Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 5 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 400,452All CVEsplus 18,890 rejected
- 361Last 24 hours2,971 in the last 7 days
- 17,371Last 30 days1,592 of them critical
- 1,767Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 0 | 26 | 34 | 10 | 0 | 70 | 337 |
| 2025 | 0 | 15 | 23 | 5 | 0 | 43 | 267 |
| 2024 | 2 | 30 | 36 | 3 | 0 | 71 | 224 |
| 2023 | 8 | 13 | 36 | 8 | 0 | 65 | 153 |
| 2022 | 11 | 16 | 28 | 2 | 0 | 57 | 88 |
| 2021 | 1 | 13 | 11 | 0 | 0 | 25 | 31 |
| 2020 | 0 | 0 | 0 | 0 | 0 | 0 | 6 |
| 2019 | 1 | 0 | 1 | 0 | 0 | 2 | 6 |
| 2018 | 1 | 0 | 0 | 0 | 0 | 1 | 4 |
| 2017 | 0 | 2 | 1 | 0 | 0 | 3 | 3 |
| Title | ||
|---|---|---|
| CVE-2026-118599 | epiphany: TAR-based .xpi with hard links can overwrite user files during WebExtension installGNOME · Epiphany | Medium5.5 |
| CVE-2026-118598 | epiphany: clipboard/website-data permission prompt incorrectly grants camera and microphone accessGNOME · Epiphany | Medium6.5 |
| CVE-2026-115683 | epiphany: TLS certificate warning bypass via race in tlsErrorPage message handlerGNOME · Epiphany | Medium6.8 |
| CVE-2026-116612 | A flaw was found in GStreamer Editing Services (gst-editing-services). A GES project file can embed an arbitrary GStreamer pipeline description as an effect…GStreamer project · gst-editing-services | High7.8 |
| CVE-2026-114460 | Mod_qos: query truncation during json body merging permits security-rule bypasspbuchbinder · mod_qos | Medium5.3 |
| CVE-2026-114459 | Mod_qos: out-of-bounds reads in response-body substring matchingpbuchbinder · mod_qos | Low3.7 |
| CVE-2026-114458 | Mod_qos: undersized connection-monitor scratch array permits heap buffer overflowpbuchbinder · mod_qos | Medium5.9 |
| CVE-2026-114457 | Mod_qos: missing nul termination in json value escaping permits out-of-bounds readspbuchbinder · mod_qos | Low3.7 |
| CVE-2026-103680 | Tnef: heap buffer overflow in find_free_number() via numbered-backup suffix generationtnef | Low3.1 |
| CVE-2026-103679 | Tnef: use-after-free and double-free in get_body_files() via multi-value body extractiontnef | Medium6.5 |
| CVE-2026-103678 | Tnef: heap out-of-bounds read in get_rtf_data_from_buf() via uncompressed rtf mapi valuetnef | Medium5.4 |
| CVE-2026-103431 | Collectl: collectl: colmux does not sanitize ansi/vt100 terminal escape sequences in data received from remote collectl instancescollectl | High7.7 |
| CVE-2026-102588 | Moodle: csrf in xml grade importmoodle | Medium6.5 |
| CVE-2026-102587 | Moodle: user list filters bypass profile field visibilitymoodle | Low2.7 |
| CVE-2026-102586 | Moodle: xss via password reset link due to insufficient username escapingmoodle | Medium4.3 |
| CVE-2026-102585 | Moodle: group validation missing when enrolling user to coursemoodle | Medium4.3 |
| CVE-2026-102584 | Moodle: missing capability check allows unauthorised grade penalty recalculationmoodle | Medium4.3 |
| CVE-2026-102583 | Moodle: incorrect capability check in ai generate image web servicemoodle | Low2.7 |
| CVE-2026-102582 | Moodle: manual enrolment page accessible when plugin disabledmoodle | Low2.2 |
| CVE-2026-102581 | Moodle: xss in forum post templates due to insufficient escapingmoodle | Medium4.6 |
| CVE-2026-102580 | Moodle: arbitrary class instantiation via report builder audience classnamemoodle | Low2.2 |
| CVE-2026-102579 | Moodle: user profile information disclosure via grade web servicemoodle | Medium4.3 |
| CVE-2026-102578 | Moodle: sql injection in question bank web servicemoodle | Medium5.5 |
| CVE-2026-102577 | Moodle: ssrf risk in url downloader via ipv4-mapped ipv6 address bypassmoodle | Medium4.3 |
| CVE-2026-91841 | Networkmanager-vpnc: networkmanager-vpnc: incomplete fix for cve-2018-10900 allows root privilege escalation via ca-file path newline injectionGNOME · NetworkManager-vpnc | High7.8 |
| CVE-2026-91840 | Networkmanager-vpnc: networkmanager-vpnc: local privilege escalation to root via newline injection in vpn usernameGNOME · NetworkManager-vpnc | High7.8 |
| CVE-2026-91839 | Networkmanager-fortisslvpn: networkmanager-fortisslvpn: local privilege escalation to root via crlf injection in vpn profile credentialsGNOME · NetworkManager-fortisslvpn | High7.8 |
| CVE-2026-91838 | Networkmanager-sstp: networkmanager-sstp: local privilege escalation to root via shell injection in vpn profile fieldsGNOME · NetworkManager-sstp | High7.8 |
| CVE-2026-91837 | Networkmanager-iodine: networkmanager-iodine: local privilege escalation to root via nameserver option injectionGNOME · NetworkManager-iodine | High7.8 |
| CVE-2026-97222 | Gnumeric: gnumeric: heap use-after-free when opening a malformed workbookGNOME · Gnumeric | Medium5.5 |
| CVE-2026-19816 | PackageKit: dnf5 backend ignores SIMULATE on RepoRemovePackageKit | High7.1 |
| CVE-2026-19624 | NetworkManager-l2tp: local privilege escalation via ipsec.conf injectionNetworkManager-l2tp | High7.8 |
| CVE-2026-77652 | Dia: dia: heap buffer overflow in wpg colormap parser via out-of-bounds palette indexGNOME · Dia | High7.8 |
| CVE-2026-77658 | Dia: dia: stack buffer overflow in bus object via unvalidated handle count in project filesGNOME · Dia | High7.8 |
| CVE-2026-18487 | Epiphany: address bar / host spoofing via userinfo in ephy_uri_get_decoded_host()GNOME · Epiphany | Medium5.4 |
| CVE-2026-3842 | Qemu-kvm: hyperv/syndbg: missing mapped-length guard after cpu_physical_memory_map causes host oob writeqemu | High7.8 |
| CVE-2026-3195 | Qemu-kvm: virtio-snd: heap buffer overflow in virtio_snd_pcm_in_cb (incomplete fix for cve-2024-7730)qemu | High7.4 |
| CVE-2026-3196 | Qemu-kvm: virtio-snd: integer overflow leading to unbounded memory allocationqemu | Medium5.5 |
| CVE-2026-1767 | Localsearch: tracker-miners: gnome localsearch mp3 extractor: heap buffer overflow leading to denial of service or information disclosure via malformed mp3 id3 tagsRed Hat · Red Hat Enterprise Linux 10 | Medium5.6 |
| CVE-2026-1766 | Localsearch: tracker-miners: gnome localsearch mp3 extractor: denial of service and information disclosure via malformed mp3 files.Red Hat · Red Hat Enterprise Linux 10 | Medium5.6 |
| CVE-2026-1765 | Localsearch: tracker-miners: gnome localsearch mp3 extractor: denial of service and potential information disclosure via crafted mp3 filesRed Hat · Red Hat Enterprise Linux 10 | Medium5.6 |
| CVE-2026-1764 | Localsearch: tracker-miners: gnome localsearch mp3 extractor: heap buffer overflow leads to denial of service or information disclosure when parsing mp3 filesRed Hat · Red Hat Enterprise Linux 10 | Medium5.6 |
| CVE-2026-0708 | Libucl: libucl: denial of service via embedded null byte in ucl inputlibucl · libucl | High8.3 |
| CVE-2026-26047 | Moodle: moodle: uncontrolled resource consumption in tex formula editor leading to denial of servicemoodle | Medium6.5 |
| CVE-2026-26046 | Moodle: moodle: improper input sanitization in tex filter administration settingmoodle | High7.2 |
| CVE-2026-26045 | Moodle: moodle: improper validation in file restore functionality leading to remote code executionmoodle | High7.2 |
| CVE-2026-2681 | Github.com/supranational/blst: blst cryptographic library: denial of service via out-of-bounds stack write in key generationblst | Medium5.3 |
| CVE-2026-0665 | Qemu-kvm: heap off-by-one in kvm xen physdevop_map_pirqqemu | Medium6.5 |
| CVE-2025-8860 | Qemu-kvm: uefi-vars: information disclosure vulnerability in uefi_vars_write callbackqemu | Low3.3 |
| CVE-2025-14876 | Qemu-kvm: unbounded allocation in virtio-cryptoqemu | Medium5.5 |