Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 1 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 400,735All CVEsplus 19,114 rejected
- 439Last 24 hours2,854 in the last 7 days
- 17,125Last 30 days1,582 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 9 | 29 | 31 | 2 | 0 | 71 | 184 |
| 2025 | 10 | 9 | 6 | 1 | 0 | 26 | 113 |
| 2024 | 3 | 15 | 10 | 0 | 0 | 28 | 87 |
| 2023 | 0 | 4 | 6 | 0 | 0 | 10 | 59 |
| 2022 | 7 | 6 | 16 | 3 | 0 | 32 | 49 |
| 2021 | 1 | 12 | 4 | 0 | 0 | 17 | 17 |
| Title | ||
|---|---|---|
| CVE-2026-120338 | Prefab UI Pyodide sandbox escape to host RCEPrefectHQ · prefab-ui | Critical10.0 |
| CVE-2026-120308 | Beta9 host filesystem exposure via volume path traversalbeam-cloud · Beta9 gateway | Critical9.9 |
| CVE-2026-120307 | Beta9 container escape via unvalidated sandbox file pathsbeam-cloud · Beta9 worker | Critical9.9 |
| CVE-2026-120306 | Beta9 build sandbox escape via chroot-only isolationbeam-cloud · Beta9 worker | Critical9.9 |
| CVE-2026-92892 | Potential command execution on the host running JFrog CLI.jfrog · jfrog-cli | Critical9.0 |
| CVE-2026-105192 | LMCache Unauthenticated RCE in multiprocess mode via pickle deserializationLMCache · LMCache | Critical9.8 |
| CVE-2026-96456 | Reachy Mini Bluetooth PIN authentication can be bypassed by racing an authenticated devicePollen Robotics · Reachy Mini | Medium6.3 |
| CVE-2026-96455 | Reachy Mini daemon allows unauthenticated remote code execution through the app installation endpointPollen Robotics · Reachy Mini | High8.8 |
| CVE-2026-96454 | Pake grants unrestricted IPC access to every HTTPS origin loaded in generated applicationstw93 · Pake | High8.2 |
| CVE-2026-95627 | Tauri framework v2 Dialog plugin auto-expands the filesystem scope with attacker-controlled recursionTauri · tauri-plugin-dialog | High7.7 |
| CVE-2026-95626 | Tauri framework v2 CSP nonce protection bypass via data and blob URI schemes allows an XSS to RCE chainsTauri · tauri | High8.3 |
| CVE-2026-95625 | Tauri framework v2 missing updater signature version number validation can be exploited into forced downgradeTauri · tauri-plugin-updater | Medium5.9 |
| CVE-2026-95624 | Tauri framework v2 malicious downgrade via allow_downgrades from frontend codeTauri · tauri-plugin-updater | Medium6.8 |
| CVE-2026-95623 | Tauri framework v2 SSRF Protection Bypass via HTTP RedirectsTauri · tauri-plugin-http | Medium5.6 |
| CVE-2026-90898 | Bifrost unauthenticated remote code execution via MCP stdio client registrationmaximhq · Bifrost | Critical9.8 |
| CVE-2026-90894 | Parallels Desktop local privilege escalation via appliance extract argument injectionParallels · Parallels Desktop for Mac | High7.8 |
| CVE-2026-86242 | Unauthenticated RCE via Custom Plugin HTTP Path on Dynamically Linked Buildsmaximhq · Bifrost | High8.1 |
| CVE-2026-82642 | Readest: unsanitized iframe srcdoc attribute in the EPUB sanitizer can lead to arbitrary code executionreadest · readest | High8.8 |
| CVE-2026-82635 | Pake arbitrary file write via unsanitized download_file filenametw93 · Pake | High8.8 |
| CVE-2026-82329 | Potential authentication bypass leading to administrative access in ArtifactoryExploitedjfrog · artifactory | Critical9.8 |
| CVE-2026-70550 | Potential unauthorized access to private Composer repository metadata in JFrog Artifactoryjfrog · artifactory | Medium6.5 |
| CVE-2026-70548 | SSRF In CocoaPods Via JFrog Artifactory External Dependencyjfrog · artifactory | Low3.5 |
| CVE-2026-69104 | Potential unauthorized repository migration in JFrog Artifactoryjfrog · artifactory | High7.6 |
| CVE-2026-70551 | Server-Side Request Forgery Via VCS remote download in JFrog Artifactoryjfrog · artifactory | High8.5 |
| CVE-2026-69106 | Potential cache poisoning in JFrog Artifactoryjfrog · artifactory | High8.8 |
| CVE-2026-42018 | Anonymous user token generation exposure in JFrog ArtifactoryExploitedjfrog · artifactory | High7.5 |
| CVE-2026-69107 | Potential unauthorized artifact access in JFrog Artifactoryjfrog · artifactory | Medium5.9 |
| CVE-2026-69105 | Potential package cache integrity issue in JFrog Artifactoryjfrog · artifactory | High8.1 |
| CVE-2026-70547 | Potential unauthorized metadata exposure in JFrog Artifactoryjfrog · artifactory | Medium4.3 |
| CVE-2026-66016 | Rendered Artifactory Helm manifests may contain generated TLS private keysjfrog · artifactory | Medium6.7 |
| CVE-2026-68759 | Integration credential holders may impersonate users in JFrog Accessjfrog · artifactory | High7.2 |
| CVE-2026-65926 | Private Release Bundle versions may be disclosed under specific configurationsjfrog · artifactory | Low3.1 |
| CVE-2026-66384 | Authenticated users may write data outside the intended Docker cache pathExploitedjfrog · artifactory | Medium5.3 |
| CVE-2026-68758 | Authenticated users may access restricted Artifactory support informationjfrog · artifactory | Medium6.5 |
| CVE-2026-66375 | Low-privilege users may remove protected Artifactory metadatajfrog · artifactory | High8.1 |
| CVE-2026-68757 | Potential improper SAML signature verification in JFrog Artifactoryjfrog · artifactory | High7.5 |
| CVE-2026-68756 | Potential insecure deserialization in JFrog Artifactoryjfrog · artifactory | Medium6.6 |
| CVE-2026-66382 | Authenticated users may write files outside the intended Artifactory work directoryjfrog · artifactory | Medium4.3 |
| CVE-2026-66381 | Repository readers may access content outside configured upstream pathsjfrog · artifactory | Medium5.3 |
| CVE-2026-68760 | Potential remember-me authentication bypass in JFrog Artifactoryjfrog · artifactory | Medium5.3 |
| CVE-2026-66379 | Authenticated users may view private Puppet module metadatajfrog · artifactory | Medium4.3 |
| CVE-2026-66378 | Authenticated users may access private NuGet metadatajfrog · artifactory | Medium4.3 |
| CVE-2026-66377 | Anonymous users may access restricted Artifactory repository informationjfrog · artifactory | Medium5.3 |
| CVE-2026-68755 | Bundle writers may alter trusted release information in JFrog Artifactoryjfrog · artifactory | Medium4.3 |
| CVE-2026-66380 | Authenticated users may access private OCI referrer metadatajfrog · artifactory | Medium4.3 |
| CVE-2026-68754 | Publishers without delete permission can overwrite docker layer informationjfrog · artifactory | Medium6.5 |
| CVE-2026-68753 | Anonymous users may access restricted Artifactory content under specific configurationsjfrog · artifactory | Medium5.3 |
| CVE-2026-66376 | Deleted users may temporarily retain access to JFrog Artifactoryjfrog · artifactory | Medium4.2 |
| CVE-2026-68752 | Project Resource Managers may escalate privileges in JFrog Artifactoryjfrog · artifactory | High7.2 |
| CVE-2026-65922 | Potential unauthorized modification of Artifactory internal metadatajfrog · artifactory | High7.1 |