Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 1 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 400,797All CVEsplus 19,115 rejected
- 486Last 24 hours2,895 in the last 7 days
- 16,849Last 30 days1,547 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 14 | 71 | 58 | 12 | 0 | 155 | 158 |
| 2025 | 0 | 1 | 1 | 1 | 0 | 3 | 3 |
| Title | ||
|---|---|---|
| CVE-2026-120216 | fastify vulnerable to Denial of Service via uncaught exception on handlerTimeout with streaming responsesfastify · fastify | Medium5.9 |
| CVE-2026-117518 | @fastify/reply-from vulnerable to path traversal via backslash dot-segment prefix escape@fastify/reply-from · @fastify/reply-from | High8.2 |
| CVE-2026-117531 | @fastify/multipart vulnerable to Denial of Service via a malformed upload hanging delayed file consumers@fastify/multipart · @fastify/multipart | Medium5.9 |
| CVE-2026-117549 | @fastify/secure-session vulnerable to signature verification bypass via cookie signature removal@fastify/secure-session · @fastify/secure-session | Medium4.2 |
| CVE-2026-120215 | @fastify/cors vulnerable to Denial of Service on a CORS preflight with the onSend hook@fastify/cors · @fastify/cors | Low3.7 |
| CVE-2026-120213 | @fastify/http-proxy vulnerable to prefix escape via decoded route parameters@fastify/http-proxy · @fastify/http-proxy | Critical9.1 |
| CVE-2026-120214 | @fastify/http-proxy vulnerable to prefix escape via percent-encoded backslash dot-segments@fastify/http-proxy · @fastify/http-proxy | Medium5.9 |
| CVE-2026-112362 | @fastify/express vulnerable to path-scoped middleware bypass via absolute-form request targets@fastify/express · @fastify/express | Critical9.1 |
| CVE-2026-117499 | @fastify/session vulnerable to session revocation bypass via a logout race condition@fastify/session · @fastify/session | Low3.7 |
| CVE-2026-111181 | body-parser vulnerable to Denial of Service via trailing bytes after a compressed request bodybody-parser · body-parser | High7.5 |
| CVE-2026-113872 | multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardownmulter · multer | High7.5 |
| CVE-2026-114348 | webpack-dev-server vulnerable to information disclosure via Host validation bypass in the open-editor endpointwebpack-dev-server · webpack-dev-server | Medium5.3 |
| CVE-2026-112085 | webpack-dev-server vulnerable to cross-origin WebSocket access via proxied upgradeswebpack-dev-server · webpack-dev-server | High8.2 |
| CVE-2026-112712 | @fastify/middie vulnerable to path-scoped middleware bypass via scope prefix mismatch@fastify/middie · @fastify/middie | Critical9.1 |
| CVE-2026-110725 | fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix referencesfast-uri · fast-uri | Low3.7 |
| CVE-2026-110306 | fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decodingfast-uri · fast-uri | Medium6.1 |
| CVE-2026-110180 | fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalizationfast-uri · fast-uri | Medium4.8 |
| CVE-2026-110095 | fast-uri vulnerable to improper path equivalence in relative reference normalizationfast-uri · fast-uri | Low3.7 |
| CVE-2026-110008 | @fastify/oauth2 vulnerable to Login CSRF via OAuth state cookie not cleared after callback@fastify/oauth2 · @fastify/oauth2 | Medium4.2 |
| CVE-2026-110024 | @fastify/jwt vulnerable to missing token expiration when per-call options drop global defaults@fastify/jwt · @fastify/jwt | Medium6.8 |
| CVE-2026-87029 | undici vulnerable to Denial of Service via unhandled exception in the decompress interceptorundici · undici | Medium5.9 |
| CVE-2026-109932 | undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG bufferingundici · undici | Medium5.9 |
| CVE-2026-87018 | undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiationundici · undici | High7.5 |
| CVE-2026-109383 | undici vulnerable to TLS certificate validation bypass via dropped tls options in Agentundici · undici | High7.4 |
| CVE-2026-109829 | undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirectsundici · undici | High7.4 |
| CVE-2026-109841 | undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokensundici · undici | Medium5.9 |
| CVE-2026-109924 | undici vulnerable to Denial of Service via unbounded memory in the EventSource parserundici · undici | Medium5.9 |
| CVE-2026-109869 | undici vulnerable to Denial of Service via unhandled error on excessive content-encodingsundici · undici | High7.5 |
| CVE-2026-109855 | undici WebSocket client vulnerable to Denial of Service via failed HTTP/2 handshakeundici · undici | High7.5 |
| CVE-2026-107832 | fastify vulnerable to header validation bypass via case-sensitive propertyNamesfastify · fastify | Low3.7 |
| CVE-2026-107318 | @fastify/reply-from vulnerable to improper certificate validation in built-in HTTPS transports@fastify/reply-from · @fastify/reply-from | High7.4 |
| CVE-2026-107275 | @fastify/jwt vulnerable to missing token expiration when temporal options cannot be parsed@fastify/jwt · @fastify/jwt | Medium6.8 |
| CVE-2026-90982 | @fastify/static vulnerable to route guard bypass via path case-folding@fastify/static · @fastify/static | Medium5.3 |
| CVE-2026-92395 | @fastify/proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet@fastify/proxy-addr · @fastify/proxy-addr | Critical9.1 |
| CVE-2026-92087 | @fastify/auth vulnerable to Authorization Bypass via order-dependent evaluation of composed auth@fastify/auth · @fastify/auth | High8.1 |
| CVE-2026-92081 | fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responsesfastify · fastify | Medium5.9 |
| CVE-2026-86818 | fast-uri vulnerable to mailto header injection via percent-encoded field-name desynchronizationfast-uri · fast-uri | Medium4.8 |
| CVE-2026-86472 | fast-uri vulnerable to inconsistent host case normalization via percent-encoded octetsfast-uri · fast-uri | Medium4.8 |
| CVE-2026-90711 | proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnetproxy-addr · proxy-addr | Critical9.1 |
| CVE-2026-17495 | moment vulnerable to Path Traversal via crafted non-string locale namemoment · moment | Medium5.9 |
| CVE-2026-88932 | multer vulnerable to Denial of Service via orphaned disk writes on aborted uploadsmulter · multer | Medium5.3 |
| CVE-2026-87776 | compression vulnerable to Denial of Service via memory leak on premature response closecompression · compression | High7.5 |
| CVE-2026-87123 | hbs vulnerable to Denial of Service via unhandled exception in async helper output escapinghbs · hbs | Medium5.9 |
| CVE-2026-87859 | morgan vulnerable to Log Injection via unescaped double quote in quoted log fieldsmorgan · morgan | Medium5.3 |
| CVE-2026-87908 | multiparty vulnerable to Denial of Service via unbounded part-header accumulationmultiparty · multiparty | High7.5 |
| CVE-2026-88038 | cookies vulnerable to Set-Cookie attribute injection via unvalidated domain and path optionscookies · cookies | Medium4.8 |
| CVE-2026-75021 | fastify-cli vulnerable to remote code execution via ignored explicit Inspector bind addressfastify-cli · fastify-cli | High8.1 |
| CVE-2026-18149 | undici vulnerable to Denial of Service via orphaned RetryHandler response bodyundici · undici | Medium5.9 |
| CVE-2026-18540 | undici vulnerable to downstream response splitting via retry interceptorundici · undici | Low3.7 |
| CVE-2026-19534 | undici vulnerable to Denial of Service via unrequested WebSocket subprotocolundici · undici | High7.5 |