Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 8 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 400,042All CVEsplus 18,873 rejected
- 734Last 24 hours3,250 in the last 7 days
- 17,396Last 30 days1,557 of them critical
- 1,766Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 23 | 237 | 78 | 22 | 38 | 398 | 5,396 |
| 2025 | 10 | 176 | 96 | 4 | 0 | 286 | 4,998 |
| 2024 | 16 | 163 | 76 | 3 | 0 | 258 | 4,712 |
| 2023 | 46 | 260 | 304 | 16 | 0 | 626 | 4,454 |
| 2022 | 50 | 286 | 314 | 48 | 0 | 698 | 3,828 |
| 2021 | 16 | 219 | 279 | 16 | 0 | 530 | 3,130 |
| 2020 | 41 | 182 | 302 | 10 | 0 | 535 | 2,600 |
| 2019 | 16 | 238 | 213 | 10 | 0 | 477 | 2,065 |
| 2018 | 49 | 183 | 51 | 3 | 0 | 286 | 1,588 |
| 2017 | 24 | 469 | 207 | 2 | 0 | 702 | 1,302 |
| 2016 | 42 | 330 | 141 | 5 | 0 | 518 | 600 |
| 2015 | 0 | 57 | 24 | 1 | 0 | 82 | 82 |
| Title | ||
|---|---|---|
| CVE-2026-58873 | In addDragDropListener of WindowManagerService.java, there is a possible permission bypass due to a missing permission check. This could lead to local…Google · Android XR | High8.4 |
| CVE-2026-58977 | In is_valid_header of timed_cache_item.c, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local escalation of…Google · Android | Medium6.7 |
| CVE-2026-58930 | An unprivileged application can exploit a lack of package/signature validation in SystemUI's `RemoteQCController` when resolving a hardcoded `content://` URI.…Google · Android | Not scored |
| CVE-2026-58927 | The vulnerability is a Use-After-Free (UAF) in the EVS AIDL HAL, arising from a data race on an unsynchronized `std::weak_ptr` within…Google · Android | Not scored |
| CVE-2026-58926 | A Use-After-Free (UAF) vulnerability exists in the EVS HAL, allowing a privileged client to free a `buffer_handle_t` while the producer thread is still using…Google · Android | Low2.5 |
| CVE-2026-58925 | The report details a heap Use-After-Free (UAF) vulnerability within the `android.hardware.automotive.evs-default` HAL service, stemming from unsynchronized…Google · Android | Not scored |
| CVE-2026-58924 | The vulnerability is a heap out-of-bounds read in the EVS HAL's `getStreamList()` method. An attacker can craft a `CameraDesc.metadata` byte array, which is…Google · Android | Not scored |
| CVE-2026-58915 | A physical occupant on an Android Automotive OS (AAOS) Multi-User Multi-Display (MUMD) passenger display can view sensitive Heads-Up Notification (HUN) content…Google · Android | Medium6.1 |
| CVE-2026-49906 | An unprivileged application can bypass the `android.car.permission.CAR_DISPLAY_IN_CLUSTER` permission by registering an activity with the…Google · Android | High7.8 |
| CVE-2026-49903 | The `ClusterRenderingService.dump()` method, accessible to processes holding `android.permission.DUMP` and `android.permission.PACKAGE_USAGE_STATS`, acts as a…Google · Android | Not scored |
| CVE-2026-59048 | In rb_cpu_init of trace.c, there is a possible out-of-bounds read due to an incorrect bounds check. This could lead to local information disclosure with no…Google · Android | Not scored |
| CVE-2026-59047 | In multiple locations, there is a possible denial of service due to a logic error in the code. This could lead to local denial of service with no additional…Google · Android | Medium6.2 |
| CVE-2026-59046 | In __pkvm_guest_relinquish_to_host of mem_protect.c, there is a possible out-of-bounds write due to improper input validation. This could lead to local denial…Google · Android | Medium6.2 |
| CVE-2026-59045 | In multiple locations, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with no additional…Google · Android | High7.4 |
| CVE-2026-59044 | In multiple locations, there is a possible use-after-free due to a logic error in the code. This could lead to local escalation of privilege with no additional…Google · Android | High8.4 |
| CVE-2026-59043 | In arm_lpae_split_blk_unmap of io-pgtable-arm-common.c, there is a possible memory corruption due to a race condition. This could lead to local escalation of…Google · Android | High7.4 |
| CVE-2026-59042 | In __pkvm_pages_to_ppages of mmu.c, there is a possible out-of-bounds write due to a race condition. This could lead to local escalation of privilege with no…Google · Android | High7.4 |
| CVE-2026-59031 | In InputDispatcher::flushSensor of InputDispatcher.cpp, there is a possible denial of service due to a logic error in the code. This could lead to local denial…Google · Android | Medium6.2 |
| CVE-2026-59028 | In resolveAidConflictLocked of RegisteredAidCache.java, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of…Google · Android | High8.4 |
| CVE-2026-59022 | In multiple functions of MediaProvider.java, there is a possible permission bypass due to a logic error in the code. This could lead to local information…Google · Android | Not scored |
| CVE-2026-59021 | In multiple locations, there is a possible denial of service due to improper input validation. This could lead to local denial of service with User execution…Google · Android | Medium6.2 |
| CVE-2026-59020 | In removeUserData of DevicePolicyManagerService.java, there is a possible denial of service due to a race condition. This could lead to local denial of service…Google · Android | Medium5.9 |
| CVE-2026-59016 | In sendAnomalyProfile of ProfilingService.java, there is a possible path traversal issue due to path traversal. This could lead to local escalation of…Google · Android | High8.4 |
| CVE-2026-59015 | In multiple locations, there is a possible permission bypass due to a confused deputy. This could lead to local information disclosure with no additional…Google · Android | Medium4.0 |
| CVE-2026-59014 | In multiple locations, there is a possible out-of-bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional…Google · Android | High8.4 |
| CVE-2026-59012 | In checkLastKnownCellIdAccessPermission of TelephonyPermissions.java, there is a possible permission bypass due to a missing permission check. This could lead…Google · Android | Not scored |
| CVE-2026-59011 | In multiple locations, there is a possible permission bypass due to a logic error in the code. This could lead to local information disclosure with no…Google · Android | Not scored |
| CVE-2026-59010 | In deserialize of legacy.rs, there is a possible denial of service due to a missing bounds check. This could lead to local denial of service with no additional…Google · Android | Medium6.2 |
| CVE-2026-59008 | In setApplicationRestrictions of DevicePolicyManagerService.java, there is a possible denial of service due to resource exhaustion. This could lead to local…Google · Android | Medium6.2 |
| CVE-2026-59007 | In decode_packed_entry_number of codebook.c, there is a possible out-of-bounds read due to a logic error in the code. This could lead to remote information…Google · Android | Medium5.3 |
| CVE-2026-59006 | In getTouchOcclusionMode of WindowState.java, there is a possible tapjacking issue due to a tapjacking/overlay attack. This could lead to local information…Google · Android | Medium4.0 |
| CVE-2026-59005 | In insertInternal of MmsProvider.java, there is a possible multiuser isolation issue due to a missing permission check. This could lead to local escalation of…Google · Android | High8.4 |
| CVE-2026-59004 | In multiple locations, there is a possible permission bypass due to an uncaught exception. This could lead to local escalation of privilege with no additional…Google · Android | High8.4 |
| CVE-2026-59003 | In getSubscriptionProperty of SubscriptionManagerService.java, there is a possible information disclosure due to a missing permission check. This could lead to…Google · Android | Medium4.0 |
| CVE-2026-59002 | In handleMessage of UsbDeviceManager.java, there is a possible lock-screen bypass due to a logic error in the code. This could lead to physical information…Google · Android | Not scored |
| CVE-2026-59001 | In checkQueryPermission of TelephonyProvider.java, there is a possible permission bypass due to a logic error in the code. This could lead to local information…Google · Android | Not scored |
| CVE-2026-59000 | In multiple locations, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional…Google · Android | High8.4 |
| CVE-2026-58997 | In validateImageInfo of Bitmap.cpp, there is a possible out-of-bounds read due to a precondition check failure. This could lead to local information disclosure…Google · Android | Not scored |
| CVE-2026-58995 | In getEntryFileName of ZipFileRO.cpp, there is a possible memory safety issue due to a heap buffer overflow. This could lead to local escalation of privilege…Google · Android | High8.4 |
| CVE-2026-58994 | In multiple functions of NfcService.java, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of…Google · Android | High8.4 |
| CVE-2026-58990 | In l2c_fcr_process_peer_cfg_req of l2c_fcr.cc, there is a possible memory safety issue due to an integer overflow. This could lead to remote information…Google · Android | Not scored |
| CVE-2026-58989 | In setOemUnlockAllowedByUser of OemLockService.java, there is a possible way to bypass FRP due to a missing permission check. This could lead to local…Google · Android | High8.4 |
| CVE-2026-58988 | In isValid of ShimConverter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no…Google · Android | Medium4.0 |
| CVE-2026-58986 | In notifyPictureProfileHandleSelection of MediaQualityService.java, there is a possible permission bypass due to a missing permission check. This could lead to…Google · Android | High8.4 |
| CVE-2026-58985 | In handleConnectInternal of RpcServerTrusty.cpp, there is a possible denial of service due to a logic error in the code. This could lead to local denial of…Google · Android | Medium6.2 |
| CVE-2026-58984 | In multiple locations, there is a possible memory corruption due to a use-after-free. This could lead to local escalation of privilege with no additional…Google · Android | High8.4 |
| CVE-2026-58979 | In canPresent of PresentationController.java, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of…Google · Android | High8.4 |
| CVE-2026-58978 | In multiple locations, there is a possible permission bypass due to a logic error in the code. This could lead to physical escalation of privilege with no…Google · Android | Medium6.8 |
| CVE-2026-58976 | In getSelectionBySubIds of ProviderUtil.java, there is a possible cross-user data leak due to a logic error in the code. This could lead to local information…Google · Android | Not scored |
| CVE-2026-58975 | In multiple locations, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local escalation of privilege with no…Google · Android | High8.4 |