Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 1 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 399,660All CVEsplus 18,865 rejected
- 536Last 24 hours2,963 in the last 7 days
- 17,025Last 30 days1,508 of them critical
- 1,766Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 1,041 | 4,494 | 3,649 | 288 | 0 | 9,472 | 10,593 |
| 2025 | 329 | 444 | 300 | 0 | 0 | 1,073 | 1,121 |
| 2024 | 11 | 14 | 12 | 1 | 0 | 38 | 48 |
| 2023 | 5 | 3 | 2 | 0 | 0 | 10 | 10 |
| Title | ||
|---|---|---|
| CVE-2026-116845 | NetBox from 2.9.0 before 4.7.4 Authorization Bypass via BulkComponentCreateViewnetbox-community · netbox | Medium5.3 |
| CVE-2026-121628 | Bagisto before 2.3.16 and 2.4.x before 2.4.1 Race Condition in Coupon Usage Accountingbagisto · bagisto | Medium6.3 |
| CVE-2026-121627 | buku 5.0 through 5.1.1 Stored XSS via bukuserver Bookmark List URLjarun · buku | Medium5.3 |
| CVE-2026-121626 | GNU Gatekeeper before 5.16 Out-of-Bounds Read in H.460.24 RTCP Probe Handlerwillamowius · gnugk | Medium6.3 |
| CVE-2026-121625 | GNU Gatekeeper before 5.16 Out-of-Bounds Read via RTCP SDES Parsingwillamowius · gnugk | Medium6.3 |
| CVE-2026-121624 | Nanosystems Supremo before 5.0.2.3874 Improper TLS Certificate ValidationNanosystems · Supremo | High7.6 |
| CVE-2026-121631 | Lightdash 0.2609.0 before 3.137.0 Cross-Project IDOR via RenameService Dashboard Endpointslightdash · lightdash | Low2.3 |
| CVE-2026-121604 | wlroots before 0.20.2 Out-of-Bounds Read via read_surface_class() in xwm.cwlroots · wlroots | Medium4.8 |
| CVE-2026-121603 | Solanum before commit 2ea1382 Buffer Overflow via Server-to-Server KILL Handlersolanum-ircd · solanum | High8.5 |
| CVE-2026-121602 | Solanum before commit 2ce64de Heap Buffer Overflow via JOIN and SJOINsolanum-ircd · solanum | High8.5 |
| CVE-2026-121588 | TeXlyre from 0.11.0 before 0.13.5 Stored XSS via Recipe Icon ImportTeXlyre · texlyre | Medium5.3 |
| CVE-2026-121587 | Coolify before 4.1.1 Application Name Enumeration via Manual Webhook Endpointscoollabsio · coolify | Medium6.9 |
| CVE-2026-119741 | rsync through 3.5.1 Denial of Service via hash_search() Checksum CollisionsRsyncProject · rsync | High8.7 |
| CVE-2026-73328 | Volmarg Personal Management System through 2.1.0 Unrestricted File Upload RCE via /upload/send/volmarg · personal-management-system | High8.6 |
| CVE-2026-121562 | CTFd 3.1.0 before 3.8.7 Information Disclosure via /api/v1/teams EndpointCTFd · CTFd | Medium6.9 |
| CVE-2026-121561 | Label Studio before 1.23.2 SSRF and Token Disclosure via Image Export DownloadsHumanSignal · label-studio | Medium6.3 |
| CVE-2026-121560 | LogChimp before 0.9.3 Authorization Bypass via PATCH /api/v1/postslogchimp · logchimp | High7.1 |
| CVE-2026-121559 | GLPI 10.0.0 before 10.0.28 and 11.0.0 before 11.0.10 Privilege Escalation via User Cloningglpi-project · GLPI | High8.6 |
| CVE-2026-121558 | AuditPilot before commit 4669c93 RAG Project-Scope Authorization Bypass via project_idRicky-7-Yan · intelligent-audit-system | Low2.3 |
| CVE-2026-121557 | WPPConnect Server through 2.10.74 Missing Authentication via /api/:session/chatwootwppconnect · wppconnect-server | High8.2 |
| CVE-2026-121556 | FastBee through 2.1.0 IDOR via /iot/product By-ID Endpointsbeecue · FastBee | High8.7 |
| CVE-2026-121555 | Foxel through 2.4.0 Unauthenticated File Read via /api/fs/stream and /api/fs/thumbDrizzleTime · Foxel | High8.7 |
| CVE-2026-121554 | cordova-plugin-advanced-http 1.5.0 through 3.3.1 Cookie Leak via Cross-Origin Redirectssilkimen · cordova-plugin-advanced-http | High8.2 |
| CVE-2026-121553 | Cotonti through 1.0.0 Predictable Validation Tokens via md5(microtime())cotonti · cotonti | Medium6.3 |
| CVE-2026-121552 | domain-admin before 1.6.79 Missing Authorization via getGroupUserListdromara · domain-admin | Medium5.3 |
| CVE-2026-121551 | PostfixAdmin through 4.0.5 Stored XSS via TOTP Exception Descriptionpostfixadmin · postfixadmin | Medium5.1 |
| CVE-2026-121550 | nnn through 5.3 Symlink-Following Write via NNN_FIFO Handlingjarun · nnn | Low1.0 |
| CVE-2026-121549 | nnn through 5.3 Insecure Temporary File Symlink Overwrite via pdfread and nuke Pluginsjarun · nnn | Medium4.1 |
| CVE-2026-121548 | nnn through 5.3 OS Command Injection via togglex Pluginjarun · nnn | High8.4 |
| CVE-2026-121547 | dysk before 3.8.2 Terminal Escape Sequence Injection via Mount MetadataCanop · dysk | Low1.0 |
| CVE-2026-121546 | ruTorrent before 5.3.20 Path Traversal via datadir Plugin Symlink FollowingNovik · ruTorrent | Medium6.0 |
| CVE-2026-121545 | Dreeve before 5.8.0 Missing Authentication in Strava Webhook POST Handlerrobiningelbrecht · dreeve | Medium6.9 |
| CVE-2026-121544 | Koodo Reader through 2.4.6 Path Traversal via OPDS Cover and Download Handlerskoodo-reader · koodo-reader | Medium6.9 |
| CVE-2026-121543 | smart-sso through 2.0.1 Incorrect Authorization in PermissionFilter Enables Admin Escalationa466350665 · smart-sso | High8.7 |
| CVE-2026-121455 | DbGate before 7.3.3 Missing Authorization via /connections/test and /connections/savedbgate · dbgate | Medium5.3 |
| CVE-2026-121454 | Padloc through 4.3.0 Missing SCIM Token Validation via SCIM GET Requestspadloc · padloc | Medium6.3 |
| CVE-2026-121453 | SQLBot through 1.10.3 Path Traversal via datasource importToDb Endpointdataease · SQLBot | Medium5.1 |
| CVE-2026-121452 | bbs-go through 4.4.6 Improper TLS Certificate Validation in SMTP Email Servicemlogclub · bbs-go | High8.3 |
| CVE-2026-121451 | AB Download Manager before 1.11.2 Arbitrary File Write via /start-headless-download CSRFamir1376 · ab-download-manager | High8.7 |
| CVE-2026-121450 | CFNext before 3.1.0 Admin Password Recovery via MD5-Derived Subscription UUIDPAICNI · CFNext | High7.7 |
| CVE-2026-121449 | Dockhand 1.0.47 before 1.0.54 Secret Disclosure via Git Stack WebhookFinsys · dockhand | High7.1 |
| CVE-2026-121448 | Dockhand before 1.0.54 Path Traversal via Stack Environment RoutesFinsys · dockhand | High8.7 |
| CVE-2026-121447 | svg-sanitizer before 1.1.0 XSS via animateTransform on Safaridarylldoyle · svg-sanitizer | Medium5.3 |
| CVE-2026-121446 | svg-sanitizer 0.5.0 before 1.1.0 Incomplete url() Filtering in SVG Attributesdarylldoyle · svg-sanitizer | Medium5.3 |
| CVE-2026-121445 | svg-sanitizer 1.0.0 before 1.1.0 ReDoS and Fail-Open via image-set CSS Strippingdarylldoyle · svg-sanitizer | High8.2 |
| CVE-2026-121444 | svg-sanitizer 0.11.0 before 1.1.0 Algorithmic Complexity DoS via use Reference Graphdarylldoyle · svg-sanitizer | High8.7 |
| CVE-2026-121443 | svg-sanitizer from 1.1.0 before 1.1.1 Denial of Service via Unclosed Tagdarylldoyle · svg-sanitizer | Medium6.9 |
| CVE-2026-121442 | Frappe HRMS before 15.61.0 Permission Bypass via Expense Claim Advances APIfrappe · hrms | Medium5.3 |
| CVE-2026-121441 | Wasmtime before 36.0.19, 37.0.0 before 48.0.7, and 49.0.0 before 49.0.4 wasi-http Request Smugglingbytecodealliance · wasmtime | Medium6.3 |
| CVE-2026-121440 | Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 Forwarded Trailers Header Filter Bypassbytecodealliance · wasmtime | Medium6.3 |