Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 7 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,334All CVEsplus 19,141 rejected
- 442Last 24 hours2,721 in the last 7 days
- 16,921Last 30 days1,562 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 6 | 11 | 4 | 0 | 0 | 21 | 52 |
| 2025 | 14 | 13 | 2 | 0 | 0 | 29 | 31 |
| 2024 | 0 | 0 | 2 | 0 | 0 | 2 | 2 |
| Title | ||
|---|---|---|
| CVE-2026-29128 | IDC SFX2100 Satellite Receiver bgpd/ospfd/ripd/zebra Config Credential Disclosure via World-Readable FilesInternational Datacasting Corporation · SFX2100 Satellite Receiver | High8.6 |
| CVE-2026-29127 | Incorrect Permission Assignment(777) on `monitor` Users Home Directory Containing SUID Root Binaries in IDC SFX2100International Datacasting Corporation · SFX2100 Satellite Receiver | Critical9.2 |
| CVE-2026-29126 | World-Writable, Root Owned/Run `/etc/udhcpc/default.script` in IDC SFX2100 Satellite Receiver Leads To Potential LPEInternational Datacasting Corporation · SFX2100 Satellite Receiver | High8.5 |
| CVE-2026-29125 | IDC SFX2100 Satellite Receiver allows unprivileged modification of DNS configuration due to world-writable `/etc/resolv.conf`International Datacasting Corporation · SFX2100 Satellite Receiver | High7.1 |
| CVE-2026-29124 | Multiple SUID Root Binaries in `monitor` User Home Directory Leading to Potential Local Privilege EscalationInternational Datacasting Corporation · SFX2100 Satellite Receiver | High8.6 |
| CVE-2026-29123 | Multiple SUID Root Binaries in `xd` User Home Directory Leading to Potential Local Privilege EscalationInternational Datacasting Corporation · SFX2100 Satellite Receiver | High8.6 |
| CVE-2026-29122 | `/bin/date` Binary given SETUID Permissions on IDC SFX2100 Leading to Potential LPEInternational Datacasting Corporation · SFX2100 Satellite Receiver | High8.3 |
| CVE-2026-29121 | `/sbin/ip` Binary given SETUID Permissions on IDC SFX2100 Leading to Potential LPEInternational Datacasting Corporation · SFX2100 Satellite Receiver | High8.3 |
| CVE-2026-29120 | Insecure, Hardcoded Root Password Stored in Anaconda Configuration File On IDC SFX2100 Satellite ReceiverInternational Datacasting Corporation · IDC SFX2100 SuperFlex Satellite Receiver | Critical9.2 |
| CVE-2026-29119 | Hardcoded and Insecure Credentials for "Admin" Account providing Telnet Access on IDC SFX2100 Satellite ReceiverInternational Datacasting Corporation (IDC) · SFX2100 Series SuperFlex SatelliteReceiver | High8.8 |
| CVE-2026-28778 | Hardcoded FTP Credentials and LPE(via Insecure Permissions) for `xd` Local Account on IDC SFX2100International Datacasting Corporation (IDC) · IDC SFX2100 SuperFlex Satellite Receiver | High7.9 |
| CVE-2026-28777 | Hardcoded and Insecure Credentials for "User" Local Account with SSH Access On IDC SFX2100 Satellite ReceiverInternational Datacasting Corporation (IDC) · SFX2100 Satellite Receiver | Critical9.2 |
| CVE-2026-28776 | Hardcoded and Insecure Credentials for "monitor" account with SSH Access On IDC SFX2100 Satellite ReceiverInternational Datacasting Corporation (IDC) · IDC SFX2100 SuperFlex Satellite Receiver | High7.8 |
| CVE-2026-28775 | Unauthenticated RCE via SNMP Default Writable Community StringInternational Datacasting Corporation (IDC) · SFX2100 Series SuperFlex SatelliteReceiver | Critical10.0 |
| CVE-2026-28774 | Authenticated OS Command Injection via Traceroute Utility leads to Root RCEInternational Datacasting Corporation (IDC) · SFX Series SuperFlex SatelliteReceiver Web Management Interface | Critical9.3 |
| CVE-2026-28773 | Authenticated OS Command Injection via Ping Utility Leading to RCE as RootInternational Datacasting Corporation (IDC) · SFX Series SuperFlex SatelliteReceiver Web Management Interface | Critical9.3 |
| CVE-2026-28772 | Reflected XSS in IDC_Logging Index endpointInternational Datacasting Corporation (IDC) · SFX Series SuperFlex SatelliteReceiver Web Management Interface | Medium5.1 |
| CVE-2026-28771 | Reflected XSS In /index.cgi Endpoint On IDC Satellite Receiver Web Management Interface Version 101International Datacasting Corporation (IDC) · SFX Series SuperFlex Satellite Receiver Web Management Interface | Medium5.1 |
| CVE-2026-28770 | XML injection In /IDC_Logging/checkifdone.cgi Endpoint On IDC SFX Web Management Interface Version 101International Datacasting Corporation (IDC) · SFX Series SuperFlex Satellite Receiver Web management interface | Medium5.3 |
| CVE-2026-28769 | LFI in /IDC_Logging/checkifdone.cgi, "file" parameter Allowing for File Existence Enumeration On IDC Satellite Receiver Web Management Interface Version 101International Datacasting Corporation (IDC) · SFX Series SuperFlex Satellite Receiver Web management interface | Medium5.3 |
| CVE-2026-1953 | Stored Cross Site Scripting(XSS) in Nukegraphic CMS V3.1.2Nukegraphic CMS · Nukegraphic CMS | High8.2 |
| CVE-2025-14202 | Cross-Site Request Forgery (CSRF) Leading to Account Takeover via SVG File UploadLinkding · LinkDing | High8.2 |
| CVE-2025-66269 | Unquoted Service Path in UPSilon2000V6.0(RupsMon and USBMate) running as SYSTEMMegaTec Taiwan · UPSilon2000V6.0 | High7.1 |
| CVE-2025-66266 | Insecure SYSTEM Service Permissions in UPSilon2000V6.0 (RupsMon.exe) leading to trivial Local Privilege EscalationMegaTec Taiwan · UPSilon2000V6.0 | Critical9.3 |
| CVE-2025-66265 | Insecure permissions in configuration directory (C:\\usr)MegaTec Taiwan · ClientMate | Medium6.9 |
| CVE-2025-66264 | Unquoted Service path in UPSilon2000V6.0 SYSTEM privilege serviceMegaTec Taiwan · ClientMate | High7.2 |
| CVE-2025-66263 | Unauthenticated Arbitrary File Read via Null Byte InjectionDB Electronica Telecomunicazioni S.p.A. · Mozart FM Transmitter | High8.9 |
| CVE-2025-66262 | Arbitrary File Overwrite via Tar Extraction Path TraversalDB Electronica Telecomunicazioni S.p.A. · Mozart FM Transmitter | Critical9.3 |
| CVE-2025-66261 | Unauthenticated OS Command Injection (restore_settings.php)DB Electronica Telecomunicazioni S.p.A. · Mozart FM Transmitter | Critical9.9 |
| CVE-2025-66260 | PostgreSQL SQL Injection (status_sql.php)DB Electronica Telecomunicazioni S.p.A. · Mozart FM Transmitter | High7.2 |
| CVE-2025-66259 | Authenticated Root Remote Code Execution through improper filtering of HTTP post request parametersDB Electronica Telecomunicazioni S.p.A. · Mozart FM Transmitter | Critical9.3 |
| CVE-2025-66258 | Stored Cross-Site Scripting via XML InjectionDB Electronica Telecomunicazioni S.p.A. · Mozart FM Transmitter | High7.1 |
| CVE-2025-66257 | Unauthenticated Arbitrary File Deletion (patch_contents.php)DB Electronica Telecomunicazioni S.p.A. · Mozart FM Transmitter | Critical9.2 |
| CVE-2025-66256 | Unauthenticated Arbitrary File Upload (patch_contents.php)DB Electronica Telecomunicazioni S.p.A. · Mozart FM Transmitter | Critical9.9 |
| CVE-2025-66255 | Unauthenticated Arbitrary File Upload (upgrade_contents.php)DB Electronica Telecomunicazioni S.p.A. · Mozart FM Transmitter | Critical9.9 |
| CVE-2025-66254 | Unauthenticated Arbitrary File Deletion (upgrade_contents.php)DB Electronica Telecomunicazioni S.p.A. · Mozart FM Transmitter | High7.8 |
| CVE-2025-66253 | Unauthenticated OS Command Injection (start_upgrade.php)DB Electronica Telecomunicazioni S.p.A. · Mozart FM Transmitter | Critical9.9 |
| CVE-2025-66252 | Infinite Loop Denial of Service via Failed File DeletionDB Electronica Telecomunicazioni S.p.A. · Mozart FM Transmitter | High8.4 |
| CVE-2025-66251 | Unauthenticated Path Traversal with Arbitrary File DeletionDB Electronica Telecomunicazioni S.p.A. · Mozart FM Transmitter | High7.7 |
| CVE-2025-66250 | Unauthenticated Arbitrary File Upload (status_contents.php)DB Electronica Telecomunicazioni S.p.A. · Mozart FM Transmitter | Critical9.2 |
| CVE-2025-12683 | NULL DACL assigned to Named Pipe communicating with SYSTEM ServiceVoidtools · Everything | Medium5.8 |
| CVE-2025-1131 | Asterisk Unsafe Shell Sourcing in safe_asterisk Leads to Local Privilege EscalationAsterisk · Asterisk | High7.0 |
| CVE-2025-2271 | IDOR in Issuetrak NewAuditID parameter via Inv_PopTrakXShow.aspissuetrak · audit | High7.7 |
| CVE-2025-1135 | SQL Injection in ChurchCRM CurrentFundraiser Parameter via BatchWinnerEntry.phpChurchCRM · ChurchCRM | Critical9.3 |
| CVE-2025-1134 | SQL Injection in ChurchCRM CurrentFundraiser Parameter via DonatedItemEditor.phpChurchCRM · ChurchCRM | Critical9.3 |
| CVE-2025-1133 | SQL Injection in ChurchCRM EID Parameter via EditEventAttendees.phpChurchCRM · ChurchCRM | Critical9.3 |
| CVE-2025-1132 | SQL Injection in ChurchCRM EN_tyid Parameter via EditEventAttendees.phpChurchCRM · ChurchCRM | Critical9.3 |
| CVE-2025-1024 | Session Hijacking via Reflected Cross-Site Scripting (XSS) in ChurchCRM EditEventAttendees.php EID ParameterChurchCRM · ChurchCRM | High8.4 |
| CVE-2025-1023 | SQL Injection in ChurchCRM newCountName Parameter via EditEventTypes.phpChurchCRM · ChurchCRM | Critical9.3 |
| CVE-2025-0981 | Session Hijacking via Stored Cross-Site Scripting (XSS) in ChurchCRM GroupEditor.php Description FieldChurchCRM · ChurchCRM | High8.4 |