Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 7 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 400,109All CVEsplus 18,875 rejected
- 775Last 24 hours3,263 in the last 7 days
- 17,390Last 30 days1,568 of them critical
- 1,767Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 14 | 58 | 34 | 3 | 2 | 111 | 263 |
| 2025 | 1 | 17 | 19 | 1 | 0 | 38 | 152 |
| 2024 | 3 | 8 | 9 | 0 | 0 | 20 | 114 |
| 2023 | 6 | 20 | 14 | 0 | 0 | 40 | 94 |
| 2022 | 9 | 31 | 10 | 2 | 0 | 52 | 54 |
| 2021 | 0 | 0 | 0 | 0 | 0 | 0 | 2 |
| 2020 | 0 | 2 | 0 | 0 | 0 | 2 | 2 |
| Title | ||
|---|---|---|
| CVE-2026-97045 | Check all ancestor namespace transitions when rendering raw text in html in golang.org/x/netgolang.org/x/net · golang.org/x/net/html | Not scored |
| CVE-2026-78661 | Avoid quadratic complexity when coalescing text nodes in html in golang.org/x/netgolang.org/x/net · golang.org/x/net/html | Not scored |
| CVE-2026-111943 | Distrust compromised intermediate certificates in crypto/x509Go standard library · crypto/x509 | Medium6.8 |
| CVE-2026-97032 | HTTP/2 server crash due to HPACK encoder race in net/httpGo standard library · net/http | High7.5 |
| CVE-2026-94439 | HTTP/1 server connection desynchronization after 2xx CONNECT response in net/httpGo standard library · net/http | High7.5 |
| CVE-2026-78663 | Double flow control refund on HTTP/2 server streams in net/httpGo standard library · net/http | Critical9.1 |
| CVE-2026-78669 | Excessive CPU consumption from repeated initial window changes in net/httpGo standard library · net/http | High7.5 |
| CVE-2026-78660 | HTTP/2 transport accepts malformed framing-related headers in net/httpGo standard library · net/http | High7.5 |
| CVE-2026-78667 | Lack of limit on size of parsed Range headers in net/httpGo standard library · net/http | High7.5 |
| CVE-2026-94440 | Memory limit bypass when parsing MIME headers in net/textproto, mime/multipartGo standard library · net/textproto | High7.5 |
| CVE-2026-97031 | Reject malformed ECH outer extension references in crypto/tlsGo standard library · crypto/tls | High7.5 |
| CVE-2026-56866 | HTTP/1 client connection desynchronization after CONNECT rejection in net/httpGo standard library · net/http | High7.5 |
| CVE-2026-56857 | Root.Mkdir(All) can follow junctions out of the root on Windows in osGo standard library · os | Critical9.8 |
| CVE-2026-78659 | HTTP/2 server memory exhaustion due to Trailer headers in net/httpGo standard library · net/http | High7.5 |
| CVE-2026-94447 | Checksum database bypass for golang.org/toolchain in cmd/goGo toolchain · cmd/go | High7.8 |
| CVE-2026-94444 | Checksum bypass for golang.org/fips140 in cmd/goGo toolchain · cmd/go | High7.8 |
| CVE-2026-97030 | Recognize yield as regexp preceder keyword in html/templateGo standard library · html/template | Medium6.1 |
| CVE-2026-94448 | Reset context tracking on consecutive template expressions in html/templateGo standard library · html/template | Medium6.1 |
| CVE-2026-56851 | Panic parsing crafted input in x/text/secure/precis in golang.org/x/textgolang.org/x/text · golang.org/x/text/secure/precis | High7.5 |
| CVE-2026-94445 | Malicious user input may lead to RCE in golang.org/x/playgroundgolang.org/x/playground · golang.org/x/playground | High8.8 |
| CVE-2026-56855 | Prevent DoS on deadlocked established channel in golang.org/x/crypto/sshgolang.org/x/crypto · golang.org/x/crypto/ssh | High7.5 |
| CVE-2026-78662 | Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/sshgolang.org/x/crypto · golang.org/x/crypto/ssh | High7.5 |
| CVE-2026-56854 | Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/sshgolang.org/x/crypto · golang.org/x/crypto/ssh | High7.5 |
| CVE-2026-46603 | Excessive memory allocation during VP8L decoding in golang.org/x/imagegolang.org/x/image · golang.org/x/image/vp8l | High7.5 |
| CVE-2026-56860 | Avoid quadratic complexity in resolvePath in net/urlGo standard library · net/url | Medium5.9 |
| CVE-2026-56864 | Ignore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdbGo toolchain · cmd/go | High7.5 |
| CVE-2026-56865 | Fix transparency log tile verification bypass in golang.org/x/mod/sumdb/tlogGo toolchain · cmd/go | High8.4 |
| CVE-2026-56858 | Fix Javascript regexp context tracking in html/templateGo standard library · html/template | Medium6.1 |
| CVE-2026-56862 | Limit handshake messages we are willing to accept post-handshake in crypto/tlsGo standard library · crypto/tls | High7.5 |
| CVE-2026-56853 | Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/httpGo standard library · net/http | High7.5 |
| CVE-2026-56859 | Add recursion depth guard during decode in encoding/xmlGo standard library · encoding/xml | High7.5 |
| CVE-2026-33818 | Enforce maximum recursion depth in encoding/asn1Go standard library · encoding/asn1 | High7.5 |
| CVE-2026-56852 | Infinite loop on invalid input in golang.org/x/textgolang.org/x/text · golang.org/x/text/unicode/norm | High7.5 |
| CVE-2026-46600 | Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessageGo standard library · net | High7.5 |
| CVE-2026-42505 | Invoking Encrypted Client Hello privacy leak in crypto/tlsGo standard library · crypto/tls | Medium5.3 |
| CVE-2026-39822 | Root escape via symlink plus trailing slash in osGo standard library · os | High7.8 |
| CVE-2026-46604 | Panic decoding image with out-of-bounds strip offset in x/image/tiff in golang.org/x/imagegolang.org/x/image · golang.org/x/image/tiff | High7.5 |
| CVE-2026-46602 | Lack of limit on tile sizes in x/image/tiff in golang.org/x/imagegolang.org/x/image · golang.org/x/image/tiff | High7.5 |
| CVE-2026-46601 | Panic on VP8 alpha channel size mismatch in x/image/webp in golang.org/x/imagegolang.org/x/image · golang.org/x/image/webp | High7.5 |
| CVE-2026-42507 | Arbitrary inputs are included in errors without any escaping in net/textprotoGo standard library · net/textproto | Medium5.3 |
| CVE-2026-42504 | Quadratic complexity in WordDecoder.DecodeHeader in mimeGo standard library · mime | High7.5 |
| CVE-2026-27145 | Inefficient candidate hostname parsing in crypto/x509Go standard library · crypto/x509 | Medium6.5 |
| CVE-2026-46599 | Excessive resource consumption in PackBits decompression in golang.org/x/image/tiffgolang.org/x/image · golang.org/x/image/tiff | High7.5 |
| CVE-2026-42500 | Panic when reading out of bound palette index in golang.org/x/image/bmpgolang.org/x/image · golang.org/x/image/bmp | Medium5.3 |
| CVE-2026-39824 | Invoking integer overflow in NewNTUnicodeString in golang.org/x/sys/windowsgolang.org/x/sys · golang.org/x/sys/windows | Low3.3 |
| CVE-2026-27136 | Invoking duplicate attributes can cause XSS in golang.org/x/net/htmlgolang.org/x/net · golang.org/x/net/html | Medium6.1 |
| CVE-2026-25681 | Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/htmlgolang.org/x/net · golang.org/x/net/html | Medium6.1 |
| CVE-2026-25680 | Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/htmlgolang.org/x/net · golang.org/x/net/html | Medium6.5 |
| CVE-2026-42502 | Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/htmlgolang.org/x/net · golang.org/x/net/html | Medium6.1 |
| CVE-2026-39821 | Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idnaGo standard library · net/http | Critical9.6 |