Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 1 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 399,660All CVEsplus 18,865 rejected
- 541Last 24 hours2,963 in the last 7 days
- 17,025Last 30 days1,508 of them critical
- 1,766Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 0 | 1 | 2 | 0 | 0 | 3 | 645 |
| 2025 | 5 | 2 | 1 | 1 | 0 | 9 | 642 |
| 2024 | 0 | 0 | 0 | 0 | 0 | 0 | 633 |
| 2023 | 0 | 0 | 0 | 0 | 0 | 0 | 633 |
| 2022 | 4 | 0 | 1 | 0 | 0 | 5 | 633 |
| 2021 | 0 | 1 | 0 | 0 | 0 | 1 | 628 |
| 2020 | 1 | 6 | 7 | 0 | 0 | 14 | 627 |
| 2019 | 5 | 17 | 11 | 0 | 0 | 33 | 613 |
| 2018 | 10 | 10 | 24 | 0 | 0 | 44 | 580 |
| 2017 | 31 | 49 | 53 | 2 | 0 | 135 | 536 |
| 2016 | 19 | 39 | 27 | 2 | 0 | 87 | 401 |
| 2015 | 0 | 15 | 24 | 3 | 0 | 42 | 314 |
| 2014 | 1 | 21 | 40 | 9 | 0 | 71 | 272 |
| 2013 | 0 | 4 | 12 | 3 | 0 | 19 | 201 |
| 2012 | 1 | 8 | 13 | 1 | 0 | 23 | 182 |
| 2011 | 0 | 0 | 0 | 0 | 0 | 0 | 159 |
| 2010 | 0 | 0 | 0 | 0 | 0 | 0 | 159 |
| 2009 | 0 | 0 | 0 | 0 | 0 | 0 | 159 |
| 2008 | 0 | 0 | 0 | 0 | 0 | 0 | 159 |
| 2007 | 0 | 0 | 1 | 0 | 0 | 1 | 159 |
| 2006 | 0 | 25 | 25 | 9 | 0 | 59 | 158 |
| 2005 | 1 | 42 | 33 | 23 | 0 | 99 | 99 |
| Title | ||
|---|---|---|
| CVE-2026-11853 | Debusine is an integrated solution to build, distribute and maintain a Debian-based distribution. Debian source packages (.dsc) and upload artifacts (.changes)…Debian · debusine | Medium6.5 |
| CVE-2026-11852 | Debusine is an integrated solution to build, distribute and maintain a Debian-based distribution. Files managed by debusine are organized into artifacts. The…Debian · debusine | Medium6.5 |
| CVE-2026-2219 | It was discovered that dpkg-deb (a component of dpkg, the Debian package management system) does not properly validate the end of the data stream when…Debian · dpkg | High7.5 |
| CVE-2025-8454 | It was discovered that uscan, a tool to scan/watch upstream sources for new releases of software, included in devscripts (a collection of scripts to make the…Debian · devscripts | Critical9.8 |
| CVE-2025-6297 | dpkg-deb: Fix cleanup for control member with restricted directoriesDebian · dpkg | High8.2 |
| CVE-2015-0849 | pycode-browser before version 1.0 is prone to a predictable temporary file vulnerability.pycode-browser · pycode-browser | Low3.9 |
| CVE-2015-0843 | yubiserver before 0.6 is prone to buffer overflows due to misuse of sprintf.yubiserver · yubiserver | Critical9.8 |
| CVE-2015-0842 | yubiserver before 0.6 is prone to SQL injection issues, potentially leading to an authentication bypass.yubiserver · yubiserver | Critical9.8 |
| CVE-2014-6274 | S3 and Glacier remotes creds embedded in the git repo were not encryptedgit-annex · git-annex | High7.5 |
| CVE-2014-7210 | pdns specific as packaged in Debian in version before 3.3.1-1 creates a too privileged MySQL user. It was discovered that the maintainer scripts of…Debian · pdns | Critical9.8 |
| CVE-2014-0468 | Vulnerability in fusionforge in the shipped Apache configuration, where the web server may execute scripts that the users would have uploaded in their raw SCM…fusionforge · fusionforge | Critical9.8 |
| CVE-2013-1424 | Buffer overflow vulnerability in matplotlib.This issue affects matplotlib: before upstream commit ba4016014cb4fb4927e36ce8ea429fed47dcb787.matplotlib · matplotlib | Medium5.6 |
| CVE-2022-2787 | stricter rules on chroot namesDebian · schroot | Medium4.3 |
| CVE-2022-1664 | directory traversal for in-place extracts with untrusted v2 and v3 source packages with debian.tarDebian · dpkg | Critical9.8 |
| CVE-2016-1239 | duck before 0.10 did not properly handle loading of untrusted code from the current directory.Debian · duck | Critical9.8 |
| CVE-2022-0543 | It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific) Lua sandbox escape, which could…ExploitedDebian · redis | Critical10.0 |
| CVE-2021-20001 | It was discovered, that debian-edu-config, a set of configuration files used for the Debian Edu blend, before 2.12.16 configured insecure permissions for the…Debian · debian-edu-config | Critical9.8 |
| CVE-2015-1877 | The open_generic_xdg_mime function in xdg-open in xdg-utils 1.1.0 rc1 in Debian, when using dash, does not properly handle local variables, which allows remote… | High8.8 |
| CVE-2020-3811 | qmail-verify as used in netqmail 1.06 is prone to a mail-address verification bypass vulnerability.Debian · netqmail | High7.5 |
| CVE-2020-3812 | qmail-verify as used in netqmail 1.06 is prone to an information disclosure vulnerability. A local attacker can test for the existence of files and directories…Debian · netqmail | Medium5.5 |
| CVE-2020-3810 | Missing input validation in the ar/tar implementations of APT before version 2.1.2 could result in denial of service when processing specially crafted deb…Debian · apt | Medium5.5 |
| CVE-2016-7524 | coders/meta.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted file.ImageMagick · ImageMagick | Medium6.5 |
| CVE-2016-7523 | coders/meta.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted file.ImageMagick · ImageMagick | Medium6.5 |
| CVE-2016-9928 | MCabber before 1.0.4 is vulnerable to roster push attacks, which allows remote attackers to intercept communications, or add themselves as an entity on a 3rd…MCabber · MCabber | High7.4 |
| CVE-2013-1437 | Eval injection vulnerability in the Module-Metadata module before 1.000015 for Perl allows remote attackers to execute arbitrary Perl code via the $Version…Perl Toolchain Gang · Module-Metadata | Critical9.8 |
| CVE-2014-9481 | The Scribunto extension for MediaWiki allows remote attackers to obtain the rollback token and possibly other sensitive information via a crafted module,…Scribunto · Scribunto | Medium5.9 |
| CVE-2015-2688 | buf_pullup in Tor before 0.2.4.26 and 0.2.5.x before 0.2.5.11 does not properly handle unexpected arrival times of buffers with invalid layouts, which allows…The Tor Project · Tor | High7.5 |
| CVE-2015-2689 | Tor before 0.2.4.26 and 0.2.5.x before 0.2.5.11 does not properly handle pending-connection resolve states during periods of high DNS load, which allows remote…The Tor Project · Tor | High7.5 |
| CVE-2015-2929 | The Hidden Service (HS) client implementation in Tor before 0.2.4.27, 0.2.5.x before 0.2.5.12, and 0.2.6.x before 0.2.6.7 allows remote servers to cause a…The Tor Project · Tor | High7.5 |
| CVE-2015-2928 | The Hidden Service (HS) server implementation in Tor before 0.2.4.27, 0.2.5.x before 0.2.5.12, and 0.2.6.x before 0.2.6.7 allows remote attackers to cause a…The Tor Project · Tor | High7.5 |
| CVE-2014-6275 | FusionForge before 5.3.2 use scripts that run under the shared Apache user, which is also used by project homepages by default. If project webpages are hosted…Red Hat · FusionForge | Medium5.9 |
| CVE-2013-7351 | Multiple cross-site scripting (XSS) vulnerabilities in index.php in Shaarli allow remote attackers to inject arbitrary web script or HTML via the URL to the…Shaarli · Shaarli | Medium6.1 |
| CVE-2019-3467 | Debian-edu-config all versions < 2.11.10, a set of configuration files used for Debian Edu, and debian-lan-config < 0.26, configured too permissive ACLs for…Debian · Debian Edu | High7.8 |
| CVE-2014-1867 | suPHP before 0.7.2 source-highlighting feature allows security bypass which could lead to arbitrary code executionsuphp · suphp | High7.8 |
| CVE-2015-0841 | Off-by-one error in the readBuf function in listener.cpp in libcapsinetwork and monopd before 0.9.8, allows remote attackers to cause a denial of service…monopd · monopd | High7.5 |
| CVE-2015-0837 | The mpi_powm function in Libgcrypt before 1.6.3 and GnuPG before 1.4.19 allows attackers to obtain sensitive information by leveraging timing differences when…GNU · Libgcrypt | Medium5.9 |
| CVE-2012-2248 | An issue was discovered in dhclient 4.3.1-6 due to an embedded path variable.isc-dhcp · isc-dhcp | High8.1 |
| CVE-2015-1396 | A Directory Traversal vulnerability exists in the GNU patch before 2.7.4. A remote attacker can write to arbitrary files via a symlink attack in a patch file.… | High7.5 |
| CVE-2014-5255 | xcfa before 5.0.1 creates temporary files insecurely which could allow local users to launch a symlink attack and overwrite arbitrary files. Note: A different…xcfa · xcfa | High7.0 |
| CVE-2014-5254 | xcfa before 5.0.1 creates temporary files insecurely which could allow local users to launch a symlink attack and overwrite arbitrary files.xcfa · xcfa | Medium4.7 |
| CVE-2015-2793 | Cross-site scripting (XSS) vulnerability in templates/openid-selector.tmpl in ikiwiki before 3.20150329 allows remote attackers to inject arbitrary web script…ikiwiki · ikiwiki | Medium6.1 |
| CVE-2012-2238 | trytond 2.4: ModelView.button fails to validate authorizationtryton · trytond | High7.5 |
| CVE-2019-3466 | The pg_ctlcluster script in postgresql-common in versions prior to 210 didn't drop privileges when creating socket/statistics temporary directories, which…postgresql-common (Debian-specific Postgres management tools) | High7.8 |
| CVE-2012-2237 | Multiple cross-site scripting (XSS) vulnerabilities in Mahara 1.4.x before 1.4.3 and 1.5.x before 1.5.2 allow remote attackers to inject arbitrary web script…Mahara · Mahara | Medium6.1 |
| CVE-2013-1429 | Lintian before 2.5.12 allows remote attackers to gather information about the "host" system using crafted symlinks.lintian · lintian | Medium6.3 |
| CVE-2013-1426 | Cross-site Scripting (XSS) in Mahara before 1.5.9 and 1.6.x before 1.6.4 allows remote attackers to inject arbitrary web script or HTML via the TinyMCE editor.mahara · mahara | Medium6.1 |
| CVE-2013-1425 | ldap-git-backup before 1.0.4 exposes password hashes due to incorrect directory permissions.ldap-git-backup · ldap-git-backup | Medium5.5 |
| CVE-2019-3465 | Rob Richards XmlSecLibs, all versions prior to v3.0.3, as used for example by SimpleSAMLphp, performed incorrect validation of cryptographic signatures in XML…Rob Richards XmlSecLibs | High8.8 |
| CVE-2006-4245 | archivemail 0.6.2 uses temporary files insecurely leading to a possible race condition.archivemail · archivemail | High8.1 |
| CVE-2006-4243 | linux vserver 2.6 before 2.6.17 suffers from privilege escalation in remount code.linux-2.6 · linux-2.6 | Critical9.8 |