Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 10 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 400,561All CVEsplus 18,890 rejected
- 402Last 24 hours3,029 in the last 7 days
- 17,425Last 30 days1,598 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 1 | 16 | 63 | 16 | 0 | 96 | 171 |
| 2025 | 0 | 7 | 6 | 1 | 0 | 14 | 75 |
| 2024 | 0 | 8 | 19 | 0 | 0 | 27 | 61 |
| 2023 | 0 | 7 | 22 | 5 | 0 | 34 | 34 |
| Title | ||
|---|---|---|
| CVE-2026-73209 | An attacker that has valid credentials can send crafted compressed data that causes the affected process to exhaust its stack and crash. The affected process…Open-Xchange GmbH · OX Dovecot Pro | Medium6.5 |
| CVE-2026-73208 | An attacker that holds a token intended for a different purpose can authenticate, because when an OAuth2 token response does not contain a scope claim, the…Open-Xchange GmbH · OX Dovecot Pro | High7.4 |
| CVE-2026-52687 | An attacker that has valid credentials can select a compression algorithm for the IMAP connection whose decompression state requires a large amount of memory,…Open-Xchange GmbH · OX Dovecot Pro | Medium6.5 |
| CVE-2026-52681 | Sieve CPU resource usage is tracked in the compiled script, so an attacker that has valid credentials can reset the accounting by repeatedly changing the…Open-Xchange GmbH · OX Dovecot Pro | Low3.1 |
| CVE-2026-42395 | A host listed as a trusted proxy can send forwarding information containing a NUL byte, which crashes the login process on the following login attempt. The…Open-Xchange GmbH · OX Dovecot Pro | Medium4.3 |
| CVE-2026-42393 | The comparison used for the doveadm password and API key is not fully timing safe and can reveal the length of the configured secret. An attacker with access…Open-Xchange GmbH · OX Dovecot Pro | Low3.1 |
| CVE-2026-42392 | An attacker that has valid credentials can send an invalid IMAP URLFETCH command, which causes uninitialized memory to be included in the error response…Open-Xchange GmbH · OX Dovecot Pro | Medium4.3 |
| CVE-2026-42391 | An unauthenticated attacker can send an IMAP ID command with a very large number of parameters before logging in, which causes memory and CPU usage to grow…Open-Xchange GmbH · OX Dovecot Pro | High7.5 |
| CVE-2026-42008 | Forwarding information received from a host listed as a trusted proxy is not kept separate from Dovecot's own authentication fields, so a value sent by that…Open-Xchange GmbH · OX Dovecot Pro | Medium4.3 |
| CVE-2026-42007 | An attacker that has valid credentials can use a Sieve script with the editheader extension to trigger a use-after-free in the mail editing code, and to write…Open-Xchange GmbH · OX Dovecot Pro | Critical9.1 |
| CVE-2026-40205 | An attacker that holds an OAuth2 token granting only part of the required scopes can authenticate, because when more than one scope is required in the…Open-Xchange GmbH · OX Dovecot Pro | Medium5.9 |
| CVE-2026-40204 | None None None No publicly available exploits are known.Open-Xchange GmbH · OX Dovecot Pro | Low3.1 |
| CVE-2026-40203 | When IMAP compression is enabled, the same compression state is reused across responses in a session, so response sizes depend on both attacker-supplied mail…Open-Xchange GmbH · OX Dovecot Pro | Low3.7 |
| CVE-2026-40019 | An unauthenticated attacker can send a truncated quoted argument to the ManageSieve login process, which makes it spin in an infinite loop consuming CPU. This…Open-Xchange GmbH · OX Dovecot CE | Medium5.9 |
| CVE-2026-40018 | None None None No publicly available exploits are known.Open-Xchange GmbH · OX Dovecot Pro | High7.4 |
| CVE-2026-40017 | An attacker that can send mail to a user can craft a message header whose values are chosen to collide in an internal hash table, which makes the IMAP THREAD…Open-Xchange GmbH · OX Dovecot Pro | Medium6.5 |
| CVE-2026-40015 | An attacker that has valid credentials can open many connections to the imap-hibernate service and send invalid commands, which can intermittently cause an…Open-Xchange GmbH · OX Dovecot Pro | Medium4.3 |
| CVE-2026-40014 | An attacker that can send mail to a user can craft a message header that makes the IMAP THREAD command consume CPU disproportionate to the size of the message.…Open-Xchange GmbH · OX Dovecot Pro | Medium6.5 |
| CVE-2026-40013 | An attacker that has valid credentials can submit a Sieve script containing an extreme numeric literal, which causes an out-of-bounds write when the…Open-Xchange GmbH · OX Dovecot Pro | Medium4.3 |
| CVE-2026-33607 | An attacker that has valid credentials can use IMAP LIST command to consume CPU. This can cause degradation or denial of service for IMAP. Monitor system for…Open-Xchange GmbH · OX Dovecot Pro | Medium4.3 |
| CVE-2026-33606 | Mail content stored by a user can be crafted so that it is interpreted as dsync protocol commands when an administrator later runs dsync with the stream…Open-Xchange GmbH · OX Dovecot Pro | Medium4.8 |
| CVE-2026-33605 | An unauthenticated attacker can crash the ManageSieve login process by sending a small malformed command before authenticating. If running in high-security…Open-Xchange GmbH · OX Dovecot Pro | High7.5 |
| CVE-2026-33604 | An attacker that can get Dovecot to relay a message, for example through Sieve redirect or submission relay, can use a crafted line ending in the message body…Open-Xchange GmbH · OX Dovecot Pro | Medium5.9 |
| CVE-2026-33263 | When mail_max_userip_connections is set (default 10) and reached, submission-login can crash with epoll() panic caused by file descriptor handling issues. If…Open-Xchange GmbH · OX Dovecot Pro | Medium4.3 |
| CVE-2026-27852 | An attacker that can send mail to a user can craft a message whose headers contain a very large number of email addresses or MIME parameters, which causes…Open-Xchange GmbH · OX Dovecot Pro | High7.5 |
| CVE-2026-52688 | RRSIGs with too few labels can lead to bypass of DNSSEC wildcard validationPowerDNS · Recursor | High7.5 |
| CVE-2026-52686 | Wildcard CNAME proof validation bypassPowerDNS · Recursor | Low3.7 |
| CVE-2026-52684 | Prefetch Feature Allows Persistent Ghost Domain Cache Poisoning AttackPowerDNS · Recursor | Low3.7 |
| CVE-2026-42389 | Reject more queries with invalid header valuesPowerDNS · Recursor | Medium5.3 |
| CVE-2026-52690 | Spoofed answers can mark an authoritative non-EDNS capablePowerDNS · Recursor | Medium5.9 |
| CVE-2026-42390 | ZONEMD validation can be bypassedPowerDNS · Recursor | Medium5.3 |
| CVE-2026-42388 | Missing input validation for catalog zonesPowerDNS · Recursor | Medium5.9 |
| CVE-2026-42387 | Insufficient input validation in ZoneToCachePowerDNS · Recursor | Medium5.9 |
| CVE-2026-40012 | Information about ECS zero scoped answers might leak to clients that use a specific ECSPowerDNS · Recursor | Medium5.3 |
| CVE-2026-33612 | ZoneToCache can poison the cachePowerDNS · Recursor | High7.5 |
| CVE-2026-42004 | EDNS options smugglingPowerDNS · DNSdist | Low3.7 |
| CVE-2026-40211 | Denial of service via crafted DoH3 queriesPowerDNS · DNSdist | Medium5.3 |
| CVE-2026-40210 | Out-of-bounds read in SetMacAddrActionPowerDNS · DNSdist | Medium4.8 |
| CVE-2026-40209 | Denial of service via IXFR queriesPowerDNS · DNSdist | Medium5.3 |
| CVE-2026-40208 | Denial of service via DoH3 queriesPowerDNS · DNSdist | Low3.7 |
| CVE-2026-40011 | Prometheus denial of service via crafted DNS queriesPowerDNS · DNSdist | Low3.7 |
| CVE-2026-42005 | Insufficient input validation of internal web serverPowerDNS · Authoritative | Medium4.3 |
| CVE-2026-41999 | Incorrect Behaviour of Views with TCP PROXY RequestsPowerDNS · Authoritative | Medium4.8 |
| CVE-2026-42002 | Concurrency and locking defects in GSS-TSIGPowerDNS · Authoritative | Medium5.9 |
| CVE-2026-42001 | Insufficient Validation of Autoprimary SOA QueriesPowerDNS · Authoritative | High7.5 |
| CVE-2026-42000 | Insufficient Validation of Names During AXFRPowerDNS · Authoritative | Medium6.8 |
| CVE-2026-42396 | Insufficient Validation of Member Zone Data May Cause Catalog Zone Transfer to FailPowerDNS · Authoritative | Medium4.9 |
| CVE-2026-42006 | An attacker can cause uncontrolled memory usage with excessive bracing over IMAP. The fix in CVE-2026-27857 was incomplete, only blocking one way of doing…Open-Xchange GmbH · OX Dovecot Pro | Medium4.3 |
| CVE-2026-40020 | Attacker can use the IMAP SETACL command to inject the anyone permission to user's dovecot-acl file even if imap_acl_allow_anyone=no. This causes folders to be…Open-Xchange GmbH · OX Dovecot Pro | Low3.1 |
| CVE-2026-40016 | Attacker can upload a malicious Sieve script over ManageSieve service (or locally) to bypass configured CPU time limits for Sieve up to 130 times of the…Open-Xchange GmbH · OX Dovecot Pro | Medium5.3 |