Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 8 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,334All CVEsplus 19,141 rejected
- 443Last 24 hours2,721 in the last 7 days
- 16,923Last 30 days1,562 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 12 | 34 | 42 | 5 | 0 | 93 | 333 |
| 2025 | 7 | 8 | 11 | 3 | 0 | 29 | 240 |
| 2024 | 2 | 9 | 10 | 2 | 0 | 23 | 211 |
| 2023 | 8 | 16 | 19 | 1 | 0 | 44 | 188 |
| 2022 | 1 | 9 | 14 | 2 | 0 | 26 | 144 |
| 2021 | 1 | 7 | 14 | 4 | 0 | 26 | 118 |
| 2020 | 9 | 10 | 14 | 0 | 0 | 33 | 92 |
| 2019 | 3 | 5 | 8 | 5 | 0 | 21 | 59 |
| 2018 | 4 | 1 | 1 | 2 | 0 | 8 | 38 |
| 2017 | 0 | 21 | 7 | 1 | 0 | 29 | 30 |
| 2016 | 0 | 0 | 1 | 0 | 0 | 1 | 1 |
| Title | ||
|---|---|---|
| CVE-2026-121139 | Rapid7 Metasploit Framework Web Service unauthenticated bootstrap window allows creation of an administrator account without authenticationRapid7 · Metasploit Framework | High7.3 |
| CVE-2026-115805 | Rapid7 Insight Agent Local Privilege Escalation via Shell Injection in mcp.json Configuration PathRapid7 · Insight Agent | High7.8 |
| CVE-2026-115786 | Zimbra Collaboration Suite Shared-File Mailbox Quota Accounting Error Enables Quota ExhaustionZimbra · Zimbra Collaboration Suite | Medium6.5 |
| CVE-2026-115785 | Zimbra Collaboration Suite Data Source Test SMTP Command Injection via Unsanitized Email AddressZimbra · Zimbra Collaboration Suite | Medium4.3 |
| CVE-2026-93640 | Zimbra Collaboration Suite Local Privilege Escalation via Unrestricted zmunbound Sudo ConfigurationZimbra · Zimbra Collaboration Suite | High7.8 |
| CVE-2026-50057 | Zimbra Collaboration Suite Local Privilege Escalation via Unrestricted Postfix Sudo PermissionsZimbra · Zimbra Collaboration Suite | High7.8 |
| CVE-2026-50056 | Zimbra Collaboration Suite Local Privilege Escalation via zmmailboxdmgr JVM Argument InjectionZimbra · Zimbra Collaboration Suite | High7.8 |
| CVE-2026-93639 | Zimbra Collaboration Suite Missing Authorization in ConfigureZimlet Enables Delegated Administrator Privilege EscalationZimbra · Zimbra Collaboration Suite | High8.7 |
| CVE-2026-93638 | Zimbra Collaboration Suite Pre-Authentication Reflected Cross-Site Scripting via Login Page zrememberme ParameterZimbra · Zimbra Collaboration Suite | Medium6.1 |
| CVE-2026-93636 | Zimbra Collaboration Suite LDAP Filter Injection via Calendar Resource Attribute NameZimbra · Zimbra Collaboration Suite | Medium4.3 |
| CVE-2026-93634 | Zimbra Collaboration Suite Cross-Account Authorization Bypass via Forged Shared-File RecordsZimbra · Zimbra Collaboration Suite | Medium4.3 |
| CVE-2026-93633 | Zimbra Collaboration Suite Briefcase CSS Sanitization Bypass via Non-ASCII Stylesheet CharactersZimbra · Zimbra Collaboration Suite | Medium5.4 |
| CVE-2026-93631 | Zimbra Collaboration Suite OAuth Extension Cross-Site Request Forgery Enables Account LinkingZimbra · Zimbra Collaboration Suite | High7.1 |
| CVE-2026-93630 | Zimbra Collaboration Suite Email HTML Sanitizer Bypass via Hostname CanonicalizationZimbra · Zimbra Collaboration Suite | Medium4.3 |
| CVE-2026-93629 | Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar REQUEST Organizer IdentityZimbra · Zimbra Collaboration Suite | Medium5.3 |
| CVE-2026-93628 | Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar REPLY Attendee ResponseZimbra · Zimbra Collaboration Suite | Medium5.3 |
| CVE-2026-93627 | Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar CANCEL/REQUEST OrganizerZimbra · Zimbra Collaboration Suite | Medium5.3 |
| CVE-2026-50053 | Zimbra Collaboration Suite RestFilter Request Attribute Override via Unauthenticated URL ParametersZimbra · Zimbra Collaboration Suite | High8.7 |
| CVE-2026-10632 | Zimbra Collaboration Suite Classic Web Client Reflected Cross-Site Scripting via Document Editor Packages ParameterZimbra · Zimbra Collaboration Suite | High8.7 |
| CVE-2026-109682 | Metasploit Framework HTTP Redirect Server-Side Request ForgeryRapid7 · Metasploit Framework | Medium4.7 |
| CVE-2026-109681 | Metasploit Framework FTP PASV Response SSRFRapid7 · Metasploit Framework | Medium4.7 |
| CVE-2026-107188 | Eptura Archibus Workflow Rule Enables Unauthenticated Arbitrary File Upload Leading to Remote Code ExecutionEptura · Archibus | Critical9.6 |
| CVE-2026-107187 | Eptura Archibus Workflow Rule Enables Unauthenticated Database Read of Sensitive TablesEptura · Archibus | High8.5 |
| CVE-2026-107186 | Eptura Archibus Direct Web Remoting (DWR) API Authentication Bypass via Privileged Session ReuseEptura · Archibus | High8.6 |
| CVE-2026-93637 | Zimbra Collaboration Suite GraphQL Batched Authentication Bypasses Pre-Auth Rate LimitingZimbra · Zimbra Collaboration Suite | Low3.7 |
| CVE-2026-93635 | Zimbra Collaboration Suite LDAP Filter Injection via Unescaped computeDn() Template SubstitutionZimbra · Zimbra Collaboration Suite | Medium5.3 |
| CVE-2026-108065 | Unauthenticated SQL Injection in Channel Software WebAlliance eCommerceChannel Software · WebAlliance eCommerce | Critical9.8 |
| CVE-2026-87689 | Metasploit Framework Web Service REST API Missing Authentication on Credential EndpointsRapid7 · Metasploit Framework | Critical9.8 |
| CVE-2026-87690 | Metasploit Framework ios_image_gather Path Traversal Leading to Arbitrary File Write and Code ExecutionRapid7 · Metasploit Framework | High8.8 |
| CVE-2026-50055 | Zimbra Collaboration Suite Sieve Notify Filter Action Bypasses Mail Forwarding Restriction via Variable ExpansionZimbra · Zimbra Collaboration Suite | Medium6.5 |
| CVE-2026-50054 | Zimbra Collaboration Suite GrantRightsRequest SOAP Handler Allows Self-Granting of Undocumented loginAs Mailbox Delegation RightZimbra · Zimbra Collaboration Suite | High7.1 |
| CVE-2026-10631 | Zimbra Collaboration Suite EWS Extension Authorization Bypass via Crafted Composite Folder/Item IdentifierZimbra · Zimbra Collaboration Suite | Medium6.5 |
| CVE-2026-78413 | Velociraptor privilege escalation via SysmonLogForward client monitoring artifactRapid7 · Velociraptor | Medium5.5 |
| CVE-2026-78411 | Velociraptor Server Metadata update with Insufficient Permission CheckRapid7 · Velociraptor | Medium6.5 |
| CVE-2026-78412 | WatchEvent API streams another organization's live eventsRapid7 · Velociraptor | Medium4.9 |
| CVE-2026-93647 | Zimbra Collaboration Suite Classic Web Client Stored Cross-Site Scripting via Crafted Calendar COUNTER Message From AddressZimbra · Zimbra Collaboration Suite (ZCS) | Critical9.3 |
| CVE-2026-93643 | Zimbra Collaboration Suite OnlyOffice Integration Path Traversal Leading to Remote Code Execution via Unauthenticated /downloadas RequestZimbra · Zimbra Collaboration Suite (ZCS) | Critical9.8 |
| CVE-2026-93642 | Zimbra Collaboration Suite Modern Web Client Stored Cross-Site Scripting via Forged Share InvitationZimbra · Zimbra Collaboration Suite (ZCS) | Critical9.3 |
| CVE-2026-93641 | Zimbra Collaboration Suite Classic Web Client Stored Cross-Site Scripting via Forged Share InvitationZimbra · Zimbra Collaboration Suite (ZCS) | Critical9.3 |
| CVE-2026-97228 | Rapid7 Bulk Export MCP — GraphQL Query Injection in Export Status LookupRapid7 · Platform | Low2.7 |
| CVE-2026-89325 | Rapid7 Insight Agent: Uncontrolled search path element in InsightVM assessment content leads to local privilege escalationRapid7 · Insight Agent | High7.8 |
| CVE-2026-77798 | Velociraptor Authenticated Denial of ServiceRapid7 · Velociraptor | Medium6.5 |
| CVE-2026-77797 | Velociraptor Prefetch parser out of boundsRapid7 · Velociraptor | Low3.6 |
| CVE-2026-19072 | Velociraptor Investigator reaches SuperUser via hunt EffectivePrincipalRapid7 · Velociraptor | Critical9.9 |
| CVE-2026-19584 | Velociraptor VQL injection during notebook restore from backupRapid7 · Velociraptor | High7.7 |
| CVE-2026-19583 | Velociraptor Required Permissions bypass by using client monitoring queriesRapid7 · Velociraptor | Critical9.9 |
| CVE-2026-16895 | Authentication Bypass in Metasploit JSON-RPC Service When DB Health Check FailsRapid7 · Metasploit-framework | Medium5.1 |
| CVE-2026-19200 | Velociraptor Analyst overwrites live built-in artifacts through verify()Rapid7 · Velociraptor | High8.9 |
| CVE-2026-15371 | Velociraptor Stored XSS in URL column typesRapid7 · Velociraptor | High8.1 |
| CVE-2026-18652 | Velociraptor STACK Type Download Path Bypasses Denied Prefix CheckRapid7 · Velociraptor | Medium6.5 |