Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read just now.
At a glance
Published CVEs; rejected ones are not counted.
- 400,855All CVEsplus 19,116 rejected
- 455Last 24 hours2,911 in the last 7 days
- 16,802Last 30 days1,551 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 23 | 148 | 142 | 66 | 0 | 379 | 388 |
| 2025 | 0 | 4 | 4 | 1 | 0 | 9 | 9 |
| Title | ||
|---|---|---|
| CVE-2026-119434 | Decompression bomb in ezstd:decompress_using_ddict/2 allows BEAM memory exhaustion via unbounded output buffersilviucpp · ezstd | Medium6.9 |
| CVE-2026-118391 | Unbounded query cache growth from interpolated JSON paths and splice lists in Ectoelixir-ecto · ecto | High8.9 |
| CVE-2026-110826 | AshAuthentication log_out_everywhere leaves sessions valid after a password reset or non-atomic password changeteam-alembic · ash_authentication | Medium6.3 |
| CVE-2026-118505 | AshAuthentication brute_force_strategy does not limit sign-in and request actions defined on the resourceteam-alembic · ash_authentication | Medium6.3 |
| CVE-2026-119215 | AshAuthentication TOTP setup lets a user install their own authenticator secret on another user's accountteam-alembic · ash_authentication | High7.6 |
| CVE-2026-117680 | jsv treats regex match budget exhaustion as a non-match, bypassing patternProperties and notlud · jsv | Low2.1 |
| CVE-2026-117656 | Unverified Sign in with Apple callback parameter can override verified ID token claimspow-auth · assent | Critical9.3 |
| CVE-2026-117645 | Phoenix.HTML vulnerable to attribute injection via unvalidated attribute names in attributes_escape/1phoenixframework · phoenix_html | Medium5.3 |
| CVE-2026-117666 | ssl_verify_fun: partial-label wildcard certificate matches hostnames across a label boundarydeadtrickster · ssl_verify_fun | Critical9.1 |
| CVE-2026-97209 | Insecure temporary file in mix deps.partition lets a local user execute code in another user's dependency buildelixir-lang · elixir | Medium5.4 |
| CVE-2026-115274 | Unbounded integer parsing in JSON.decode/1 enables CPU and memory exhaustion denial of service in Elixirelixir-lang · elixir | Medium6.9 |
| CVE-2026-109821 | Unbounded port parsing in URI.parse/1 enables CPU exhaustion denial of service in Elixirelixir-lang · elixir | Medium6.3 |
| CVE-2026-116078 | HTTP/2 request bodies made of 1-byte DATA frames amplify memory use in Banditmtrudel · bandit | High8.7 |
| CVE-2026-109823 | Host filesystem path disclosure via DNS rebindingtidewave-ai · tidewave | Low2.3 |
| CVE-2026-65630 | Timing side-channel in pure-Erlang X25519 scalar multiplication leaks the private key in josepotatosalad · jose | Medium5.9 |
| CVE-2026-65632 | ECDSA signature length is not validated in jose, allowing signature malleabilitypotatosalad · jose | Medium5.1 |
| CVE-2026-65631 | erlang-jose RSA JWK parsing attempts to factor an attacker-controlled modulus, enabling CPU-exhaustion denial of servicepotatosalad · jose | Medium6.9 |
| CVE-2026-65629 | Weak PBKDF2 parameters for password-encrypted private-key export in josepotatosalad · jose | High7.4 |
| CVE-2026-65628 | Infinite recursion (CPU denial-of-service) in JOSE.JWK.shared_secret/2 on mismatched key typespotatosalad · jose | Medium5.9 |
| CVE-2026-65627 | Decompression bomb via unbounded zlib:inflate in jose_jwe_zip:uncompress/2potatosalad · jose | Medium6.9 |
| CVE-2026-65626 | Bleichenbacher padding oracle in RSAES-PKCS1-v1_5 decryption in josepotatosalad · jose | Medium5.9 |
| CVE-2026-65625 | Attacker-controlled AES-GCM authentication tag length allows tag forgery in josepotatosalad · jose | Medium5.9 |
| CVE-2026-97200 | Unbounded response body buffering and decompression in hackneybenoitc · hackney | High8.2 |
| CVE-2026-115693 | Custom cacerts or cacertfile do not restrict trust to the pinned CA in hackneybenoitc · hackney | Critical9.1 |
| CVE-2026-113440 | HTTP/1.1 and HTTP/2 redirects resend basic_auth and cookie to a different scheme or port in hackneybenoitc · hackney | Medium6.0 |
| CVE-2026-115700 | SSRF allowlist bypass via percent-encoded bracketed IPv6 or trailing-dot IP literal in hackneybenoitc · hackney | Medium6.9 |
| CVE-2026-112880 | CRLF injection in Proxy-Authorization header built from proxy_auth_fun in hackneybenoitc · hackney | Low2.1 |
| CVE-2026-108529 | SETTINGS and stream-0 WINDOW_UPDATE frames trigger quadratic work over blocked streams in Banditmtrudel · bandit | High8.7 |
| CVE-2026-110499 | Client-chosen HPACK encoder table size is applied uncapped, growing per-connection state with every response in Banditmtrudel · bandit | High8.7 |
| CVE-2026-109584 | HTTP/2 cookie crumb join expands a small HPACK header block into an unbounded allocation in Banditmtrudel · bandit | High8.7 |
| CVE-2026-111103 | HTTP/2 StreamError recovery rolls back connection state and bypasses per-connection limits in Banditmtrudel · bandit | High8.2 |
| CVE-2026-111101 | HTTP/1.1 chunked request bodies made of 1-byte chunks amplify memory use in Banditmtrudel · bandit | High8.7 |
| CVE-2026-113436 | Quadratic bignum parsing of Content-Length and Host port values in Banditmtrudel · bandit | High8.7 |
| CVE-2026-110314 | WebSocket frames keep reaching the WebSock after a server-initiated close in Banditmtrudel · bandit | Medium6.3 |
| CVE-2026-114213 | WebSocket 1-byte continuation frames bypass `max_fragmented_message_size` in Banditmtrudel · bandit | High8.7 |
| CVE-2026-114216 | Chunk extensions accept bare LF and CR, enabling request smuggling in Banditmtrudel · bandit | Medium6.3 |
| CVE-2026-115269 | HTTP/2 WINDOW_UPDATE and SETTINGS frames reset the request body read timeout in Banditmtrudel · bandit | High8.7 |
| CVE-2026-108525 | HTTP/2 inbound flow control is not enforced, letting a client queue unbounded DATA in stream processes in Banditmtrudel · bandit | High8.7 |
| CVE-2026-96581 | An upsert on the primary key in Ash ignores attribute multitenancy, so one tenant can read, overwrite and take over another tenant's recordsash-project · ash | High7.6 |
| CVE-2026-115627 | AshPostgres ignores attribute multitenancy on the join resource when loading many_to_many and through relationships, returning records related through other tenants' rowsash-project · ash_postgres | Medium6.0 |
| CVE-2026-115635 | AshPostgres returns another tenant's record for a skipped upsert when return_skipped_upsert? is setash-project · ash_postgres | Medium6.0 |
| CVE-2026-114214 | Loading a through relationship with a limit of 1 in Ash ignores the through path and returns unrelated destination recordsash-project · ash | Medium6.0 |
| CVE-2026-107685 | WebSocket sessions do not verify TLS certificates, exposing API keys and OAuth tokens to on-path attackersagentjido · req_llm | Critical9.1 |
| CVE-2026-105963 | Secret key base exposed in stack trace arguments on wrong-typed Plug.Crypto argumentselixir-plug · plug | Medium5.1 |
| CVE-2026-93471 | Unbounded SAML message decompression in esaml allows memory exhaustionhandnot2 · esaml | High8.7 |
| CVE-2026-86696 | Unbounded atom creation from unsigned LogoutResponse status codes in esaml allows atom table exhaustionhandnot2 · esaml | High8.2 |
| CVE-2026-105270 | Unbounded atom creation while parsing SAML messages in esaml allows atom table exhaustionarekinath · esaml | High8.7 |
| CVE-2026-105660 | Unvalidated HTTP/1 request-target authority lets a client choose conn.host and conn.port in Banditmtrudel · bandit | Medium6.9 |
| CVE-2026-96596 | erl_tar:extract/2 loops forever on a GNU sparse member with a trailing holeerlang · rebar3 | Medium5.9 |
| CVE-2026-105236 | TLS 1.2 session resumption in ssl crosses SNI virtual-host client-certificate trust boundariesErlang · OTP | Medium6.3 |