Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 2 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 400,847All CVEsplus 19,116 rejected
- 484Last 24 hours2,921 in the last 7 days
- 16,819Last 30 days1,547 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 12 | 25 | 11 | 1 | 0 | 49 | 294 |
| 2025 | 1 | 22 | 20 | 4 | 0 | 47 | 245 |
| 2024 | 1 | 11 | 20 | 2 | 0 | 34 | 198 |
| 2023 | 3 | 43 | 16 | 0 | 0 | 62 | 164 |
| 2022 | 3 | 19 | 30 | 1 | 0 | 53 | 102 |
| 2021 | 0 | 5 | 12 | 1 | 0 | 18 | 49 |
| 2020 | 3 | 3 | 20 | 5 | 0 | 31 | 31 |
| Title | ||
|---|---|---|
| CVE-2026-115522 | Cross-Application Artifact Namespace Isolation in Google Agent Development Kit (ADK) for PythonGoogle · Agent Development Kit (ADK) for Python | Medium5.3 |
| CVE-2026-107858 | Cross-Site WebSocket Hijacking and Permissive CORS in Google Agent Development Kit (ADK) for Java Development ServerGoogle · Agent Development Kit (ADK) for Java | High7.2 |
| CVE-2026-111497 | Out-of-Bounds Write in Google Brotli DecoderExploitedGoogle · Brotli | Critical9.2 |
| CVE-2026-103090 | Unauthenticated Biscuit Credential Disclosure via GET /enroll/status in Google OSS Agent Mesh (SAM)Google · SAM | High8.8 |
| CVE-2026-105772 | Arbitrary file read and write in Google ADK TypeScript (@google/adk) FileArtifactService via path traversal in userId and sessionIdGoogle · ADK TypeScript (@google/adk) | Critical9.1 |
| CVE-2026-103091 | Insecure Default Policy and Unrestricted OIDC Enrollment in Google OSS Agent Mesh (SAM)Google · SAM | Critical9.3 |
| CVE-2026-102503 | Missing Authentication on /libp2p-http Ingress in Google OSS Agent Mesh (SAM)Google · SAM | Critical9.3 |
| CVE-2026-102554 | Denial of Service via Eager Array Allocation During Deserialization in GuavaGoogle · Guava | High8.2 |
| CVE-2026-95702 | Code Execution in Host Sentry Process via Double Free in gVisor VFS MemoryFileGoogle · gVisor | High8.5 |
| CVE-2026-102252 | Path Traversal in VMDK Extractor in OSV-SCALIBRGoogle · OSV-SCALIBR | Medium6.9 |
| CVE-2026-102242 | Path Traversal via Symlink Following in allowedLocalRoots in MCP Toolbox for DatabasesGoogle · MCP Toolbox for Databases | High8.6 |
| CVE-2026-87723 | Untrusted Search Path (PATH Hijacking) in fuse-archiveGoogle · fuse-archive | Medium5.4 |
| CVE-2026-96812 | Host Root Sandbox Escape in gVisor via Character Device Passthrough and CUSEGoogle · gVisor | High8.8 |
| CVE-2026-87722 | Regular Expression Denial of Service (ReDoS) in Search Query Predicates and REST Filter Endpoints in Gerrit Code ReviewGerrit · Gerrit | High8.7 |
| CVE-2026-87721 | Denial of Service via Exponential Backtracking in ANTLR Search Query Parser in Gerrit Code ReviewGerrit · Gerrit | High8.7 |
| CVE-2026-87720 | Incorrect Authorization via Stale ProjectCache Eviction and Repeated .git Suffixes in Gerrit Code ReviewGerrit · Gerrit | High7.6 |
| CVE-2026-19202 | Token Cache Reuse in mcp-toolbox-sdk-pythonGoogle · mcp-toolbox-sdk-python | Critical9.1 |
| CVE-2026-89418 | Uncontrolled Recursion leading to Denial of Service in protobuf-javascript (google-protobuf)Google · protobuf-javascript (aka google-protobuf npm package) | High8.7 |
| CVE-2026-83530 | Uncontrolled Memory Allocation in cel-goGoogle · cel-go | Medium6.9 |
| CVE-2026-19201 | Denial of Service via Unbounded Recursion in go-attestation Windows SIPA ParserGoogle · go-attestation | Medium6.6 |
| CVE-2026-75062 | Eval Injection in google/langfun via default lf.query protocolGoogle · langfun | Critical9.2 |
| CVE-2026-10032 | Arbitrary JavaScript Execution via openUrl in @a2ui/web_coreGoogle · @a2ui/web_core | Medium6.1 |
| CVE-2026-14541 | Authentication Bypass and Audience Confusion in MCP Toolbox OAuth ProviderGoogle · mcp-toolbox | High8.0 |
| CVE-2026-14540 | Server-Side Request Forgery via Unrestricted HTTP Redirection in MCP ToolboxGoogle · mcp-toolbox | High8.0 |
| CVE-2026-14539 | Denial of Service via Unrestricted Payload Buffering in MCP ToolboxGoogle · mcp-toolbox | Medium6.6 |
| CVE-2026-14538 | BigQuery Dataset Allowlist Bypass via Metadata Dry-Run in MCP ToolboxGoogle · mcp-toolbox | Medium5.7 |
| CVE-2026-14537 | Authorization Bypass in MCP Toolbox Legacy HTTP EndpointsGoogle · mcp-toolbox | High8.1 |
| CVE-2026-18236 | Google-ADK Continuation ForgeryGoogle · Google-ADK | Critical9.3 |
| CVE-2026-16481 | Server-Side Request Forgery (SSRF) and Credential Exfiltration in googleapis/mcp-toolbox cloud-healthcare-fhir-fetch-page ToolGoogle · MCP Toolbox for Databases (googleapis/mcp-toolbox) | Medium6.0 |
| CVE-2026-15432 | Observable Timing Discrepancy in Tink-Java and Tink-Android ChunkedMacVerificationGoogle · Tink-Java | High8.2 |
| CVE-2026-15829 | SQL Injection and Security Boundary Bypass in googleapis/mcp-toolboxGoogle · MCP Toolbox for Databases (googleapis/mcp-toolbox) | High8.6 |
| CVE-2026-11720 | Path Traversal in googleapis/mcp-toolbox HTTP Tool URL BuilderGoogle · MCP Toolbox for Databases (googleapis/mcp-toolbox) | Critical9.3 |
| CVE-2026-12681 | Improper Validation of Specified Index, Position, or Offset in Input vulnerability in Google go-attestation. parseEfiSignatureList() does not advance the…Google · go-attestation | High8.9 |
| CVE-2026-11719 | An authenticated authorization bypass vulnerability exists in MCP Toolbox for Databases due to missing scope enforcement across older protocol handlers. While…Google · MCP Toolbox for Databases (googleapis/mcp-toolbox) | High8.6 |
| CVE-2026-11718 | An authentication bypass vulnerability exists in the generic opaque token validation path (validateOpaqueToken) of googleapis/mcp-toolbox. When the toolbox…Google · MCP Toolbox for Databases (googleapis/mcp-toolbox) | Critical9.3 |
| CVE-2026-11717 | An authentication bypass vulnerability exists in the generic opaque token validation path (validateOpaqueToken) of googleapis/mcp-toolbox. When verifying an…Google · MCP Toolbox for Databases (googleapis/mcp-toolbox) | Critical9.3 |
| CVE-2026-11624 | The Model Context Protocol has a security warning advising servers to validate the "Origin" header on all incoming connections to prevent DNS rebinding…Google · MCP Toolbox for Databases | Critical9.4 |
| CVE-2026-9739 | Vulnerable to DNS rebinding attacks when using SSE (http://b/499408790). During the beta phase, we implemented `allowed-origins` and `allowed-hosts` flags to…Google · MCP Toolbox for Databases | Critical9.4 |
| CVE-2026-8369 | Improper Input Validation in OpenThread NAT64 TranslatorThe OpenThread Authors · OpenThread | Medium6.0 |
| CVE-2026-2725 | Improper Authorization in Gerrit allowing Code Review Bypass via "Submitted Together"Gerrit · Gerrit | Medium6.0 |
| CVE-2026-6409 | Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted inputProtocol Buffers · Protobuf-php (Pecl) | High7.1 |
| CVE-2026-4092 | Arbitrary File Write via Path Traversal in Google clasp leading to RCEGoogle · Clasp | High8.7 |
| CVE-2026-3223 | Zip Slip leading to Arbitrary File Write and Privilege Escalation in Google Web DesignerGoogle · Web Designer | High8.4 |
| CVE-2026-1669 | Arbitrary File Read in Keras via HDF5 External DatasetsGoogle · Keras | High7.1 |
| CVE-2025-12474 | libjxl: Uninitialized memory read in decoder due to incorrect optimization in patch handlingGoogle · libjxl | Low2.3 |
| CVE-2026-1837 | libjxl: Out-of-bounds write in grayscale color transformation when using LCMS2Google · libjxl | High8.7 |
| CVE-2026-0994 | Denial of Service in Python ProtobufPython · Protobuf | High8.2 |
| CVE-2026-1260 | Invalid Memory Access in Sentencepiece,Google · Sentencepiece | High8.5 |
| CVE-2026-0897 | Denial of Service in Keras via Excessive Memory Allocation in HDF5 MetadataGoogle · Keras | High7.1 |
| CVE-2025-13437 | Arbitrary node_modules Directory Deletion in Google zxGoogle · zx | Medium5.6 |