Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 3 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 400,441All CVEsplus 18,890 rejected
- 414Last 24 hours3,028 in the last 7 days
- 17,387Last 30 days1,594 of them critical
- 1,767Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 115 | 139 | 76 | 15 | 76 | 421 | 468 |
| 2025 | 10 | 14 | 23 | 0 | 0 | 47 | 47 |
| Title | ||
|---|---|---|
| CVE-2026-121009 | SQL::Abstract versions from 1.90_01 before 2.000001_04 for Perl skip the injection_guard check for function names given with -funcSQL-Abstract | Not scored |
| CVE-2026-121008 | SQL::Abstract::Tree versions before 2.000001_04 for Perl allow cross-site scripting via unescaped SQL text and bind values in the html profileSQL-Abstract | Not scored |
| CVE-2026-121007 | SQL::Abstract versions from 1.90_01 before 2.000001_04 for Perl allow SQL injection via the where values of a nested statement in an identifier positionSQL-Abstract | Not scored |
| CVE-2026-114627 | Web::Simple versions before 0.036 for Perl do not escape values interpolated into double-quoted strings in HTML::Tags outputWeb-Simple | Not scored |
| CVE-2026-121632 | Data::MuForm versions through 0.05 for Perl render attribute values and option labels into HTML without escapingData-MuForm | Not scored |
| CVE-2026-120651 | CGI versions before 5.00 for Perl allow an infinite loop on a short request body when $DISABLE_UPLOADS is setCGI | Not scored |
| CVE-2026-120650 | CGI versions before 5.00 for Perl allow memory, CPU and disk exhaustion via missing or unenforced request size, parameter and upload limitsCGI | Not scored |
| CVE-2026-120648 | CGI versions before 5.00 for Perl allow HTML injection via text containing --> in commentCGI | Not scored |
| CVE-2026-120647 | CGI versions before 5.00 for Perl allow Content-Disposition parameter injection via unescaped double quotes in the header attachment filenameCGI | Not scored |
| CVE-2026-120646 | CGI versions from 4.71 before 5.00 for Perl allow denial of service via a plain string dereferenced as a symbolic reference in uploadInfoCGI | Not scored |
| CVE-2026-120645 | CGI versions before 5.00 for Perl allow denial of service via submitted values used as a regex for optgroup selection in scrolling_listCGI | Not scored |
| CVE-2026-120644 | CGI::Cookie versions before 5.00 for Perl allow cookie attribute injection via unvalidated path, domain and expires valuesCGI | Not scored |
| CVE-2026-120643 | CGI versions from 4.62 before 5.00 for Perl allow cross-site scripting via a raw apostrophe in URLs returned by url and self_urlCGI | Not scored |
| CVE-2026-120642 | CGI versions before 5.00 for Perl return request-derived values untainted under taint modeCGI | Not scored |
| CVE-2026-120641 | CGI versions before 5.00 for Perl return upload filenames with any client-supplied path, including ../ and Windows pathsCGI | Not scored |
| CVE-2026-120640 | CGI versions before 5.00 for Perl allow the POSTDATA, PUTDATA, PATCHDATA and XForms:Model parameters to be set from the query string or form fieldsCGI | Not scored |
| CVE-2026-120639 | CGI versions before 5.00 for Perl allow HTTP header injection via entity decoding after the newline check in header and unchecked values in multipart_start and do_pushCGI | Not scored |
| CVE-2026-120638 | CGI versions before 5.00 for Perl allow open redirects via HTML entity decoding of the URL after application validation in redirectCGI | Not scored |
| CVE-2026-120637 | CGI versions before 5.00 for Perl take request parameters from the process command line arguments for an unrecognised REQUEST_METHODCGI | Not scored |
| CVE-2026-120636 | CGI versions before 5.00 for Perl allow open redirects and script injection via URLs built from REQUEST_URI in url and start_formCGI | Not scored |
| CVE-2026-120635 | CGI versions before 5.00 for Perl allow form fields to be smuggled past proxies and WAFs via multipart parsing that differs from the RFCsCGI | Not scored |
| CVE-2026-120634 | CGI::Carp versions before 5.00 for Perl leak warnings across requests in persistent environments via the warningsToBrowser bufferCGI | Not scored |
| CVE-2026-120633 | CGI versions before 5.00 for Perl trust the client X-Forwarded-Host header in url, self_url, virtual_host and virtual_portCGI | Not scored |
| CVE-2026-120632 | CGI versions before 5.00 for Perl allow CPU exhaustion via a backtracking regex on the XForms multipart/related Content-TypeCGI | Not scored |
| CVE-2026-120631 | CGI::Cookie versions from 4.67 before 5.00 for Perl allow denial of service via the client cookie expires value used as a regex in parseCGI | Not scored |
| CVE-2026-74846 | Catalyst::Plugin::Authentication versions before 0.10029 for Perl allow timing attacks on stored passwords via eq comparisons in the legacy password verifierCatalyst-Plugin-Authentication | Not scored |
| CVE-2026-65059 | Furl versions through 3.15 for Perl allow memory exhaustion via unbounded decompression of HTTP responsesFurl | Not scored |
| CVE-2026-74760 | Google::Auth versions from 0.11 through 0.12 for Perl accept an authorization code from any local process because the gcloud-auth login callback does not check the OAuth stateGoogle-Auth | Not scored |
| CVE-2026-74759 | Google::Auth versions 0.12 for Perl allow server side request forgery via unvalidated credential_source URLs in AWS external account credentialsGoogle-Auth | Not scored |
| CVE-2026-13575 | HTTP::Session versions before 0.54 for Perl allow memcached command injection via unfiltered session ids in HTTP::Session::Store::CHIhttp-session | Not scored |
| CVE-2026-115946 | XS::libbrotli versions before 1.2.1.0 for Perl bundle a brotli library with an out-of-bounds write in the decoderXS-libbrotli | Not scored |
| CVE-2026-78192 | WebDyne versions from 2.022 before 3.022 for Perl disclose application source to unauthenticated clients via the viewer in the default index pageWebDyne | Not scored |
| CVE-2026-78191 | WebDyne versions from 2.031 before 3.022 for Perl execute files with .psp anywhere in the name as Perl pagesWebDyne | Not scored |
| CVE-2026-78190 | WebDyne versions from 2.014 before 3.022 for Perl reflect request parameters unescaped into form field values, allowing cross-site scriptingWebDyne | Not scored |
| CVE-2026-78189 | WebDyne versions from 3.007 before 3.022 for Perl execute .psp files outside the document root via path traversal in the PSGI API route fallbackWebDyne | Not scored |
| CVE-2026-78188 | WebDyne versions from 2.014 before 3.022 for Perl issue session cookies without the Secure, HttpOnly and SameSite attributesWebDyne | Not scored |
| CVE-2026-118986 | CallBackery versions before 0.62.0 for Perl allow session cookie forgery via a signing secret generated with rand()CallBackery | Not scored |
| CVE-2026-118987 | CallBackery versions before 0.62.0 for Perl accept session cookies of any age sent in the X-Session-Cookie headerCallBackery | Not scored |
| CVE-2026-118990 | CallBackery versions before 0.62.0 for Perl leave a world-readable dump of the configuration database in /tmp when taking a configuration backupCallBackery | Not scored |
| CVE-2026-118991 | CallBackery versions before 0.62.0 for Perl encrypt configuration backups with the padded password as the AES keyCallBackery | Not scored |
| CVE-2026-118992 | CallBackery versions before 0.62.0 for Perl allow OS command execution via sqlite3 shell commands in a restored configuration backupCallBackery | High8.4 |
| CVE-2026-118993 | CallBackery versions before 0.62.0 for Perl allow denial of service via the request path interpolated as a regular expression under CGI, FastCGI and PSGICallBackery | Not scored |
| CVE-2026-118994 | CallBackery versions before 0.62.0 for Perl allow log injection via newlines in the login nameCallBackery | Not scored |
| CVE-2026-118995 | CallBackery versions before 0.62.0 for Perl accept unintended values in form fields checked by createRxValidatorCallBackery | Not scored |
| CVE-2026-118996 | CallBackery versions before 0.62.0 for Perl send users their own password hash and the admin-only user note via getUserConfigCallBackery | Not scored |
| CVE-2026-13576 | CallBackery versions before 0.62.0 for Perl store user passwords as unsalted HMAC-SHA1 hashesCallBackery | Not scored |
| CVE-2026-119038 | Business::GoCardless versions before 1.01 for Perl complete redirect flows without checking the session token, letting a leaked redirect flow ID create payments against another customer's mandateBusiness-GoCardless | Not scored |
| CVE-2026-119037 | Business::GoCardless versions before 1.01 for Perl accept forged webhooks when a configured webhook secret is undef or emptyBusiness-GoCardless | Not scored |
| CVE-2026-119036 | Business::GoCardless versions before 1.01 for Perl allow memory exhaustion by flattening legacy webhook payloads before checking their signatureBusiness-GoCardless | Not scored |
| CVE-2026-116128 | Starlet versions from 0.20 before 0.33 for Perl allow memory exhaustion via unbounded buffering when decoding chunked request bodiesStarlet | Not scored |