235 | MISP Event Delegation Mass Assignment Allows Retargeting Delegation to Arbitrary EventsMISP · MISP | High8.7 |
| CVE-2026-101041 | Vulnerability-Lookup - Race Condition in Account Recovery Token Consumption Allows Password Takeovervulnerability-lookup · vulnerability-lookup | Medium6.3 |
| CVE-2026-100190 | Stored Cross-Site Scripting (XSS) via Crawler Capture Import in AIL Framework showDomain Pageail project · ail framework | Medium6.3 |
| CVE-2026-100187 | AIL Framework Onion Module: Non-Onion URL Accepted as Crawler Task Due to Bypassed Domain Validationail project · ail framework | Medium6.9 |
| CVE-2026-100177 | Ail Framework Crawler: Missing Cookiejar Authorization Check Allows Cross-Organization Cookiejar Attachmentail project · ail framework | Medium6.3 |
| CVE-2026-100176 | Stored Cross-Site Scripting (XSS) in AIL Framework Username Timeline Tooltipail project · ail framework | High8.5 |
| CVE-2026-100174 | Stored Cross-Site Scripting (XSS) in AIL Framework Tag Selector via Unescaped Tag Namesail project · ail framework | Medium5.1 |
| CVE-2026-100172 | Stored XSS in AIL Framework extracted-match popovers via unescaped dynamic values in HTML-enabled data-content attributesail project · ail framework | High8.5 |
| CVE-2026-97898 | Broken authorization in Akia keyless entry lets an authenticated guest unlock other roomsakia · akia | High8.4 |
| CVE-2026-97863 | misp-modules: Shell Command Injection in MISP cisco_firesight_manager_ACL_rule_export Module via Unescaped Attribute Valuesmisp · misp-modules | Medium6.3 |