Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 9 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,334All CVEsplus 19,141 rejected
- 442Last 24 hours2,720 in the last 7 days
- 16,913Last 30 days1,562 of them critical
- 1,769Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 1 | 121 | 67 | 2 | 0 | 191 | 219 |
| 2025 | 2 | 15 | 11 | 0 | 0 | 28 | 28 |
| Title | ||
|---|---|---|
| CVE-2026-109683 | UPnP Newline Injection Vulnerability in TP-Link Archer BE805TP-Link Systems Inc. · Archer BE805 v1 | Medium5.3 |
| CVE-2026-118865 | Authenticated OS Command Injection in Archer AX3000 v2 Offline Download ComponentTP-Link Systems Inc. · Archer AX3000 v2 | High7.3 |
| CVE-2026-105822 | Server-Side Request Forgery in Tapo Cloud MQTT ProxyTP-Link Systems Inc. · Tapo Cloud Service | High8.3 |
| CVE-2026-105821 | Broken Access Control Leading to Cross-Device Token Issuance in Tapo Cloud MQTT ProxyTP-Link Systems Inc. · Tapo Cloud Service | High8.3 |
| CVE-2026-102816 | Unauthenticated Wireless Regulatory Region Configuration in TP-Link RE305TP-Link Systems Inc. · RE305 v3 | Medium5.3 |
| CVE-2026-102815 | Command Injection in tmpServer Allows Local Privilege Escalation in TP-Link RE305TP-Link Systems Inc. · RE305 v3 | Medium6.9 |
| CVE-2026-102814 | Improper Authentication in TP-Link TDDP v2 Allows Root Command Execution in TP-Link RE305TP-Link Systems Inc. · RE305 v3 | High8.7 |
| CVE-2026-102813 | Administrator Password Reset Through the Verification-Code Interface in TP-Link RE305TP-Link Systems Inc. · RE305 v3 | Medium6.1 |
| CVE-2026-102812 | Hardcoded AES-128 Key and Fixed IV in Configuration Backup Encryption in TP-Link RE305 and Archer C7TP-Link Systems Inc. · RE305 v3 | Medium6.9 |
| CVE-2026-100420 | Information disclosure vulnerability in the cloud-client daemon of Deco BE63TP-Link Systems Inc. · Deco BE63 V2.0 | Medium6.8 |
| CVE-2026-89052 | Hardcoded AES encryption key in Archer C6TP-Link Systems Inc. · Archer C6 V2 | Medium5.9 |
| CVE-2026-105815 | Credential Material Exposure Leading to Unauthorized Streamed Media-Session Access in TP-Link Tapo C210TP-Link Systems Inc. · Tapo C210 v3.6 | High7.1 |
| CVE-2026-105814 | Order-Dependent Authentication Bypass in the DS JSON API in TP-Link Tapo C210TP-Link Systems Inc. · Tapo C210 v3.6 | Medium5.3 |
| CVE-2026-105810 | Authenticated Local Stack Overflow in TP-Link Tapo C320WSTP-Link Systems Inc. · Tapo C320WS v2 | High8.5 |
| CVE-2026-107795 | Improper Authorization in TP-Link Omada Controller TLS Certificate and Private Key Management APITP-Link Systems Inc. · Omada Software Controller | High7.5 |
| CVE-2026-102298 | Insufficient Authorization and User Boundary Validation in Omada Controller MSPTP-Link System Inc. · Omada Software Controller (Windows) | High7.5 |
| CVE-2026-109506 | Improper Authentication in Multiple TP-Link WiFi RepeatersTP-Link Systems Inc. · RE190 v5 | Medium5.9 |
| CVE-2026-108473 | Improper Authentication and Credential Exposure in Multiple TP-Link Kasa DevicesTP-Link Systems Inc. · HS103 v5 | High8.7 |
| CVE-2026-105674 | Predictable Media Stream Pre-Shared Key Vulnerability in TP-Link Tapo C325WBTP-Link Systems Inc. · Tapo C325WB v2 | High8.7 |
| CVE-2026-105672 | Unauthenticated JSON API Authorization Bypass Vulnerability in TP-Link Tapo C325WBTP-Link Systems Inc. · Tapo C325WB v2 | High8.7 |
| CVE-2026-105673 | Unauthenticated RTSP Tunnel Denial-of-Service Vulnerability in TP-Link Tapo C325WBTP-Link Systems Inc. · Tapo C325WB v2 | High7.1 |
| CVE-2026-102368 | Plaintext Storage of a Device-Specific Private Key in Tapo S505 FirmwareTP-Link System Inc. · Tapo S505 v1.6 | Medium5.4 |
| CVE-2026-104945 | Authenticated ONVIF PTZ Out-of-Bounds Stack Write Denial of Service in TP-Link Tapo C500TP-Link Systems Inc. · Tapo C500 v2.0 | Medium6.8 |
| CVE-2026-104944 | Unauthenticated TDP Function Pointer Dispatch Denial of Service in TP-Link Tapo C500TP-Link Systems Inc. · Tapo C500 v2.0 | High7.1 |
| CVE-2026-102370 | Physical UART Access Leading to an Unauthenticated Root Shell in TP-Link Kasa EC70 and EC71TP-Link Systems Inc. · Kasa EC70 V4 | Medium5.4 |
| CVE-2026-84682 | TDDPv2 setProductVer Command Injection in Archer AX90TP-Link Systems Inc. · Archer AX90 v1 | High7.7 |
| CVE-2026-8618 | Pre-Authentication Stack-based Buffer Overflow Remote Code Execution in TDDPv2 Subtype 0x91 on Deco M9 PlusTP-Link Systems Inc. · Deco M9 Plus V2 | High7.7 |
| CVE-2026-102369 | Unauthenticated Remote Code Execution via MacTool Command Injection in TP-Link Tapo C120 & C200TP-Link Systems Inc. · Tapo C200 v5 | High8.7 |
| CVE-2026-78578 | Unauthenticated do Method Onboarding Connect Allows Wi‑Fi Reconfiguration Denial of Service Vulnerability in TP-Link Tapo C120 & C200TP-Link Systems Inc. · Tapo C200 v5 | High7.1 |
| CVE-2026-78577 | Unauthenticated Onboarding Scan Information Disclosure in TP-Link Tapo C120 & C200TP-Link Systems Inc. · Tapo C200 v5 | Medium5.3 |
| CVE-2026-9032 | Unauthenticated Onboarding Connect NULL Pointer Dereference Denial of Service Vulnerability in TP-Link Tapo C120 & C200TP-Link Systems Inc. · Tapo C200 V5 | High7.1 |
| CVE-2026-102294 | Authenticated OS Command Injection in TL-WR841N IPv6 WAN ConfigurationTP-Link System Inc. · TL-WR841N v14 | High8.5 |
| CVE-2026-84941 | Omada Controller XML External Entity (XXE) Injection in SAML IdP Metadata Parsing Leading to Arbitrary Local File ReadTP-Link Systems Inc. · Omada Software Controller (Windows) | Medium6.9 |
| CVE-2026-17176 | OS Command Injection Vulnerability in Deco DevicesTP-Link Systems Inc. · Deco BE11000 V2 | High7.7 |
| CVE-2026-76652 | Authenticated Directory Traversal Vulnerability in File Upload Functionality in TP-Link TL-MR6400 and Archer MR600TP-Link Systems Inc. · TL-MR6400 v8 | Medium4.8 |
| CVE-2026-76653 | Missing Authentication in VPN Configuration Management in TP-Link TL-MR6400 and Archer MR600TP-Link Systems Inc. · TL-MR6400 v8 | Medium5.3 |
| CVE-2026-85384 | Authenticated Stack-Based Buffer Overflow in RE210 AC750 Configuration ImportTP-Link Systems Inc. · RE210 AC750 | High8.5 |
| CVE-2026-81531 | Unauthenticated Account Information Disclosure in Multiple Omada ControllersTP-Link System Inc. · Omada Software Controller | Medium6.9 |
| CVE-2026-18167 | Stack-based buffer overflow in TP-Link Archer AX55 v4TP-Link Systems Inc. · Archer AX55 v4 | High7.7 |
| CVE-2026-18330 | Hardcoded Shared RSA-1024 Private Key in Web Login in TP-Link RE305 and Archer C7TP-Link Systems Inc. · RE305 v3 | Medium6.1 |
| CVE-2026-75118 | http_gdpr_decrypt Pre-Authentication Stack-Based Buffer OverflowTP-Link Systems Inc. · TL-MR100 v3.20 | High8.7 |
| CVE-2026-76651 | Pre-Authentication Multipart Boundary Buffer Overflow in HTTP Service in TP-Link TL-WR841NTP-Link System Inc. · TL-WR841N v14 | Medium5.3 |
| CVE-2026-76650 | Pre-Authentication NULL Pointer Dereference in UPnP SOAP State Variable Query Processing in TP-Link TL-WR841NTP-Link System Inc. · TL-WR841N v14 | Medium5.3 |
| CVE-2026-76649 | Pre-Authentication NULL Pointer Dereference in UPnP SOAP Action Request Processing in TP-Link TL-WR841NTP-Link System Inc. · TL-WR841N v14 | Medium5.3 |
| CVE-2026-76784 | Insufficient Cryptographic Protections in Local Device Communication Protocol on Multiple TP-Link Kasa Smart Home DevicesTP-Link Systems Inc. · HS103P3 / HS103P4 v5 | High8.7 |
| CVE-2026-78541 | Command Injection in Parent Control of TP-Link Archer BE3600 v1TP-Link Systems Inc. · Archer BE3600 v1 | High8.5 |
| CVE-2026-16348 | Command Injection Vulnerability in VPN connection of Archer BE800TP-Link Systems Inc. · Archer BE800 v1 | High8.5 |
| CVE-2026-9254 | Command Injection Vulnerability in Parent Control of Multiple TP-Link Archer DevicesTP-Link Systems Inc. · Archer BE800 V1 | High8.7 |
| CVE-2026-15469 | Hard-coded Mesh Group Private Key in TP-Link Deco XE75, XE5300, and WE10800TP-Link Systems Inc. · Deco XE75 v3 / XE5300 v3.6/ WE10800 v3.6 | High7.7 |
| CVE-2026-17252 | Unauthenticated Denial of Service via Composed HTTP Parsing and Stack-Based Out-of-Bounds Write Vulnerability in TL-MR6400 Web Management InterfaceTP-Link Systems Inc. · TL-MR6400 v7.0 | High7.1 |