Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 9 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 400,106All CVEsplus 18,873 rejected
- 787Last 24 hours3,269 in the last 7 days
- 17,395Last 30 days1,568 of them critical
- 1,767Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 0 | 0 | 0 | 0 | 0 | 0 | 168 |
| 2025 | 6 | 3 | 3 | 0 | 0 | 12 | 168 |
| 2024 | 1 | 2 | 2 | 0 | 0 | 5 | 156 |
| 2023 | 8 | 5 | 3 | 0 | 0 | 16 | 151 |
| 2022 | 9 | 9 | 5 | 0 | 0 | 23 | 135 |
| 2021 | 14 | 11 | 3 | 0 | 0 | 28 | 112 |
| 2020 | 8 | 17 | 5 | 1 | 0 | 31 | 84 |
| 2019 | 20 | 15 | 4 | 0 | 0 | 39 | 53 |
| 2018 | 4 | 8 | 2 | 0 | 0 | 14 | 14 |
| Title | ||
|---|---|---|
| CVE-2025-55177 | Incomplete authorization of linked device synchronization messages in WhatsApp for iOS prior to v2.25.21.73, WhatsApp Business for iOS v2.25.21.78, and…ExploitedFacebook · WhatsApp Desktop for Mac | Medium5.4 |
| CVE-2025-54952 | An integer overflow vulnerability in the loading of ExecuTorch models can cause smaller-than-expected memory regions to be allocated, potentially resulting in…Meta Platforms, Inc · ExecuTorch | Critical9.8 |
| CVE-2025-54951 | A group of related buffer overflow vulnerabilities in the loading of ExecuTorch models can cause the runtime to crash and potentially result in code execution…Meta Platforms, Inc · ExecuTorch | Critical9.8 |
| CVE-2025-54950 | An out-of-bounds access vulnerability in the loading of ExecuTorch models can cause the runtime to crash and potentially result in code execution or other…Meta Platforms, Inc · ExecuTorch | Critical9.8 |
| CVE-2025-54949 | A heap buffer overflow vulnerability in the loading of ExecuTorch models can potentially result in code execution or other undesirable effects. This issue…Meta Platforms, Inc · ExecuTorch | Critical9.8 |
| CVE-2025-30405 | An integer overflow vulnerability in the loading of ExecuTorch models can cause objects to be placed outside their allocated memory area, potentially resulting…Meta Platforms, Inc · ExecuTorch | Critical9.8 |
| CVE-2025-30404 | An integer overflow vulnerability in the loading of ExecuTorch models can cause overlapping allocations, potentially resulting in code execution or other…Meta Platforms, Inc · ExecuTorch | Critical9.8 |
| CVE-2025-30403 | A heap-buffer-overflow vulnerability is possible in mvfst via a specially crafted message during a QUIC session. This issue affects mvfst versions prior to…Facebook · mvfst | High8.1 |
| CVE-2025-30402 | A heap-buffer-overflow vulnerability in the loading of ExecuTorch methods can cause the runtime to crash and potentially result in code execution or other…Meta Platforms, Inc · ExecuTorch | High8.1 |
| CVE-2025-30401 | A spoofing issue in WhatsApp for Windows prior to version 2.2450.6 displayed attachments according to their MIME type but selected the file opening handler…Facebook · WhatsApp Desktop for Windows | Medium6.7 |
| CVE-2025-27591 | A privilege escalation vulnerability existed in the Below service prior to v0.9.0 due to the creation of a world-writable directory at /var/log/below. This…Meta Platforms, Inc · below | Medium6.8 |
| CVE-2025-27363 | An out of bounds write exists in FreeType versions 2.13.0 and below (newer versions of FreeType are not vulnerable) when attempting to parse font subglyph…ExploitedFreeType · FreeType | High8.1 |
| CVE-2024-50050 | Llama Stack prior to revision 7a8aa775e5a267cf8660d83140011a0b7f91e005 used pickle as a serialization format for socket communication, potentially allowing for…Meta Platforms, Inc · Llama Stack | Medium6.3 |
| CVE-2024-49400 | Tacquito prior to commit 07b49d1358e6ec0b5aa482fcd284f509191119e2 was not properly performing regex matches on authorized commands and arguments. Configured…Meta · Tacquito | Critical9.8 |
| CVE-2024-45863 | A null-dereference vulnerability involving parsing requests specifying invalid protocols can cause the application to crash or potentially result in other…Facebook · Facebook Thrift | Medium5.3 |
| CVE-2024-45773 | A use-after-free vulnerability involving upgradeToRocket requests can cause the application to crash or potentially result in code execution or other…Facebook · Facebook Thrift | High7.5 |
| CVE-2024-23347 | Prior to v176, when opening a new project Meta Spark Studio would execute scripts defined inside of a package.json file included as part of that project. Those…Meta Platforms, Inc · Meta Spark Studio | High7.8 |
| CVE-2023-49062 | Katran could disclose non-initialized kernel memory as part of an IP header. The issue was present for IPv4 encapsulation and ICMP (v4) Too Big packet…Facebook · Katran | High7.5 |
| CVE-2023-45239 | A lack of input validation exists in tac_plus prior to commit 4fdf178 which, when pre or post auth commands are enabled, allows an attacker who can control the…Meta · tac_plus | Critical9.8 |
| CVE-2023-38538 | A race condition in an event subsystem led to a heap use-after-free issue in established audio/video calls that could have resulted in app termination or…Facebook · WhatsApp Desktop for Mac | Medium5.0 |
| CVE-2023-38537 | A race condition in a network transport subsystem led to a heap use-after-free issue in established or unsilenced incoming audio/video calls that could have…Facebook · WhatsApp Desktop for Mac | Medium5.6 |
| CVE-2023-30470 | A use-after-free related to unsound inference in the bytecode generation when optimizations are enabled for Hermes prior to commit…Facebook · Hermes | Critical9.8 |
| CVE-2023-28753 | netconsd prior to v0.2 was vulnerable to an integer overflow in its parse_packet function. A malicious individual could leverage this overflow to create heap…Facebook · netconsd | Critical9.8 |
| CVE-2023-28081 | A bytecode optimization bug in Hermes prior to commit e6ed9c1a4b02dc219de1648f44cd808a56171b81 could be used to cause an use-after-free and obtain arbitrary…Facebook · Hermes | Critical9.8 |
| CVE-2023-25933 | A type confusion bug in TypedArray prior to commit e6ed9c1a4b02dc219de1648f44cd808a56171b81 could have been used by a malicious attacker to execute arbitrary…Facebook · Hermes | Critical9.8 |
| CVE-2023-24833 | A use-after-free in BigIntPrimitive addition in Hermes prior to commit a6dcafe6ded8e61658b40f5699878cd19a481f80 could have been used by an attacker to leak raw…Facebook · Hermes | High7.5 |
| CVE-2023-24832 | A null pointer dereference bug in Hermes prior to commit 5cae9f72975cf0e5a62b27fdd8b01f103e198708 could have been used by an attacker to crash an Hermes…Facebook · Hermes | High7.5 |
| CVE-2023-23759 | There is a vulnerability in the fizz library prior to v2023.01.30.00 where a CHECK failure can be triggered remotely. This behavior requires the client…Facebook · fizz | High7.5 |
| CVE-2023-23557 | An error in Hermes' algorithm for copying objects properties prior to commit a00d237346894c6067a594983be6634f4168c9ad could be used by a malicious attacker to…Facebook · Hermes | Critical9.8 |
| CVE-2023-23556 | An error in BigInt conversion to Number in Hermes prior to commit a6dcafe6ded8e61658b40f5699878cd19a481f80 could have been used by a malicious attacker to…Facebook · Hermes | Critical9.8 |
| CVE-2022-36937 | HHVM 4.172.0 and all prior versions use TLS 1.0 for secure connections when handling tls:// URLs in the stream extension. TLS1.0 has numerous published…Facebook · HHVM | Critical9.8 |
| CVE-2023-30792 | Anchor tag hrefs in Lexical prior to v0.10.0 would render javascript: URLs, allowing for cross-site scripting on link clicks in cases where input was being…Meta Platforms, Inc · Lexical | Medium6.1 |
| CVE-2022-36943 | SSZipArchive versions 2.5.3 and older contain an arbitrary file write vulnerability due to lack of sanitization on paths which are symlinks. SSZipArchive will…ZipArchive · SSZipArchive | High8.1 |
| CVE-2022-36938 | DexLoader function get_stringidx_fromdex() in Redex prior to commit 3b44c64 can load an out of bound address when loading the string index table, potentially…Facebook · Redex | Critical9.8 |
| CVE-2022-40138 | An integer conversion error in Hermes bytecode generation, prior to commit 6aa825e480d48127b480b08d13adf70033237097, could have been used to perform…Facebook · Hermes | Critical9.8 |
| CVE-2022-35289 | A write-what-where condition in hermes caused by an integer overflow, prior to commit 5b6255ae049fa4641791e47fad994e8e8c4da374 allows attackers to potentially…Facebook · Hermes | Critical9.8 |
| CVE-2022-32234 | An out of bounds write in hermes, while handling large arrays, prior to commit 06eaec767e376bfdb883d912cb15e987ddf2bda1 allows attackers to potentially execute…Facebook · Hermes | Critical9.8 |
| CVE-2022-27810 | It was possible to trigger an infinite recursion condition in the error handler when Hermes executed specific maliciously formed JavaScript. This condition was…Facebook · Hermes | High7.5 |
| CVE-2022-27492 | An integer underflow in WhatsApp could have caused remote code execution when receiving a crafted video file.Meta · WhatsApp Business for iOS | High7.8 |
| CVE-2022-36934 | An integer overflow in WhatsApp could result in remote code execution in an established video call.Meta · WhatsApp for iOS | Critical9.8 |
| CVE-2022-38216 | An integer overflow exists in Mapbox's closed source gl-native library prior to version 10.6.1, which is bundled with multiple Mapbox products including open…Mapbox · Mapbox | High7.5 |
| CVE-2022-36312 | Airspan AirVelocity 1500 software version 15.18.00.2511 lacks CSRF protections in the eNodeB's web management UI. This issue may affect other AirVelocity and…Airspan · AirVelocity | High8.8 |
| CVE-2022-36311 | Airspan AirVelocity 1500 prior to software version 15.18.00.2511 is vulnerable to injection leading to XSS in the SNMP community field in the eNodeB's web…Airspan · AirVelocity | Medium6.1 |
| CVE-2022-36310 | Airspan AirVelocity 1500 software prior to version 15.18.00.2511 had NET-SNMP-EXTEND-MIB enabled on its snmpd service, enabling an attacker with SNMP write…Airspan · AirVelocity | High8.8 |
| CVE-2022-36309 | Airspan AirVelocity 1500 software versions prior to 15.18.00.2511 have a root command injection vulnerability in the ActiveBank parameter of the…Airspan · AirVelocity | High8.8 |
| CVE-2022-36308 | Airspan AirVelocity 1500 web management UI displays SNMP credentials in plaintext on software versions older than 15.18.00.2511, and stores SNMPv3 credentials…Airspan · AirVelocity | Critical9.1 |
| CVE-2022-36307 | The AirVelocity 1500 prints SNMP credentials on its physically accessible serial port during boot. This was fixed in AirVelocity 1500 software version…Airspan · AirVelocity | Medium6.8 |
| CVE-2022-36306 | An authenticated attacker can enumerate and download sensitive files, including the eNodeB's web management UI's TLS private key, the web server binary, and…Airspan · AirVelocity | Medium6.5 |
| CVE-2022-24949 | A privilege escalation to root exists in Eternal Terminal prior to version 6.2.0. This is due to the combination of a race condition, buffer overflow, and…Jason Gauci · Eternal Terminal | High7.5 |
| CVE-2022-24952 | Several denial of service vulnerabilities exist in Eternal Terminal prior to version 6.2.0, including a DoS triggered remotely by an invalid sequence number…Jason Gauci · Eternal Terminal | Medium6.5 |