Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read just now.
At a glance
Published CVEs; rejected ones are not counted.
- 401,084All CVEsplus 19,119 rejected
- 501Last 24 hours2,856 in the last 7 days
- 16,884Last 30 days1,553 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 3 | 2 | 11 | 2 | 0 | 18 | 91 |
| 2025 | 0 | 0 | 5 | 2 | 0 | 7 | 73 |
| 2024 | 0 | 1 | 7 | 1 | 0 | 9 | 66 |
| 2023 | 0 | 5 | 5 | 1 | 0 | 11 | 57 |
| 2022 | 0 | 1 | 6 | 7 | 0 | 14 | 46 |
| 2021 | 0 | 1 | 10 | 7 | 0 | 18 | 32 |
| 2020 | 0 | 1 | 6 | 7 | 0 | 14 | 14 |
| Title | ||
|---|---|---|
| CVE-2026-93582 | Authentication Bypass via Spoofed Remote-User Header in HTTP Basic AuthenticationOTRS GmbH (former OTRS AG) · OTRS | Critical9.4 |
| CVE-2026-93581 | Insufficient Neutralization of Formula Elements in CSV ExportsOTRS GmbH (former OTRS AG) · OTRS | Medium6.1 |
| CVE-2026-78359 | Duplicate Identity / Identity Shadowing across CustomerUser backendsOTRS GmbH (former OTRS AG) · OTRS | Medium5.4 |
| CVE-2026-78358 | Cross-Site Request Forgery in Administrative ActionsOTRS GmbH (former OTRS AG) · OTRS | Medium4.3 |
| CVE-2026-78357 | Insufficient Session Revocation for JWT AuthenticationOTRS GmbH (former OTRS AG) · OTRS | Critical9.1 |
| CVE-2026-78356 | Unauthenticated Disclosure of Agent Frontend ConfigurationOTRS GmbH (former OTRS AG) · OTRS | Medium5.3 |
| CVE-2026-78355 | Path Traversal in SendSupportBundle allows File Deletion Outside the Intended DirectoryOTRS GmbH (former OTRS AG) · OTRS | High8.7 |
| CVE-2026-48212 | Stored XSS in external pagesOTRS GmbH (former OTRS AG) · OTRS | Medium4.8 |
| CVE-2026-48211 | Cross-Site Request Forgery in Import/Export Admin consoleOTRS GmbH (former OTRS AG) · OTRS | Medium5.4 |
| CVE-2026-48187 | Email with special content can lead to DoSOTRS AG · OTRS | Medium5.7 |
| CVE-2026-48188 | SQL Injection via MySQL Quote MethodOTRS AG · OTRS | Critical9.1 |
| CVE-2026-48189 | Bypass DedicatedAgentToCustomerGroups SettingOTRS AG · OTRS | Medium5.7 |
| CVE-2026-48190 | Incorrect handling of permissions in External Interface Config Item List moduleOTRS AG · OTRS | Low3.5 |
| CVE-2026-48191 | Wrong Permission Handling in Document Search Article Meta FiltersOTRS AG · OTRS | Low3.5 |
| CVE-2026-48208 | Denial-of-Service via SVG Rendering in TicketOTRS AG · OTRS | Medium6.5 |
| CVE-2026-48209 | Reflected XSS in authenticated agent contextOTRS AG · OTRS | High7.1 |
| CVE-2026-48210 | Possible information disclosure via External InterfaceOTRS AG · OTRS | Medium5.7 |
| CVE-2026-6060 | Possible DoS via SQL BoxOTRS AG · OTRS | Medium4.5 |
| CVE-2025-24391 | Possible user enumerationOTRS AG · OTRS | Medium5.3 |
| CVE-2025-24388 | Unsafe handling of AJAX callsOTRS AG · OTRS | Low3.8 |
| CVE-2025-24387 | Missing CSRF protectionOTRS AG · OTRS | Medium4.8 |
| CVE-2025-24390 | Missing Cookie FlagsOTRS AG · OTRS | Medium6.8 |
| CVE-2025-24389 | SMTP Password will be shown in cleartext on some SMTP errorsOTRS AG · OTRS | Medium6.3 |
| CVE-2024-43446 | Improper check of permissions in Generic InterfaceOTRS AG · OTRS | Low3.5 |
| CVE-2024-43445 | Missing X-Content-Type-Options: nosniff Header Allows MIME Type SniffingOTRS AG · OTRS | Medium5.4 |
| CVE-2024-43444 | Passwords are written to Admin Log ModuleOTRS AG · OTRS | High8.2 |
| CVE-2024-43443 | Stored XSS in process managementOTRS AG · OTRS | Medium4.9 |
| CVE-2024-43442 | Stored XSS in System ConfigurationOTRS AG · OTRS | Medium4.9 |
| CVE-2024-23794 | Agents are able to lock the ticket without the "Owner" permissionOTRS AG · OTRS | Medium5.2 |
| CVE-2024-6540 | Information exlosure in external interfaceOTRS AG · OTRS | Medium5.7 |
| CVE-2024-23793 | Upload of files outside application directoryOTRS AG · OTRS | Medium6.3 |
| CVE-2024-23790 | Missing file type check in avatar picture uploadOTRS AG · OTRS | Low3.5 |
| CVE-2024-23791 | Unnecessary data is written to log if issues during indexing occursOTRS AG · OTRS | Medium4.9 |
| CVE-2024-23792 | Insufficient access controlOTRS AG · OTRS | Medium5.3 |
| CVE-2023-6254 | Password is send back to clientOTRS AG · OTRS | High8.1 |
| CVE-2023-5421 | Possible XSS execution in customer informationOTRS AG · OTRS | Low3.5 |
| CVE-2023-38059 | External pictures can be loaded even if not allowed by configurationOTRS AG · OTRS | Medium5.3 |
| CVE-2023-5422 | SSL Certificates are not checked for E-Mail HandlingOTRS AG · OTRS | High8.7 |
| CVE-2023-38060 | Host header injection by attachments in web serviceOTRS AG · OTRS | Medium6.3 |
| CVE-2023-38058 | Tickets can be moved without permissionsOTRS AG · OTRS | Medium4.1 |
| CVE-2023-38057 | XSS stored in survey answersOTRS AG · OTRS | Medium4.1 |
| CVE-2023-38056 | Code execution via System ConfigurationOTRS AG · OTRS | High7.2 |
| CVE-2023-2534 | Information disclouse and DoS via websocket push eventsOTRS AG · OTRS | High7.6 |
| CVE-2023-1250 | Code execution through ACL creationOTRS AG · OTRS | High7.4 |
| CVE-2023-1248 | Possible XSS in Ticket ActionsOTRS AG · OTRS | Medium6.1 |
| CVE-2022-4427 | SQL Injection via OTRS Search APIOTRS AG · OTRS | Medium6.5 |
| CVE-2022-3501 | Information exposure of template content due to missing check of permissionsAccessing template content without permissions · OTRS | Low3.5 |
| CVE-2022-39052 | DoS attack using emailOTRS AG · OTRS | High7.5 |
| CVE-2022-39051 | Perl Code execution in Template ToolkitOTRS AG · OTRS | Medium6.8 |
| CVE-2022-39050 | Possible XSS stored in customer informationOTRS AG · OTRS | Medium4.6 |