Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 5 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,673All CVEsplus 19,141 rejected
- 692Last 24 hours2,975 in the last 7 days
- 17,156Last 30 days1,607 of them critical
- 1,769Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 1 | 6 | 20 | 13 | 0 | 40 | 44 |
| 2025 | 1 | 2 | 1 | 0 | 0 | 4 | 4 |
| Title | ||
|---|---|---|
| CVE-2026-114582 | Server-side request forgery via SpatialReference string inputdjangoproject · Django | Medium6.9 |
| CVE-2026-113733 | Password hash disclosure to "view only" admin users with custom user modelsdjangoproject · Django | Low2.1 |
| CVE-2026-113593 | Potential exposure of private data via empty and missing Vary headersdjangoproject · Django | Low2.3 |
| CVE-2026-111362 | Server-side request forgery via crs member of GeoJSON geometriesdjangoproject · Django | Medium6.9 |
| CVE-2026-111211 | Potential log injection via unescaped geometry form valuesdjangoproject · Django | Medium6.9 |
| CVE-2026-108147 | Potential memory exhaustion in MultiPartParser via base64-encoded file uploaddjangoproject · Django | Medium6.9 |
| CVE-2026-87975 | Privilege abuse in model formsets with editable primary keysdjangoproject · Django | Medium5.3 |
| CVE-2026-87890 | Potential request forgery via spatial lookup byte valuesdjangoproject · Django | Medium6.9 |
| CVE-2026-84429 | Potential denial-of-service vulnerability in HTTP header parsingdjangoproject · Django | Medium6.9 |
| CVE-2026-77050 | Potential denial-of-service vulnerability in get_supported_language_variant()djangoproject · Django | Medium6.9 |
| CVE-2026-15920 | Potential cross-site scripting via URLField values in the admindjangoproject · Django | Medium5.1 |
| CVE-2026-15830 | Potential denial-of-service vulnerability via nested geometry collectionsdjangoproject · Django | Medium6.9 |
| CVE-2026-15337 | Potential denial-of-service vulnerability in check_for_language()djangoproject · Django | Medium6.9 |
| CVE-2026-15307 | Server-side file-write and request forgery via spatial lookupsdjangoproject · Django | High8.7 |
| CVE-2026-53878 | Header injection possibility since DomainNameValidator accepted newlines in inputdjangoproject · Django | Medium5.3 |
| CVE-2026-53877 | Heap buffer over-read in GDALRasterdjangoproject · Django | Medium6.3 |
| CVE-2026-48588 | Potential exposure of private data via cached Set-Cookie responsedjangoproject · Django | Low2.3 |
| CVE-2026-44546 | Header injection via WebSocket upgrade parser differential allows ASGI scope header spoofingdjangoproject · daphne | Low3.7 |
| CVE-2026-44545 | Unbounded WebSocket message and frame sizes can cause unauthenticated remote denial of servicedjangoproject · daphne | Medium5.3 |
| CVE-2026-48587 | Potential exposure of private data via whitespace padding in Vary headerdjangoproject · Django | Low2.3 |
| CVE-2026-35193 | Potential exposure of private data via missing Vary: Authorization in UpdateCacheMiddlewaredjangoproject · Django | Low2.3 |
| CVE-2026-8404 | Potential exposure of private data via case-sensitive Cache-Control directives in UpdateCacheMiddlewaredjangoproject · Django | Low2.3 |
| CVE-2026-7666 | Potential unencrypted email transmission via STARTTLS in the SMTP backenddjangoproject · Django | Low2.3 |
| CVE-2026-6873 | Signed cookie salt namespace collision in django.http.HttpRequest.get_signed_cookiedjangoproject · Django | Low2.3 |
| CVE-2026-35192 | Session fixation via public cached pages and SESSION_SAVE_EVERY_REQUESTdjangoproject · Django | Low2.3 |
| CVE-2026-6907 | Potential exposure of private data due to incorrect handling of Vary: * in UpdateCacheMiddlewaredjangoproject · Django | Low2.3 |
| CVE-2026-5766 | Potential denial-of-service vulnerability in ASGI requests via file upload limit bypassdjangoproject · Django | Medium6.3 |
| CVE-2026-33034 | Potential denial-of-service vulnerability in ASGI requests via memory upload limit bypassdjangoproject · Django | High7.5 |
| CVE-2026-33033 | Potential denial-of-service vulnerability in MultiPartParser via base64-encoded file uploaddjangoproject · Django | Medium6.5 |
| CVE-2026-4292 | Privilege abuse in ModelAdmin.list_editabledjangoproject · Django | Low2.7 |
| CVE-2026-4277 | Privilege abuse in GenericInlineModelAdmindjangoproject · Django | Critical9.8 |
| CVE-2026-3902 | ASGI header spoofing via underscore/hyphen conflationdjangoproject · Django | High7.5 |
| CVE-2026-25674 | Potential incorrect permissions on newly created file system objectsdjangoproject · Django | Low3.7 |
| CVE-2026-25673 | Potential denial-of-service vulnerability in URLField via Unicode normalization on Windowsdjangoproject · Django | High7.5 |
| CVE-2025-14550 | Potential denial-of-service vulnerability via repeated headers when using ASGIdjangoproject · Django | High7.5 |
| CVE-2026-1312 | Potential SQL injection via QuerySet.order_by and FilteredRelationdjangoproject · Django | Medium5.4 |
| CVE-2026-1287 | Potential SQL injection in column aliases via control charactersdjangoproject · Django | Medium5.4 |
| CVE-2026-1285 | Potential denial-of-service vulnerability in django.utils.text.Truncator HTML methodsdjangoproject · Django | High7.5 |
| CVE-2026-1207 | Potential SQL injection via raster lookups on PostGISdjangoproject · Django | Medium5.4 |
| CVE-2025-13473 | Username enumeration through timing difference in mod_wsgi authentication handlerdjangoproject · Django | Medium5.3 |
| CVE-2025-64460 | Potential denial-of-service vulnerability in XML serializer text extractiondjangoproject · Django | High7.5 |
| CVE-2025-13372 | Potential SQL injection in FilteredRelation column aliases on PostgreSQLdjangoproject · Django | Medium4.3 |
| CVE-2025-64459 | Potential SQL injection via _connector keyword argument in QuerySet and Q objectsdjangoproject · Django | Critical9.1 |
| CVE-2025-64458 | Potential denial-of-service vulnerability in HttpResponseRedirect and HttpResponsePermanentRedirect on Windowsdjangoproject · Django | High7.5 |