Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 2 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 400,898All CVEsplus 19,118 rejected
- 378Last 24 hours2,800 in the last 7 days
- 16,786Last 30 days1,549 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 0 | 5 | 7 | 3 | 0 | 15 | 25 |
| 2025 | 0 | 1 | 5 | 0 | 0 | 6 | 10 |
| 2024 | 0 | 3 | 1 | 0 | 0 | 4 | 4 |
| Title | ||
|---|---|---|
| CVE-2026-121949 | Symfony: HtmlSanitizer Does Not URL-Sanitize srcset and imagesrcset: Media Scheme and Host Allow-List Bypasssensiolabs · symfony | Low2.3 |
| CVE-2026-118517 | Symfony: HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URLs Without a Well-Formed Authority (Incomplete Fix for CVE-2026-45066)sensiolabs · symfony | Low2.3 |
| CVE-2026-123125 | Symfony: Ip Constraint public/private Modes Accept IPv4-Mapped and IPv4-Compatible IPv6 Addresses allowing SSRF Filter Bypasssensiolabs · symfony | Medium6.3 |
| CVE-2026-123119 | Symfony: NoPrivateNetworkHttpClient Does Not Pin the Checked IP of Cached Hosts, Letting DNS Rebinding Enumerate Internal Ports (Incomplete Fix for CVE-2024-50342)sensiolabs · symfony | Low2.3 |
| CVE-2026-121971 | Symfony: ScopingHttpClient Sends the Credentials of Its Default Scope to Other Origins Through Network-Path Referencessensiolabs · symfony | High8.2 |
| CVE-2026-121373 | Symfony: HtmlSanitizer MetaRefreshAttributeSanitizer Matches Only a Narrow Subset of the Browser Refresh Grammar (Incomplete Fix for CVE-2026-48761)sensiolabs · symfony | Medium5.3 |
| CVE-2026-118516 | Symfony: Host Placeholders Can Match the Start of the Path in Compiled URL Matchers, Bypassing Path-Based Access Controlsensiolabs · symfony | Medium6.3 |
| CVE-2026-118513 | Symfony: X.509 Authentication Impersonation via DN Value Injection (incomplete fix for CVE-2026-45063)sensiolabs · symfony | High7.7 |
| CVE-2026-77157 | ast-cli: Auto-update downloads are not verified against a checksum before executionCheckmarx · github.com/checkmarx/ast-cli | Medium6.3 |
| CVE-2026-77156 | ast-cli: Path traversal in tar extraction on Linux/macOS allows writes outside the install directoryCheckmarx · github.com/checkmarx/ast-cli | Medium6.3 |
| CVE-2026-109449 | Symfony: Unbounded Nesting in the Expression Parser Lets Untrusted Expressions Crash the Processsensiolabs · symfony | High8.7 |
| CVE-2026-109413 | Symfony: Unbounded Recursion in the YAML Inline Lexer Lets a Single Document Crash the Processsensiolabs · symfony | High8.7 |
| CVE-2026-108082 | Symfony: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Headersensiolabs · symfony | High8.7 |
| CVE-2026-9591 | Cross-Site Request Forgery (CSRF) in SimplCommerce News Modulesimplcommerce · SimplCommerce | Medium6.9 |
| CVE-2026-11975 | Stored Cross-Site Scripting (XSS) in SimplCommerce News Module Admin Interfacesimplcommerce · SimplCommerce | Medium6.2 |
| CVE-2014-125128 | 'sanitize-html' prior to version 1.0.3 is vulnerable to Cross-site Scripting (XSS). The function 'naughtyHref' doesn't properly validate the hyperreference…sanitize-html | Medium6.1 |
| CVE-2019-25225 | `sanitize-html` prior to version 2.0.0-beta is vulnerable to Cross-site Scripting (XSS). The `sanitizeHtml()` function in `index.js` does not sanitize content…sanitize-html | Medium6.1 |
| CVE-2014-125127 | Denial of Service (DoS) vulnerability in mikecao/flightflightphp · core | High7.5 |
| CVE-2025-6050 | Stored Cross-Site Scripting (XSS) in Mezzanine CMS Admin Interfacejupo · mezzanine | Medium4.8 |
| CVE-2018-25110 | Regular Expression Denial of Service (ReDoS) in markedjs/markedmarked | Medium6.9 |
| CVE-2025-0825 | CRLF injection in Cpp-httplibcpp-httplib | Medium6.9 |
| CVE-2024-8374 | Arbitrary Code Injection in CuraUltimaker · Cura | High7.8 |
| CVE-2024-5685 | Broken Function Level Authorization (BFLA) in snipe/snipe-itsnipe · snipe-it | High7.6 |
| CVE-2024-4068 | Memory Exhaustion in bracesmicromatch · braces | High7.5 |
| CVE-2024-4067 | Regular Expression Denial of Service in micromatchmicromatch · micromatch | Medium5.3 |