Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 6 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 400,109All CVEsplus 18,875 rejected
- 790Last 24 hours3,263 in the last 7 days
- 17,391Last 30 days1,568 of them critical
- 1,767Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 71 | 99 | 82 | 20 | 3 | 275 | 1,805 |
| 2025 | 18 | 25 | 34 | 7 | 0 | 84 | 1,530 |
| 2024 | 40 | 110 | 31 | 6 | 0 | 187 | 1,446 |
| 2023 | 33 | 67 | 43 | 1 | 0 | 144 | 1,259 |
| 2022 | 13 | 25 | 46 | 1 | 0 | 85 | 1,115 |
| 2021 | 17 | 55 | 62 | 3 | 0 | 137 | 1,030 |
| 2020 | 26 | 82 | 94 | 4 | 0 | 206 | 893 |
| 2019 | 17 | 40 | 37 | 3 | 0 | 97 | 687 |
| 2018 | 43 | 386 | 97 | 3 | 0 | 529 | 590 |
| 2017 | 12 | 13 | 31 | 3 | 0 | 59 | 61 |
| 2016 | 1 | 1 | 0 | 0 | 0 | 2 | 2 |
| Title | ||
|---|---|---|
| CVE-2026-105476 | Improper link resolution before file access in cPanel allows remote authenticated users to write arbitrary root-owned files and escalate privileges.WebPros · cPanel | High8.8 |
| CVE-2026-105475 | Improper neutralization of a NUL byte in cPanel allows remote attackers to read any mail account's calendar and contact data.WebPros · cPanel | High8.7 |
| CVE-2026-107238 | A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) as the LocalSystem account on servers running the Veeam Management…Veeam · Management Pack for Microsoft System Center | High8.7 |
| CVE-2026-107239 | A vulnerability allowing a member of the Veeam Virtualization Extensions Users group to perform remote code execution (RCE) on servers running the Veeam…Veeam · Management Pack for Microsoft System Center | High8.8 |
| CVE-2023-22793 | A vulnerability allowing an unauthenticated attacker to perform remote code execution (RCE) on servers running the Veeam Virtualization Extensions service of…Veeam · Management Pack for Microsoft System Center | Critical9.3 |
| CVE-2025-64394 | A vulnerability allowing a low-privileged local user to write arbitrary files with SYSTEM privileges during the installation of Veeam Backup for Microsoft 365,…Veeam · Backup for Microsoft 365 | Medium4.3 |
| CVE-2026-108141 | A vulnerability allowing an authenticated user with the Restore Operator role, who also controls the contents of a backed-up NAS share, to write…Veeam · Backup and Replication | Medium5.9 |
| CVE-2026-106078 | A vulnerability allowing an unauthenticated attacker to bypass REST API authentication with a forged federation token and receive responses from REST API…Veeam · Backup for Microsoft 365 | Medium6.9 |
| CVE-2026-107671 | A vulnerability allowing an attacker with valid Administrator credentials to bypass multi-factor authentication by disabling it globally before completing MFA…Veeam · ONE | High8.5 |
| CVE-2026-108142 | A vulnerability allowing an unauthenticated attacker to bypass authorization on the CDP Coordinator Service.Veeam · Backup and Replication | Critical9.1 |
| CVE-2026-106077 | A vulnerability allowing a user with the Veeam Backup for Microsoft 365 Administrator role to read arbitrary files on the backup server with LocalSystem…Veeam · Backup for Microsoft 365 | High8.3 |
| CVE-2026-106076 | A vulnerability allowing an authenticated organization-transfer peer to inject SQL into the configuration database of the source Veeam Backup for Microsoft 365…Veeam · Backup for Microsoft 365 | Critical9.0 |
| CVE-2026-108140 | A vulnerability allowing an authenticated user with the Restore Operator role, who also controls the contents of a backed-up NAS share, to write…Veeam · Backup and Replication | Medium5.9 |
| CVE-2026-105477 | A vulnerability in Veeam Agent for Linux allows for local privilege escalation. Only installations that are managed by a Veeam Backup & Replication instance…Veeam · Agent for Linux | High7.3 |
| CVE-2026-82984 | When a team was configured as "visible to everyone", the web UI correctly blocked non-members from viewing the team ("You are not a member of ..."), but the…Nextcloud · Server | Medium4.3 |
| CVE-2026-77167 | Abusing the federated share endpoint, an attacker can write arbitrary rows into the oc_share_external database table. These rows persist indefinitely — there…Nextcloud · server | High7.5 |
| CVE-2026-77173 | A user could create a docx or odt file with a # in the filename with confidential information such as a credit card number and have it not be marked as…Nextcloud · Files Confidential | Medium4.3 |
| CVE-2026-67400 | A missing token type check allowed to retrieve more additional information about the WOPI configuration with a user or guest token.Nextcloud · Richdocuments | Low3.5 |
| CVE-2026-77171 | A public shared collective always allowed recipients of the link to create pages.Nextcloud · Collectives | Low3.5 |
| CVE-2026-77172 | App passwords were allowed to bypass password confirmation on sensitive endpoints.Nextcloud · Server | Medium5.3 |
| CVE-2026-87897 | A SSRF vulnerability found that enables access to internal Chrome Devtools Protocol APIs that can leak the JWT authentication token for another user. A low…Nextcloud · whiteboard | Medium4.6 |
| CVE-2026-82983 | The Tables app's share-listing endpoint (GET /apps/tables/share/table/{tableId}) did not verify that the requesting user has manage-level permission on the…Nextcloud · Tables | Low3.3 |
| CVE-2026-82986 | The user in a group can bypass the group restriction set by an administrator on link sharing, creating share links for a table even though they shouldn't have…Nextcloud · Tables | Medium4.6 |
| CVE-2026-106069 | A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP address than the one the client connected to,…nodejs · node | High7.4 |
| CVE-2026-105481 | A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request. This is an…nodejs · node | Medium6.5 |
| CVE-2026-105482 | A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse(). This is an…nodejs · node | High7.4 |
| CVE-2026-106074 | A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`, and `crypto.randomInt()` to be saved into…nodejs · node | Medium4.8 |
| CVE-2026-106071 | A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--allow-fs-read` or `--allow-fs-write` rule.…nodejs · node | Low3.6 |
| CVE-2026-106072 | A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when the client connects using a…nodejs · node | Medium6.7 |
| CVE-2026-87901 | Improper sanitization in the registration module allows reflected Cross-Site Scripting.phpBB · phpBB | High8.3 |
| CVE-2026-105483 | A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 address when the…nodejs · node | High7.4 |
| CVE-2026-106070 | A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entry after the local and central header validation…nodejs · node | Low3.7 |
| CVE-2026-106073 | A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permission checks. This is an incomplete fix of…nodejs · node | Low3.3 |
| CVE-2026-105474 | A server-side template injection exists in SolusVM 2 up to version 2.0.0-44576 that allows remote authenticated users to execute arbitrary code as root.WebPros · SolusVM 2 | Critical9.4 |
| CVE-2026-93699 | Argument injection in WP Toolkit for cPanel allows local users to execute arbitrary code as other accounts on the same server.WebPros · WP Toolkit | High8.5 |
| CVE-2025-64391 | This vulnerability in Veeam Agent for Microsoft Windows allows a low-privileged local user to make the agent write files to arbitrary locations when an…Veeam · Agent for Windows | Medium4.1 |
| CVE-2025-64392 | This vulnerability in Veeam Backup Enterprise Manager allows an attacker to execute script in the browser of a portal user who opens a crafted link.Veeam · Backup Enterprise Manager | Medium4.8 |
| CVE-2026-93026 | This vulnerability in Veeam Backup & Replication allows a Backup Viewer to modify the Enterprise Manager master key and stored antivirus update credentials.Veeam · Backup and Replication | Medium6.1 |
| CVE-2026-58068 | This vulnerability in Veeam Agent for Microsoft Windows allows any local user to terminate arbitrary processes on the system.Veeam · Agent for Windows | Medium6.8 |
| CVE-2026-58069 | This vulnerability in Veeam Backup & Replication allows an authenticated Cloud Connect tenant to read arbitrary files on the service provider host.Veeam · Backup and Replication | High8.3 |
| CVE-2025-64393 | This vulnerability in Veeam Backup & Replication allows a Backup Viewer to execute arbitrary code as SYSTEM on the backup server.Veeam · Backup and Replication | Critical9.4 |
| CVE-2026-93029 | There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Manage SSL Hosts interface.Webpros · cPanel | Critical9.0 |
| CVE-2026-93697 | There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Mass Modify Accounts interface.Webpros · cPanel | Critical9.0 |
| CVE-2026-93698 | Insufficient validation allows arbitrary commands to be executed via the Multilang adminbin.Webpros · cPanel | Critical9.9 |
| CVE-2026-87899 | Execution with unnecessary privileges in cPanel allows remote authenticated users to execute arbitrary code with root privileges.WebPros · cPanel | Critical9.4 |
| CVE-2026-68492 | An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before 18.0.81.1 allows remote authenticated users to execute…WebPros · Plesk | High8.7 |
| CVE-2026-68490 | Incorrect permission assignment allows local users to obtain sensitive CalDAV/CardDAV information belonging to other accounts.WebPros · cPanel | High8.2 |
| CVE-2026-87900 | Argument injection in WP Toolkit for cPanel 6.11.2-10794 and earlier allows remote authenticated users to read arbitrary files and execute arbitrary code…WebPros · WP Toolkit for cPanel | Critical9.4 |
| CVE-2026-87898 | OS command injection in Plesk allows remote authenticated users to execute arbitrary code with root privileges.WebPros · Plesk extension "Site Import" | Critical9.4 |
| CVE-2026-87902 | An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme…ExploitedWordPress · WordPress | High8.1 |