Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 2 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 399,660All CVEsplus 18,865 rejected
- 540Last 24 hours2,963 in the last 7 days
- 17,025Last 30 days1,508 of them critical
- 1,766Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 4 | 31 | 22 | 6 | 0 | 63 | 144 |
| 2025 | 0 | 1 | 5 | 0 | 0 | 6 | 81 |
| 2024 | 1 | 2 | 6 | 0 | 0 | 9 | 75 |
| 2023 | 0 | 9 | 10 | 0 | 0 | 19 | 66 |
| 2022 | 3 | 6 | 4 | 0 | 0 | 13 | 47 |
| 2021 | 1 | 4 | 2 | 1 | 0 | 8 | 34 |
| 2020 | 0 | 1 | 1 | 1 | 0 | 3 | 26 |
| 2019 | 0 | 1 | 4 | 2 | 0 | 7 | 23 |
| 2018 | 0 | 1 | 5 | 0 | 0 | 6 | 16 |
| 2017 | 0 | 5 | 5 | 0 | 0 | 10 | 10 |
| Title | ||
|---|---|---|
| CVE-2026-84784 | QUIC: Unbounded RETIRE_CONNECTION_ID BacklogOpenSSL · OpenSSL | High7.5 |
| CVE-2026-84783 | Use-After-Free in X.509 Extension Cache Under Concurrent UseOpenSSL · OpenSSL | High7.5 |
| CVE-2026-84782 | DTLS Retransmits Handshake Messages From a Stale Buffer OffsetOpenSSL · OpenSSL | High8.2 |
| CVE-2026-77696 | Timing Side-Channel in SM2 Signature GenerationOpenSSL · OpenSSL | Low3.7 |
| CVE-2026-75806 | Unauthenticated and Undersized DTLS 1.2 AEAD Record Causes DoSOpenSSL · OpenSSL | Medium5.3 |
| CVE-2026-75805 | NULL Pointer Dereference in CMP Client Revocation Response HandlingOpenSSL · OpenSSL | Medium5.3 |
| CVE-2026-75804 | QUIC Connection-Level Flow Control is Not Enforced for StreamsOpenSSL · OpenSSL | Medium5.3 |
| CVE-2026-72897 | Out-of-Bounds Access After SSL_set_SSL_CTX() During a HandshakeOpenSSL · OpenSSL | High7.5 |
| CVE-2026-54875 | Non-Constant-Time SM2 Scalar Multiplication on ARM64 and RISC-VOpenSSL · OpenSSL | Low3.7 |
| CVE-2026-54873 | QUIC STREAM Fragment Metadata DoSOpenSSL · OpenSSL | High7.5 |
| CVE-2026-54872 | Timing Side-Channel in Scalar Multiplication for Non-NIST EC CurvesOpenSSL · OpenSSL | Low3.7 |
| CVE-2026-42772 | Potential CPU DoS via O(n^2) Fragment Reassembly in QUICOpenSSL · OpenSSL | Medium5.3 |
| CVE-2026-35191 | QUIC Unvalidated Amplification Credit may be Over AccountedOpenSSL · OpenSSL | Low3.7 |
| CVE-2026-35189 | Excessive Memory Allocation in Relative CRLDP ProcessingOpenSSL · OpenSSL | Medium5.3 |
| CVE-2026-75803 | AEAD Forgeries with Empty Ciphertext When Using EVP_Cipher()OpenSSL · OpenSSL | Critical9.1 |
| CVE-2026-63076 | Invalid Pointer Dereference in CMP Server via Crafted protectionAlgOpenSSL · OpenSSL | High7.5 |
| CVE-2026-63075 | QUIC ACK-only Packet Retention Can Cause Memory ExhaustionOpenSSL · OpenSSL | High7.5 |
| CVE-2026-63074 | CMP Indefinite Cache Growth of ExtraCertsOpenSSL · OpenSSL | Medium5.9 |
| CVE-2026-63073 | Untrusted Sender DN Used as Format String in CMP Response ValidationOpenSSL · OpenSSL | Critical9.8 |
| CVE-2026-63072 | Heap Buffer Overflow in CMS Key UnwrappingOpenSSL · OpenSSL | High7.5 |
| CVE-2026-54874 | Excessive Memory Use Buffering DTLS Records for a Future EpochOpenSSL · OpenSSL | High7.5 |
| CVE-2026-18798 | QUIC Server May Trigger Double Free When Processing INITIAL PacketOpenSSL · OpenSSL | High7.5 |
| CVE-2026-14457 | RPK Server Signature Algorithm Selection Can Dereference a Missing CertificateOpenSSL · OpenSSL | High7.5 |
| CVE-2026-14456 | Unbounded Memory Growth in QUIC Server Incoming Channel QueueOpenSSL · OpenSSL | High7.5 |
| CVE-2026-54876 | Client-Side Memory Leak in OCSP Response CheckingOpenSSL · OpenSSL | High7.5 |
| CVE-2026-45447 | Heap Use-After-Free in the PKCS7_verify() FunctionOpenSSL · OpenSSL | High8.8 |
| CVE-2026-45446 | Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modesOpenSSL · OpenSSL | Medium4.8 |
| CVE-2026-45445 | AES-OCB IV Ignored on EVP_Cipher() PathOpenSSL · OpenSSL | High7.5 |
| CVE-2026-42771 | Possible Out of Bounds Read in X509_VERIFY_PARAM_set1_email()OpenSSL · OpenSSL | Medium6.2 |
| CVE-2026-42770 | FFC-DH Peer Validation Uses Attacker-Supplied qOpenSSL · OpenSSL | Low3.7 |
| CVE-2026-42769 | Trust-Anchor Substitution via cert/issuer Typo in CMP rootCaKeyUpdateOpenSSL · OpenSSL | Medium5.3 |
| CVE-2026-42768 | Multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt() and PKCS7_decrypt()OpenSSL · OpenSSL | Low3.7 |
| CVE-2026-42767 | NULL Pointer Dereference in CRMF EncryptedValue DecryptionOpenSSL · OpenSSL | Medium5.9 |
| CVE-2026-42766 | Possible NULL Dereference in Password-Based CMS DecryptionOpenSSL · OpenSSL | Medium5.9 |
| CVE-2026-42765 | NULL Dereference in Certificate Verification with OCSP CheckingOpenSSL · OpenSSL | High7.5 |
| CVE-2026-42764 | NULL Pointer Dereference in QUIC Server Initial Packet HandlingOpenSSL · OpenSSL | High7.5 |
| CVE-2026-35188 | Double-free When Checking OCSP Stapled ResponseOpenSSL · OpenSSL | Medium5.0 |
| CVE-2026-34183 | Unbounded Memory Growth in the QUIC PATH_CHALLENGE HandlerOpenSSL · OpenSSL | High7.5 |
| CVE-2026-34182 | CMS AuthEnvelopedData Processing May Accept Forged MessagesOpenSSL · OpenSSL | Critical9.1 |
| CVE-2026-34181 | PKCS#12 Files with PBMAC1 Are Accepted with Short HMAC KeysOpenSSL · OpenSSL | High7.4 |
| CVE-2026-34180 | Heap Buffer Over-read in ASN.1 Content ParsingOpenSSL · OpenSSL | High7.5 |
| CVE-2026-9076 | Out-of-Bounds Read in CMS Password-Based DecryptionOpenSSL · OpenSSL | High7.5 |
| CVE-2026-7383 | Possible Heap Buffer Overflow in ASN.1 Multibyte String ConversionOpenSSL · OpenSSL | High8.1 |
| CVE-2026-31790 | Incorrect Failure Handling in RSA KEM RSASVE EncapsulationOpenSSL · OpenSSL | High7.5 |
| CVE-2026-31789 | Heap Buffer Overflow in Hexadecimal ConversionOpenSSL · OpenSSL | Medium5.8 |
| CVE-2026-28390 | Possible NULL Dereference When Processing CMS KeyTransportRecipientInfoOpenSSL · OpenSSL | High7.5 |
| CVE-2026-28389 | Possible NULL Dereference When Processing CMS KeyAgreeRecipientInfoOpenSSL · OpenSSL | High7.5 |
| CVE-2026-28388 | NULL Pointer Dereference When Processing a Delta CRLOpenSSL · OpenSSL | High7.5 |
| CVE-2026-28387 | Potential Use-after-free in DANE Client CodeOpenSSL · OpenSSL | High8.1 |
| CVE-2026-28386 | Out-of-bounds Read in AES-CFB-128 on X86-64 with AVX-512 SupportOpenSSL · OpenSSL | Critical9.1 |