Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 5 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 400,959All CVEsplus 19,118 rejected
- 394Last 24 hours2,830 in the last 7 days
- 16,815Last 30 days1,549 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 0 | 0 | 0 | 0 | 0 | 0 | 43 |
| 2025 | 0 | 0 | 0 | 0 | 0 | 0 | 43 |
| 2024 | 0 | 2 | 2 | 0 | 0 | 4 | 43 |
| 2023 | 2 | 5 | 9 | 1 | 0 | 17 | 39 |
| 2022 | 4 | 5 | 6 | 0 | 0 | 15 | 22 |
| 2021 | 0 | 5 | 2 | 0 | 0 | 7 | 7 |
| Title | ||
|---|---|---|
| CVE-2024-8796 | Insufficient Default OTP Shared Secret Lengthdevise-two-factor · devise-two-factor | Medium6.0 |
| CVE-2024-5184 | Prompt Injection in EmailGPTEmailGPT · EmailGPT | High8.5 |
| CVE-2024-5185 | Data Poisoning in EmbedAISamurAIGPT · EmbedAI | High8.3 |
| CVE-2024-0226 | Stored Cross-Site Scripting in Synopsys SeekerSynopsys · Seeker | Medium4.8 |
| CVE-2023-4480 | Arbitrary File Read in Fusion File ManagerPHPFusion · PHPFusion | Medium5.5 |
| CVE-2023-2453 | Local file Inclusion (LFI) in Forum Infusion via Directory TraversalPHPFusion · PHPFusion | High8.8 |
| CVE-2023-2631 | CSRF vulnerability and missing permission checks in Code Dx PluginJenkins · Jenkins Code Dx Plugin | Medium4.3 |
| CVE-2023-2195 | CSRF vulnerability and missing permission checks in Code Dx PluginJenkins · Jenkins Code Dx Plugin | Medium4.3 |
| CVE-2023-2633 | API keys stored and displayed in plain text by Code Dx PluginJenkins · Jenkins Code Dx Plugin | Medium4.3 |
| CVE-2023-2632 | API keys stored and displayed in plain text by Code Dx PluginJenkins · Jenkins Code Dx Plugin | Medium4.3 |
| CVE-2023-2196 | Missing permission checks in Code Dx PluginJenkins · Jenkins Code Dx Plugin | Medium4.3 |
| CVE-2023-25827 | Cross-site Scripting in OpenTSDBOpenTSDB · OpenTSDB | High8.2 |
| CVE-2023-25826 | Remote Code Execution in OpenTSDBOpenTSDB · OpenTSDB | Critical9.8 |
| CVE-2023-2158 | Impersonation through User-Controlled TokenSynopsys · Code Dx | Critical9.8 |
| CVE-2023-1663 | Authenticated Resources Accessible via Forced BrowsingSynopsys · Coverity | Medium6.5 |
| CVE-2023-25828 | Authenticate Remote Code Execution in Pluck CMSPluck · pluck-cms | High7.2 |
| CVE-2023-23850 | A missing permission check in Synopsys Jenkins Coverity Plugin 3.0.2 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of…Synopsys · Synopsys Jenkins Coverity Plugin | Medium4.3 |
| CVE-2023-23848 | Missing permission checks in Synopsys Jenkins Coverity Plugin 3.0.2 and earlier allow attackers with Overall/Read permission to connect to an…Synopsys · Synopsys Jenkins Coverity Plugin | Medium4.3 |
| CVE-2023-23847 | A cross-site request forgery (CSRF) vulnerability in Synopsys Jenkins Coverity Plugin 3.0.2 and earlier allows attackers to connect to an attacker-specified…Synopsys · Synopsys Jenkins Coverity Plugin | Low3.5 |
| CVE-2023-23849 | Versions of Coverity Connect prior to 2022.12.0 are vulnerable to an unauthenticated Cross-Site Scripting vulnerability. Any web service hosted on the same sub…Synopsys · Coverity | High8.1 |
| CVE-2023-23846 | Due to insufficient length validation in the Open5GS GTP library versions prior to versions 2.4.13 and 2.5.7, when parsing extension headers in GPRS tunneling…Open5GS · Open5GS | High7.5 |
| CVE-2022-45481 | The default configuration of Lazy Mouse does not require a password, allowing remote unauthenticated users to execute arbitrary code with no prior…thisAAY · Lazy Mouse | Critical9.8 |
| CVE-2022-45479 | PC Keyboard allows remote unauthenticated users to send instructions to the server to execute arbitrary code without any previous authorization or…BEAppsMobile · PC Keyboard WiFi & Bluetooth | Critical9.8 |
| CVE-2022-45478 | Telepad allows an attacker (in a man-in-the-middle position between the server and a connected device) to see all data (including keypresses) in cleartext.…Telepad · Telepad | Medium5.1 |
| CVE-2022-45477 | Telepad allows remote unauthenticated users to send instructions to the server to execute arbitrary code without any previous authorization or authentication.…Telepad · Telepad | Critical9.8 |
| CVE-2022-45483 | Lazy Mouse allows an attacker (in a man in the middle position between the server and a connected device) to see all data (including keypresses) in cleartext.…thisAAY · Lazy Mouse | Medium5.9 |
| CVE-2022-45482 | Lazy Mouse server enforces weak password requirements and doesn't implement rate limiting, allowing remote unauthenticated users to easily and quickly brute…thisAAY · Lazy Mouse | Critical9.8 |
| CVE-2022-45480 | PC Keyboard WiFi & Bluetooth allows an attacker (in a man-in-the-middle position between the server and a connected device) to see all data (including…Telepad · PC Keyboard WiFi & Bluetooth | Medium5.9 |
| CVE-2022-43945 | The Linux kernel NFSD implementation prior to versions 5.19.17 and 6.0.2 are vulnerable to buffer overflow. NFSD tracks the number of pages held by each NFSD…linux · linux_kernel | High7.5 |
| CVE-2022-39065 | A single malformed IEEE 802.15.4 (Zigbee) frame makes the TRÅDFRI gateway unresponsive, such that connected lighting cannot be controlled with the IKEA Home…Ikea · TRÅDFRI gateway system | Medium6.5 |
| CVE-2022-39064 | An attacker sending a single malformed IEEE 802.15.4 (Zigbee) frame makes the TRÅDFRI bulb blink, and if they replay (i.e. resend) the same frame multiple…Ikea · TRÅDFRI smart lighting system | High8.1 |
| CVE-2022-39063 | When Open5GS UPF receives a PFCP Session Establishment Request, it stores related values for building the PFCP Session Establishment Response. Once UPF…Open5GS · Open5GS | High7.5 |
| CVE-2022-30618 | An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email and password reset tokens, for API users if…Strapi · Strapi | High7.5 |
| CVE-2022-30617 | An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email and password reset tokens, for other admin panel…Strapi · Strapi | High8.8 |
| CVE-2022-30278 | A vulnerability in Black Duck Hub’s embedded MadCap Flare documentation files could allow an unauthenticated remote attacker to conduct a cross-site scripting…Synopsys · Black Duck Hub | Medium6.1 |
| CVE-2021-43177 | As a result of an incomplete fix for CVE-2015-7225, in versions of devise-two-factor prior to 4.0.2 it is possible to reuse a One-Time-Password (OTP) for one…Tinfoil · devise-two-factor | Medium5.3 |
| CVE-2021-43176 | The GOautodial API prior to commit 3c3a979 made on October 13th, 2021 takes a user-supplied “action” parameter and appends a .php file extension to locate and…GOautodial · GOautodial API | High8.8 |
| CVE-2021-43175 | The GOautodial API prior to commit 3c3a979 made on October 13th, 2021 exposes an API router that accepts a username, password, and action that routes to other…GOautodial · GOautodial API | High7.5 |
| CVE-2021-33179 | The general user interface in Nagios XI versions prior to 5.8.4 is vulnerable to authenticated reflected cross-site scripting. An authenticated victim, who…Nagios · Nagios XI | Medium6.1 |
| CVE-2021-33178 | The Manage Backgrounds functionality within NagVis versions prior to 1.9.29 is vulnerable to an authenticated path traversal vulnerability. Exploitation of…NagVis · NagVis | Medium6.5 |
| CVE-2021-33177 | The Bulk Modifications functionality in Nagios XI versions prior to 5.8.5 is vulnerable to SQL injection. Exploitation requires the malicious actor to be…Nagios · Nagios XI | High8.8 |
| CVE-2021-33176 | VerneMQ MQTT Broker versions prior to 1.12.0 are vulnerable to a denial of service attack as a result of excessive memory consumption due to the handling of…VerneMQ · vernemq | High7.5 |
| CVE-2021-33175 | EMQ X Broker versions prior to 4.2.8 are vulnerable to a denial of service attack as a result of excessive memory consumption due to the handling of untrusted…EMQ Technologies · EMQ X Broker | High7.5 |