Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 8 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 400,558All CVEsplus 18,890 rejected
- 408Last 24 hours3,029 in the last 7 days
- 17,426Last 30 days1,597 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 1 | 14 | 5 | 0 | 1 | 21 | 40 |
| 2025 | 1 | 5 | 6 | 0 | 0 | 12 | 19 |
| 2024 | 0 | 0 | 6 | 1 | 0 | 7 | 7 |
| Title | ||
|---|---|---|
| CVE-2026-106554 | jackson-dataformat-cbor: quadratic-time TagList growth on unbounded stacked tags (CPU/GC DoS, PoC)FasterXML · jackson-dataformat-cbor | Not scored |
| CVE-2026-110879 | jackson-databind: PolymorphicTypeValidator bypass via generic type arguments and array element types allows arbitrary class instantiation (incomplete fix for CVE-2026-54512)FasterXML · jackson-databind | Critical9.8 |
| CVE-2026-110747 | jackson-dataformat-protobuf: integer overflow in ProtobufParser._readStringKey() allows OutOfMemoryError from an 8-byte payloadFasterXML · jackson-dataformat-protobuf | High7.5 |
| CVE-2026-104895 | jackson-dataformat-smile: unbounded eager byte[] allocation for raw binary in the async parser allows OutOfMemoryError denial of serviceFasterXML · jackson-dataformat-smile | High7.5 |
| CVE-2026-104016 | jackson-dataformat-protobuf: signed integer overflow in string-length paths allows unbounded array allocation and OutOfMemoryErrorFasterXML · jackson-dataformat-protobuf | High7.5 |
| CVE-2026-68498 | jackson-core: Delayed maxNameLength enforcement for char-backed input (ReaderBasedJsonParser) allows memory-exhaustion denial of serviceFasterXML · jackson-core | High7.5 |
| CVE-2026-68496 | jackson-dataformats-binary: Smile parser does not enforce StreamReadConstraints.maxNameLength, enabling memory-exhaustion denial of serviceFasterXML · jackson-dataformats-binary | High7.5 |
| CVE-2026-68495 | jackson-dataformats-binary: CBOR parser does not enforce StreamReadConstraints.maxNameLength, enabling memory-exhaustion denial of serviceFasterXML · jackson-dataformats-binary | High7.5 |
| CVE-2026-91777 | jackson-databind: quadratic forward-reference completion in Collection and Map deserializersFasterXML · jackson-databind | High7.5 |
| CVE-2026-91776 | jackson-databind: unbounded growth of the type id cache in TypeDeserializerBase retains every unknown raw type IDFasterXML · jackson-databind | High7.5 |
| CVE-2026-89425 | jackson-core: UTF8DataInputJsonParser._reportInvalidToken() does not honor maxErrorTokenLength, allowing unbounded StringBuilder growthFasterXML · jackson-core | High7.5 |
| CVE-2026-89407 | jackson-core: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber() enables ReDoSFasterXML · jackson-core | High7.5 |
| CVE-2026-68497 | jackson-databind: unbounded numeric parse in Duration and XMLGregorianCalendar deserialization allows CPU denial of serviceFasterXML · jackson-databind | High7.5 |
| CVE-2026-83557 | jackson-databind omits java.lang.Comparable from DefaultBaseTypeLimitingValidator's unsafe base typesFasterXML · jackson-databind | Medium5.6 |
| CVE-2026-19032 | jackson-databind resolves attacker-controlled URI schemes when deserializing java.nio.file.PathFasterXML · jackson-databind | Medium5.3 |
| CVE-2026-68494 | jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for CVE-2026-18401 / GHSA-72hv-8253-57qq)FasterXML · jackson-core | High8.7 |
| CVE-2026-18401 | jackson-core: Number length constraint bypass in non-blocking (async) JSON parser leads to potential denial of serviceFasterXML · jackson-core | Medium6.9 |
| CVE-2026-11998 | AngularJS XSS via SCE resource URL sanitization bypassGoogle · AngularJS | High7.6 |
| CVE-2026-2818 | Zip Slip Path Traversal in Snapshot Archive Extraction (Windows-Specific)VMware · Spring Data Geode | High8.2 |
| CVE-2026-2817 | Spring Data Geode Insecure Temporary Directory UsageVMware · Spring Data Geode | Medium4.8 |
| CVE-2025-14505 | Elliptic Cryptanalysis vulnerability when `k` has leading zerosN/A · Elliptic | Medium5.6 |
| CVE-2025-8083 | Vuetify Prototype Pollution via Preset optionsN/A · Vuetify | High8.6 |
| CVE-2025-8082 | Vuetify XSS via unsanitized 'titleDateFormat' in 'VDatePicker'N/A · Vuetify | Medium6.3 |
| CVE-2025-36855 | EOL .NET 6.0 Runtime Remote Code Execution VulnerabilityMicrosoft · .NET 6.0 | High8.8 |
| CVE-2025-36854 | EOL ASP.NET 6.0 Remote Code Execution VulnerabilityMicrosoft · .NET 6.0 | High8.1 |
| CVE-2025-36853 | EOL .NET 6.0 Runtime Remote Code Execution VulnerabilityMicrosoft · .NET 6.0 | High7.5 |
| CVE-2025-4690 | AngularJS 'linky' filter ReDoSGoogle · AngularJS | Medium4.3 |
| CVE-2025-7326 | EOL ASP.NET Core Elevation of Privilege VulnerabilityMicrosoft · ASP.NET Core 6.0 | High7.0 |
| CVE-2025-36852 | Build Cache Poisoning via Untrusted Pull RequestsNiklas Portmann · Azure Based Remote Cache Plugin for Nx | Critical9.4 |
| CVE-2025-2336 | AngularJS improper sanitization in SVG '<image>' element with 'ngSanitize'Google · AngularJS | Medium4.8 |
| CVE-2025-1461 | Vuetify XSS through 'eventMoreText' prop of VCalendarN/A · Vuetify | Medium5.6 |
| CVE-2025-1647 | XSS in Bootstrap title attribute for Tooltip and PopoverBootstrap · Bootstrap | Medium5.6 |
| CVE-2025-0716 | AngularJS improper sanitization in SVG '<image>' elementGoogle · AngularJS | Medium4.8 |
| CVE-2024-10491 | Preload arbitrary resources by injecting additional `Link` headersexpress · express | Medium4.0 |
| CVE-2024-9506 | Regular Expression Denial of Service (ReDoS)vue · vue | Low3.7 |
| CVE-2024-9266 | Open Redirectexpressjs · express | Medium4.7 |
| CVE-2024-8373 | AngularJS improper sanitization in '<source>' elementGoogle · AngularJS | Medium4.8 |
| CVE-2024-8372 | AngularJS improper sanitization in 'srcset' attributeGoogle · AngularJS | Medium4.8 |
| CVE-2024-6783 | Vue client-side XSS via prototype pollutionvue · vue | Medium4.8 |
| CVE-2024-6485 | XSS in Bootstrap button componentBootstrap · Bootstrap | Medium6.4 |