Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 6 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,360All CVEsplus 19,141 rejected
- 468Last 24 hours2,746 in the last 7 days
- 16,919Last 30 days1,564 of them critical
- 1,769Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 8 | 30 | 22 | 0 | 0 | 60 | 131 |
| 2025 | 6 | 7 | 16 | 0 | 0 | 29 | 71 |
| 2024 | 4 | 17 | 19 | 0 | 0 | 40 | 42 |
| 2023 | 1 | 0 | 1 | 0 | 0 | 2 | 2 |
| Title | ||
|---|---|---|
| CVE-2026-4952 | Stored Cross-Site Scripting in OrderAdministration Portal (AuftragsManager) via Business Reference in VertiGIS WebOrderSystemVertiGIS Ltd. · WebOrderSystem (AuftragsManager) | Medium5.1 |
| CVE-2026-4951 | Reflected Cross-Site Scripting in CustomerAdministration Portal (KundenManager)in VertiGIS WebOrderSystemVertiGIS Ltd. · WebOrderSystem (KundenManager) | Medium5.1 |
| CVE-2026-4950 | Stored Cross-Site Scripting in CustomerAdministration Portal (KundenManager) in VertiGIS WebOrderSystemVertiGIS Ltd. · WebOrderSystem (KundenManager) | Medium4.8 |
| CVE-2026-4638 | Plaintext Password Disclosure via VBScript Sensor Error Message in Paessler PRTG Network MonitorPaessler GmbH · PRTG Network Monitor | High7.1 |
| CVE-2026-4637 | Reflected Cross-Site Scripting via URL Path in Paessler PRTG Network MonitorPaessler GmbH · PRTG Network Monitor | Medium5.1 |
| CVE-2025-10560 | Hardcoded cloud credentials in Worksnaps client application binaries expose production cloud resourcesSilver Leaf Technologies, Inc. · Worksnaps.net Worksnaps | Critical9.3 |
| CVE-2026-11858 | Missing authorization in Quanos SCHEMA ST4 Client Update Service allows arbitrary file overwrite as SYSTEMQuanos Solutions GmbH · SCHEMA ST4 | High8.4 |
| CVE-2026-11857 | Insecure .NET Remoting deserialization in Quanos SCHEMA ST4 Client Update Service allows local privilege escalationQuanos Solutions GmbH · SCHEMA ST4 | High8.4 |
| CVE-2026-12225 | syracom Secure Login (2FA) for Confluence allows 2FA bypass via spoofed User-Agentsyracom AG · Secure Login (2FA) for Jira | High8.7 |
| CVE-2026-34030 | Improper branch-code validation in Wertheim SafeController Software allows file path manipulationWertheim GmbH · Wertheim SafeController Software for VAULT ROOMS (Safe Deposit Locker System) | Medium6.9 |
| CVE-2026-34029 | Hard-coded cryptographic key in Wertheim SafeController Software allows decryption of sensitive configuration dataWertheim GmbH · Wertheim SafeController Software for VAULT ROOMS (Safe Deposit Locker System) | Medium6.8 |
| CVE-2026-34028 | Unauthenticated direct access to web data in Wertheim SafeController Software exposes filesWertheim GmbH · Wertheim SafeController Software for VAULT ROOMS (Safe Deposit Locker System) | Medium6.9 |
| CVE-2026-34027 | Upload restriction bypass in Wertheim SafeController Software allows authenticated users to upload arbitrary filesWertheim GmbH · Wertheim SafeController Software for VAULT ROOMS (Safe Deposit Locker System) | Medium5.3 |
| CVE-2026-34026 | Path traversal in Wertheim SafeController Software allows authenticated users to download arbitrary filesWertheim GmbH · Wertheim SafeController Software for VAULT ROOMS (Safe Deposit Locker System) | High7.1 |
| CVE-2026-34025 | IP restriction bypass in Wertheim SafeController Software allows logins from unauthorized network locationsWertheim GmbH · Wertheim SafeController Software for VAULT ROOMS (Safe Deposit Locker System) | Medium5.3 |
| CVE-2026-34024 | Missing authorization checks in Wertheim SafeController Software allow low-privileged users to access restricted functionsWertheim GmbH · Wertheim SafeController Software for VAULT ROOMS (Safe Deposit Locker System) | High8.6 |
| CVE-2026-34023 | Broken WebSocket authorization in Wertheim SafeController Software allows cross-branch access to restricted functionsWertheim GmbH · Wertheim SafeController Software for VAULT ROOMS (Safe Deposit Locker System) | High7.1 |
| CVE-2026-34022 | Weak custom cryptography and hard-coded keys in Wertheim SafeController 65000 allow traffic decryptionWertheim GmbH · Wertheim SafeController Family 65000 Hardware for VAULT ROOMS (Safe Deposit Locker System - Microcontroller) | High7.1 |
| CVE-2026-34021 | Lack of cryptographic protection in Wertheim SafeController 5400 enables RS-485 message sniffing and replayWertheim GmbH · Wertheim SafeController 5400 Hardware for VAULT ROOMS (Safe Deposit Locker System - Microcontroller) | High8.6 |
| CVE-2026-24067 | Slate Digital Connect macOS XPC PID validation privilege escalationSlate Digital LLC · Slate Digital Connect | High8.4 |
| CVE-2026-24066 | Slate Digital Connect macOS XPC certificate validation privilege escalationSlate Digital LLC · Slate Digital Connect | High8.4 |
| CVE-2026-24065 | Local Privilege Escalation via Insecure XPC Client Validation in Waves Central for macOSWaves Audio Ltd. · Waves Central | High8.1 |
| CVE-2026-24064 | Local Privilege Escalation via Dynamic Library Injection in Waves Central for macOSWaves Audio Ltd. · Waves Central | High7.8 |
| CVE-2025-10539 | Improper TLS Certificate Validation RCE via Malicious Update in DeskTime Time Tracking AppDeskTime · DeskTime Time Tracking App | Medium4.8 |
| CVE-2025-10549 | DLL Hijacking in EfficientLab Controlio Leads to Local Privilege EscalationEfficientLab, LLC · Controlio | Medium5.1 |
| CVE-2026-24069 | Improper Enforcement of Disabled Accounts in WebUI SSO in Kiuwan SASTKiuwan · SAST | Medium5.4 |
| CVE-2026-24068 | Missing XPC Client & NSXPC endpoint validation leads to privilege escalation in Vienna Assistant (MacOS) - Vienna Symphonic LibraryVienna Symphonic Library GmbH · Vienna Assistant | High8.8 |
| CVE-2026-24063 | World-writable uninstall script executed as root in Arturia Software CenterArturia · Software Center | High8.2 |
| CVE-2026-24062 | Insufficient XPC Client validation leading to local privilege escalation in Arturia Software CenterArturia · Software Center | High7.8 |
| CVE-2025-10010 | Integrity Validation Bypass in CryptoPro Secure Disk for BitLockerCPSD IT SERVICES GMBH · CryptoPro Secure Disk for BitLocker | Medium6.8 |
| CVE-2025-15563 | Broken Access Control results in Denial of Service in NesterSoft WorkTimeNesterSoft Inc. · WorkTime (on-prem/cloud) | Medium5.3 |
| CVE-2025-15562 | Reflected Cross-Site Scripting in NesterSoft WorkTimeNesterSoft Inc. · WorkTime (on-prem/cloud) | Medium6.1 |
| CVE-2025-15561 | Local Privilege Escalation in NesterSoft WorkTimeNesterSoft Inc. · WorkTime (on-prem/cloud) | High7.8 |
| CVE-2025-15560 | SQL Injection in NesterSoft WorkTimeNesterSoft Inc. · WorkTime (on-prem/cloud) | High8.8 |
| CVE-2025-15559 | Unauthenticated OS Command Injection in NesterSoft WorkTimeNesterSoft Inc. · WorkTime (on-prem/cloud) | Critical9.8 |
| CVE-2025-15574 | Insecure Credential Generation for Solax Power Pocket WiFi models MQTT Cloud ConnectionSolaX Power · Pocket WiFi 3.0 | Medium6.5 |
| CVE-2025-15575 | Missing Firmware Authenticity Checks in Solax Power Pocket WiFi modelsSolaX Power · Pocket WiFi 3.0 | Medium5.3 |
| CVE-2025-15573 | Missing Certificate Validation for Solax Power Pocket WiFi models MQTT Cloud ConnectionSolaX Power · Pocket WiFi 3.0 | Critical9.4 |
| CVE-2026-24071 | XPC Client Validation via PID leading to Local Privilege Escalation in Native Instruments Native AccessNative Instruments · Native Access | High7.8 |
| CVE-2026-24070 | Local Privilege Escalation via DYLIB Injection in Native Instruments Native AccessNative Instruments · Native Access | High8.8 |
| CVE-2025-59109 | UART Leaking Sensitive Data in dormakaba registration unit 9002dormakaba · dormakaba registration unit 9002 | Medium5.1 |
| CVE-2025-59108 | Weak Default Passwords in dormakaba access managerdormakaba · Access Manager 92xx-k5 | Critical9.2 |
| CVE-2025-59107 | Static Firmware Encryption Password in dormakaba access managerdormakaba · Access Manager 92xx-k5 | High8.5 |
| CVE-2025-59106 | Web Server Running with Root Privileges in dormakaba access managerdormakaba · Access Manager 92xx-k7 | High8.8 |
| CVE-2025-59105 | Unencrypted Flash Storage in dormakaba access managerdormakaba · Access Manager 92xx-k5 | High7.0 |
| CVE-2025-59104 | Unlocked Bootloader in dormakaba access managerdormakaba · Access Manager 92xx-k7 | High7.0 |
| CVE-2025-59103 | Weak Default Passwords for SSH Access in dormakaba access managerdormakaba · Access Manager 92xx-k5 | Critical9.2 |
| CVE-2025-59102 | Secrets Stored in Plaintext in Database in dormakaba access managerdormakaba · Access Manager 92xx-k5 | Medium6.9 |
| CVE-2025-59101 | Insufficient Session Management in dormakaba access managerdormakaba · Access Manager 92xx-k5 | High7.7 |
| CVE-2025-59100 | Unauthenticated Access to the SQLite Database in dormakaba access managerdormakaba · Access Manager 92xx-k5 | Medium5.9 |