Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 5 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 400,587All CVEsplus 18,890 rejected
- 354Last 24 hours2,959 in the last 7 days
- 17,106Last 30 days1,583 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 373 | 613 | 5,078 | 180 | 0 | 6,244 | 17,859 |
| 2025 | 52 | 657 | 5,038 | 154 | 0 | 5,901 | 11,615 |
| 2024 | 11 | 438 | 2,210 | 271 | 0 | 2,930 | 5,714 |
| 2023 | 5 | 125 | 1,232 | 569 | 0 | 1,931 | 2,784 |
| 2022 | 1 | 75 | 467 | 310 | 0 | 853 | 853 |
| Title | ||
|---|---|---|
| CVE-2026-123022 | agentscope-ai AgentScope MCP Workspace API _config.py subprocess.Popen os command injectionagentscope-ai · AgentScope | Medium6.9 |
| CVE-2026-123020 | eosphoros-ai DB-GPT Jinja2 Template __init__.py FileBasedSkill.get_prompt special elements in template engineeosphoros-ai · DB-GPT | Medium5.3 |
| CVE-2026-123019 | eosphoros-ai DB-GPT HuggingFace Adapter hf_adapter.py exec_module inclusion of functionality from untrusted control sphereeosphoros-ai · DB-GPT | Medium6.9 |
| CVE-2026-123018 | eosphoros-ai DB-GPT CodeAction code_utils.py execute_code code injectioneosphoros-ai · DB-GPT | Medium6.9 |
| CVE-2026-122236 | OpenHands Landing missing authenticationOpenHands | Medium5.3 |
| CVE-2026-122191 | itsourcecode Airline Reservation System manage_booked.php sql injectionitsourcecode · Airline Reservation System | Medium5.3 |
| CVE-2026-122190 | SourceCodester Online Food Ordering System Category Management add_category.php cross site scriptingSourceCodester · Online Food Ordering System | Medium4.8 |
| CVE-2026-122189 | OpenPPL ppl.nn CUDA Optimizer opt_graph.cc InitQuantization out-of-boundsOpenPPL · ppl.nn | Medium5.3 |
| CVE-2026-122188 | DeepGraphLearning KnowledgeGraphEmbedding Checkpoint Loading run.py override_config path traversalDeepGraphLearning · KnowledgeGraphEmbedding | Medium5.3 |
| CVE-2026-122160 | myshell-ai AIlice HuggingFace Model Wrapper AModelCausalLM.py LoadModel_PEFT inclusion of functionality from untrusted control spheremyshell-ai · AIlice | Medium5.3 |
| CVE-2026-122159 | Edge0-AI Audio8_TTS Model Path Resolution runtime.py ArkTtsRuntime.__init__ path traversalEdge0-AI · Audio8_TTS | Medium5.3 |
| CVE-2026-122158 | InvoiceShelf MemberService.php create access controlInvoiceShelf | Medium5.1 |
| CVE-2026-122157 | Purocean Yank Note Terminal index.ts checkPermission os command injectionPurocean · Yank Note | Medium5.3 |
| CVE-2026-122154 | purocean Yank Note Settings Endpoint index.ts config.getAll information disclosurepurocean · Yank Note | Medium6.9 |
| CVE-2026-122151 | Presenton User Configuration user-config JSON.parse cross-site request forgeryPresenton | Medium5.3 |
| CVE-2026-122146 | 101arrowz fflate index.mjs unzipSync memory corruption101arrowz · fflate | Medium6.9 |
| CVE-2026-122144 | nliautaud pico-content-editor cross-site request forgerynliautaud · pico-content-editor | Medium5.3 |
| CVE-2026-122052 | laspy LAS File lasreader.py memory allocationlaspy | Medium5.3 |
| CVE-2026-122051 | Edimax BR-6208AC mp command injectionEdimax · BR-6208AC | Critical10.0 |
| CVE-2026-122050 | Campcodes Complete Sales and Inventory System with Credit Management login.php sql injectionCampcodes · Complete Sales and Inventory System with Credit Management | Medium6.9 |
| CVE-2026-122049 | Campcodes Bitcoin Wallet System ForgotPasswordController.php random_int excessive authenticationCampcodes · Bitcoin Wallet System | Medium6.3 |
| CVE-2026-122048 | Campcodes Division Regional Athletic Meet Game Result Matrix System check-user.php sql injectionCampcodes · Division Regional Athletic Meet Game Result Matrix System | Medium6.9 |
| CVE-2026-122047 | Campcodes Complete Advance Loan Management System banner.php move_uploaded_file unrestricted uploadCampcodes · Complete Advance Loan Management System | Medium6.9 |
| CVE-2026-122038 | krupalshah EmployeeRecruitmentSystem Requirement Board Update reqformprocessing.php mysql_query sql injectionkrupalshah · EmployeeRecruitmentSystem | Medium6.9 |
| CVE-2026-122028 | NST Labs Tech Nstbrowser Local Agent API info information disclosureNST Labs Tech · Nstbrowser | Medium5.3 |
| CVE-2026-122020 | NST Labs Tech Nstbrowser Local Agent Management Service stopAll stopAllBrowsers denial of serviceNST Labs Tech · Nstbrowser | Medium5.3 |
| CVE-2026-122019 | 6amTech 6valley Social Login Flow existing-account-check existingAccountCheck authorization6amTech · 6valley | Medium6.9 |
| CVE-2026-122016 | yangzongzhuan RuoYi-Vue Permission Service SysPermissionService.java SysPermissionService.getMenuPermission privileges managementyangzongzhuan · RuoYi-Vue | Medium5.3 |
| CVE-2026-122015 | NPC-Worldwide npcpy MLX Provider response.py get_mlx_response input validationNPC-Worldwide · npcpy | Medium5.3 |
| CVE-2026-122014 | NPC-Worldwide npcpy sft.py load_sft_model code injectionNPC-Worldwide · npcpy | Medium5.3 |
| CVE-2026-122013 | Comfast CF-WR632AX Multipart webmgnt path traversalComfast · CF-WR632AX | Critical10.0 |
| CVE-2026-122009 | DataLinkDC Dinky flink_web Proxy Endpoint FlinkWebURITemplateProxyServlet.java FlinkWebURITemplateProxyServlet.getNewTargetUri server-side request forgeryDataLinkDC · Dinky | Medium6.9 |
| CVE-2026-121933 | Linksys E5350 Setup Wizard apply.cgi save_settings missing authenticationLinksys · E5350 | Critical10.0 |
| CVE-2026-121932 | Linksys E5350 apply.cgi system os command injectionLinksys · E5350 | Critical10.0 |
| CVE-2026-121931 | Linksys WRT54GL Traceroute Diagnostic Function apply.cgi system os command injectionLinksys · WRT54GL | Critical9.4 |
| CVE-2026-121930 | Linksys WRT54GL Ping Diagnostic apply.cgi system os command injectionLinksys · WRT54GL | Critical9.4 |
| CVE-2026-121929 | EmpireSoft EmpireCMS index.php cross site scriptingEmpireSoft · EmpireCMS | Medium5.1 |
| CVE-2026-121928 | InfiniFlow RAGFlow Images API file_utils.py cross site scriptingInfiniFlow · RAGFlow | Medium5.1 |
| CVE-2026-121927 | InfiniFlow RAGFlow Seafile Connector seafile_connector.py _account_get server-side request forgeryInfiniFlow · RAGFlow | Medium5.3 |
| CVE-2026-121926 | yezhihao jt808-server Web Management API WebMvcConfig.addInterceptors missing authenticationyezhihao · jt808-server | Medium6.9 |
| CVE-2026-121618 | Linksys E5600 Factory Quality Control fqc.cgi information disclosureLinksys · E5600 | Medium6.9 |
| CVE-2026-121617 | Linksys E5600 Header upload_fw.cgi init_multipart out-of-bounds writeLinksys · E5600 | High8.7 |
| CVE-2026-121616 | Linksys E5600 JSON Request mesh_login.cgi strcpy out-of-bounds writeLinksys · E5600 | Medium6.9 |
| CVE-2026-121615 | Linksys E5600 Login mesh_login.cgi improper authenticationLinksys · E5600 | Critical10.0 |
| CVE-2026-121610 | funadmin Frontend List Endpoint index selectList sql injectionfunadmin | Medium6.9 |
| CVE-2026-121609 | Qihoo 360 Whole Home Router M5 Boot Script mpt start hard-coded credentialsQihoo 360 · Whole Home Router M5 | Critical10.0 |
| CVE-2026-121608 | Qihoo 360 D603-2/D600-2/D606-6 Timezone Push iscm on_push_message os command injectionQihoo 360 · D603-2 | Medium6.9 |
| CVE-2026-121607 | Qihoo 360 D603-2/D600-2/D606-6/D706 iscm testspeed_command os command injectionQihoo 360 · D603-2 | Critical10.0 |
| CVE-2026-121606 | Qihoo 360 D621-2/D603-2/D600-2/D619/D606-6/D706 Firmware Signature Verification iscm verify_sign signature verificationQihoo 360 · D621-2 | Critical10.0 |
| CVE-2026-121600 | TOTOLINK A950RG MAC Filter cstecgi.cgi setMacFilterRules stack-based overflowTOTOLINK · A950RG | Critical9.4 |