Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 9 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,334All CVEsplus 19,141 rejected
- 443Last 24 hours2,721 in the last 7 days
- 16,928Last 30 days1,562 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 11 | 10 | 4 | 0 | 0 | 25 | 37 |
| 2025 | 4 | 1 | 1 | 0 | 0 | 6 | 12 |
| 2024 | 1 | 2 | 1 | 0 | 0 | 4 | 6 |
| 2023 | 1 | 1 | 0 | 0 | 0 | 2 | 2 |
| Title | ||
|---|---|---|
| CVE-2026-71881 | Cross-site scripting in Integrated Publishing ToolkitGBIF · Integrated Publishing Toolkit | Medium4.8 |
| CVE-2026-116606 | Authentication Bypass Allows Global Configuration Restore in Barracuda Email Security GatewayBarracuda Networks · Barracuda Email Security Gateway (ESG) | Critical9.3 |
| CVE-2026-111560 | OS Command Injection in Barracuda AppliancesBarracuda Networks · Barracuda Email Security Gateway (ESG) | High8.6 |
| CVE-2026-104384 | Insufficiently protected credentials in EagleCloud Aquila on-premises versionEagleCloud · Aquila | High8.7 |
| CVE-2026-104383 | Code injection in EagleCloud Aquila on-premises versionEagleCloud · Aquila | Critical9.4 |
| CVE-2026-105044 | OS Command Injection in Qingteng Host Adaptive Security Platform Security ToolboxQingteng · Host Adaptive Security Platform | High8.5 |
| CVE-2026-114198 | Deserialization of untrusted data in flossMandiant FLARE · floss | High8.7 |
| CVE-2026-114197 | Deserialization of untrusted data in capaMandiant FLARE · capa | High8.7 |
| CVE-2026-55396 | Unencrypted UDP Control Traffic in Teledyne FLIR Robots running Aware2Teledyne FLIR · Aware2 | High8.5 |
| CVE-2026-55395 | Hardcoded Passwords in Teledyne FLIR Robots running Aware2Teledyne FLIR · Aware2 | Critical9.4 |
| CVE-2026-55394 | Unencrypted 802.11 Network in Teledyne FLIR Robots running Aware2Teledyne FLIR · Aware2 | Medium5.3 |
| CVE-2026-55393 | Local File Inclusion in Teledyne FLIR Robots running Aware2Teledyne FLIR · Aware2 | Critical10.0 |
| CVE-2026-14984 | Cleartext HTTP for Control Traffic in Teledyne FLIR Robots running Aware2Teledyne FLIR · Aware2 | Critical9.4 |
| CVE-2026-14983 | Missing Authentication in Teledyne FLIR Robots running Aware2Teledyne FLIR · Aware2 | High7.1 |
| CVE-2025-9211 | Cross-site scripting in Otalio Ship Property Management SystemOtalio · Ship Property Management System | Medium6.7 |
| CVE-2025-9210 | Missing JSON Web Token signature validation in Otalio Ship Property Management SystemOtalio · Ship Property Management System | High8.1 |
| CVE-2026-71880 | Server-side template injection in Integrated Publishing ToolkitGBIF · Integrated Publishing Toolkit | High7.6 |
| CVE-2026-71879 | Authentication bypass in Integrated Publishing ToolkitGBIF · Integrated Publishing Toolkit | Critical9.1 |
| CVE-2026-71878 | Authentication bypass in Integrated Publishing ToolkitGBIF · Integrated Publishing Toolkit | Critical9.2 |
| CVE-2026-5426 | KnowledgeDeliver deployments before February 24, 2026 use a static ASP.NET/IIS machineKey valueDigital Knowledge · KnowledgeDeliver | Critical9.1 |
| CVE-2025-57796 | Use of a hardcoded static key to protect sensitive data in Explorance BlueExplorance · Blue | Medium6.8 |
| CVE-2025-57795 | Unauthenticated Remote File Download in Explorance BlueExplorance · Blue | Critical9.9 |
| CVE-2025-57794 | Unrestricted File Upload Vulnerability in Explorance BlueExplorance · Blue | Critical9.1 |
| CVE-2025-57792 | SQL Injection Vulnerability in Explorance BlueExplorance · Blue | Critical10.0 |
| CVE-2025-57793 | SQL Injection Vulnerability in Explorance BlueExplorance · Blue | High8.6 |
| CVE-2025-12480 | Triofox versions prior to 16.7.10368.56560, are vulnerable to an Improper Access Control flaw that allows access to initial setup pages even after setup is…ExploitedTrioFox · TrioFox | Critical9.1 |
| CVE-2025-4665 | WordPress plugin Contact Form CFDB7 versions up to and including 1.3.2 are affected by a pre-authentication SQL injection vulnerability that cascades into…WordPress Contact Form 7 Database Addon CFDB7 By Arshid · CFDB7 | Critical9.6 |
| CVE-2025-2172 | Aviatrix Controller versions prior to 7.1.4208, 7.2.5090, and 8.0.0 fail to sanitize user input prior to passing the input to command line utilities, allowing…Aviatrix · Controller | Medium6.6 |
| CVE-2025-2171 | Aviatrix Controller versions prior to 7.1.4208, 7.2.5090, and 8.0.0 do not enforce rate limiting on password reset attempts, allowing adversaries to brute…Aviatrix · Controller | High7.8 |
| CVE-2024-12442 | Command injection in EnerSys AMPA versions 24.04 through 24.16, inclusiveEnerSys · AMPA | Critical9.8 |
| CVE-2024-11861 | Command injection in EnerSys AMPA 22.09 and prior versionsEnerSys · AMPA | Critical9.8 |
| CVE-2023-6080 | Privilege Escalation to SYSTEM in Lakeside Software InstallerLakeside Software · SysTrack LsiAgent Installer | High7.8 |
| CVE-2024-6586 | Lightdash version 0.1024.6 allows users with the necessary permissions, such as Administrator or Editor, to create and share dashboards. A dashboard that…Lightdash · Lightdash | High7.3 |
| CVE-2024-6585 | Multiple stored cross-site scripting (“XSS”) vulnerabilities in the markdown dashboard and dashboard comment functionality of Lightdash version 0.1024.6 allows…Lightdash · Lightdash | Medium5.4 |
| CVE-2023-4472 | Cryptographically weak PRNG in Opinio 7.22Objectplanet · Opinio | Critical9.8 |
| CVE-2023-7102 | Remote Code Execution (RCE) VulnerabilityBarracuda Networks Inc. · Barracuda ESG Appliance | Critical9.8 |
| CVE-2023-7101 | Arbitrary Code Execution (ACE) VulnerabilityExploitedDouglas Wilson · Spreadsheet::ParseExcel | High7.8 |