Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 5 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 400,097All CVEsplus 18,873 rejected
- 781Last 24 hours3,297 in the last 7 days
- 17,390Last 30 days1,564 of them critical
- 1,766Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 58 | 467 | 673 | 94 | 0 | 1,292 | 11,987 |
| 2025 | 13 | 102 | 161 | 24 | 0 | 300 | 10,695 |
| 2024 | 6 | 116 | 166 | 18 | 0 | 306 | 10,395 |
| 2023 | 13 | 156 | 257 | 20 | 0 | 446 | 10,089 |
| 2022 | 27 | 268 | 318 | 14 | 0 | 627 | 9,643 |
| 2021 | 41 | 170 | 215 | 26 | 0 | 452 | 9,016 |
| 2020 | 51 | 206 | 274 | 36 | 0 | 567 | 8,564 |
| 2019 | 58 | 230 | 315 | 27 | 0 | 630 | 7,997 |
| 2018 | 35 | 170 | 319 | 38 | 0 | 562 | 7,367 |
| 2017 | 82 | 188 | 201 | 6 | 0 | 477 | 6,805 |
| 2016 | 62 | 192 | 271 | 12 | 0 | 537 | 6,328 |
| 2015 | 1 | 93 | 266 | 40 | 0 | 400 | 5,791 |
| 2014 | 0 | 152 | 664 | 134 | 0 | 950 | 5,391 |
| 2013 | 3 | 145 | 660 | 162 | 0 | 970 | 4,441 |
| 2012 | 3 | 187 | 768 | 198 | 0 | 1,156 | 3,471 |
| 2011 | 0 | 109 | 336 | 70 | 0 | 515 | 2,315 |
| 2010 | 3 | 103 | 294 | 64 | 0 | 464 | 1,800 |
| 2009 | 2 | 116 | 173 | 20 | 0 | 311 | 1,336 |
| 2008 | 3 | 108 | 143 | 18 | 0 | 272 | 1,025 |
| 2007 | 0 | 59 | 150 | 35 | 0 | 244 | 753 |
| 2006 | 1 | 102 | 134 | 33 | 0 | 270 | 509 |
| 2005 | 2 | 70 | 119 | 48 | 0 | 239 | 239 |
| Title | ||
|---|---|---|
| CVE-2026-121621 | Github.com/argoproj-labs/argocd-image-updater: argocd-image-updater: arbitrary command execution via crafted ssh repository proxy configurationRed Hat · Red Hat OpenShift GitOps | High8.8 |
| CVE-2026-82976 | Image-customization-controller: unauthenticated plaintext image server with directory listing exposes ignition images containing cluster pull secretRed Hat · Red Hat OpenShift Container Platform 4 | High7.1 |
| CVE-2026-121259 | Gst-plugins-bad: gst-plugins-bad: integer overflows and division by zero in jpeg 2000 decimatorRed Hat · Red Hat Enterprise Linux 10 | Medium6.5 |
| CVE-2026-119843 | Gst-plugins-good: assertion failures in FLV demuxer when parsing malformed enhanced audio/video tagsRed Hat · Red Hat Enterprise Linux 10 | Medium6.5 |
| CVE-2026-120971 | Org.jboss.resteasy/resteasy-core: resteasy: information disclosure through default exception mapper responsesRed Hat · Red Hat build of Apache Camel 4 for Quarkus 3 | Medium5.3 |
| CVE-2026-120831 | Libslirp: libslirp: queue pointer corruption in if_output() leading to denial of serviceRed Hat · Red Hat Enterprise Linux 10 | Medium6.5 |
| CVE-2026-120830 | Libslirp: libslirp: out-of-bounds heap read in icmp_forward_error() leading to information disclosureRed Hat · Red Hat Enterprise Linux 10 | High7.4 |
| CVE-2026-120740 | Hivex: hivex: denial of service via out-of-bounds read in big-data block processingRed Hat · Red Hat Enterprise Linux 10 | Low2.0 |
| CVE-2026-116958 | Konflux-ci: unquoted variable expansion in shell command executionkonflux-ci | Medium6.7 |
| CVE-2026-120194 | Json-glib: json-glib: infinite loop in json_path_query() with negative jsonpath slice stepRed Hat · Red Hat Enterprise Linux 10 | High7.5 |
| CVE-2026-117681 | Konflux-ci: ui proxy skips backend tls verification on non-openshift clusters, leaking a token that can impersonate anyonekonflux-ci | High8.0 |
| CVE-2026-116964 | Konflux-ci: remote code execution via eval() in manifest scriptskonflux-ci | High8.4 |
| CVE-2026-116086 | Konflux-ci: jq filter injection in github workflow issue managementkonflux-ci | High8.8 |
| CVE-2026-114217 | Konflux-ci: github token plaintext exposure in ci/cd scriptskonflux-ci | High8.6 |
| CVE-2026-119842 | Gst-plugins-base: gst-plugins-base: null-pointer dereference in mdvdsub subtitle parser via missing closing-brace checkRed Hat · Red Hat Enterprise Linux 10 | Medium6.5 |
| CVE-2026-119727 | Gst-plugins-bad: gst-plugins-bad: h.265 sps scc palette predictor array overflow via integer underflow in bounds computationRed Hat · Red Hat Enterprise Linux 10 | Medium6.5 |
| CVE-2026-119729 | Gst-plugins-base: gst-plugins-bad: gst-plugins-base/gst-plugins-bad: integer overflow in av1 leb128 parser allows denial of serviceRed Hat · Red Hat Enterprise Linux 10 | Medium6.5 |
| CVE-2026-119728 | Gst-plugins-bad: gst-plugins-bad: null pointer dereference in h.264 mvc sps cleanup during parse failureRed Hat · Red Hat Enterprise Linux 10 | Medium6.5 |
| CVE-2026-119777 | Gstreamer1-plugins-bad-free: gstreamer1-plugins-bad-free: stack buffer overflow in h.266/vvc parserRed Hat · Red Hat Enterprise Linux 10 | High8.8 |
| CVE-2026-119542 | Org.infinispan/infinispan-query: infinispan: deeply nested ickle queries can trigger a stackoverflowerrorRed Hat · Red Hat build of Apache Camel 4 for Quarkus 3 | Medium4.3 |
| CVE-2026-119528 | Gimp: gimp: stack buffer overflow in psd image resource header loaderRed Hat · Red Hat Enterprise Linux 10 | High7.8 |
| CVE-2026-115456 | Gcc: out-of-bounds read in std::from_charsRed Hat · Red Hat Enterprise Linux 10 | Low3.7 |
| CVE-2026-115455 | Gcc: stack overflow in std::bitset on libstdc++Red Hat · Red Hat Enterprise Linux 10 | Medium6.5 |
| CVE-2026-114691 | Gcc: integer wrap in `stdRed Hat · Red Hat Enterprise Linux 10 | Medium5.9 |
| CVE-2026-114690 | Gcc: confirmed out-of-bounds read/write in libstdc++ parallel `stdRed Hat · Red Hat Enterprise Linux 10 | Medium6.2 |
| CVE-2026-118593 | Kernel: local_bh imbalance in seg6_input_core() drop path (incomplete fix for cve-2026-46099)Red Hat · Red Hat Enterprise Linux 10 | Medium5.9 |
| CVE-2026-118952 | Kroxylicious-authorizer-acl: kroxylicious: acl prefix matching can bypass authorization rulesRed Hat · streams for Apache Kafka 2 | Medium6.5 |
| CVE-2026-103963 | Glib-networking: unbounded tls 1.3 session ticket queue growth in glib-networking allows remote denial of serviceRed Hat · Red Hat Enterprise Linux 10 | High7.5 |
| CVE-2026-118475 | Eog: eye of gnome: buffer overrun when parsing malicious png files with non-standard iccp chunkRed Hat · Red Hat Enterprise Linux 6 | Low3.6 |
| CVE-2026-112922 | Ghostscript: out-of-bounds read in ghostscript shade_next_color via integer overflow of indexed color index in mesh shadingRed Hat · Red Hat Enterprise Linux 10 | Low3.3 |
| CVE-2026-91920 | Undertow: undertow: chunkreader message length permits chunk-size overflowRed Hat · Red Hat build of Apache Camel for Spring Boot 4 | Medium6.5 |
| CVE-2026-110133 | Ghostscript: heap buffer overflow in ghostscript truetype outliner due to npointstotal integer underflow during retry rollbackRed Hat · Red Hat Enterprise Linux 10 | Medium5.8 |
| CVE-2026-118959 | Keycloak-services: keycloak-services: required actions bypassed via kc_action parameterRed Hat · Red Hat Build of Keycloak | Medium5.4 |
| CVE-2026-118947 | Keycloak-services: keycloak-services: authorization bypass via uma resource registration idorRed Hat · Red Hat Build of Keycloak | Medium4.3 |
| CVE-2026-92092 | Openshift-ansible: openshift-ansible: installer container downloads and executes remote inventory script without integrity verificationRed Hat · Red Hat OpenShift Container Platform 4 | High7.4 |
| CVE-2026-118425 | Keycloak-services: keycloak-services: redirect uri domain allowlist bypass via dns resolution to loopbackRed Hat · Red Hat Build of Keycloak | Medium6.8 |
| CVE-2026-93009 | Dnsmasq: dnsmasq: heap out-of-bounds read in dhcpv6 option 39 fqdn decoderRed Hat · Red Hat Ceph Storage 9 | Medium4.3 |
| CVE-2026-93010 | Dnsmasq: dnsmasq: --leasequery without address argument applies no source address checkRed Hat · Red Hat Ceph Storage 9 | Medium4.3 |
| CVE-2026-93006 | Dnsmasq: dnsmasq: tftp prefetch cache keyed on stale heap pointer serves wrong file contentRed Hat · Red Hat Ceph Storage 9 | Medium6.8 |
| CVE-2026-93007 | Dnsmasq: dnsmasq: tcp/53 child-slot exhaustion starves dnssec validationRed Hat · Red Hat Ceph Storage 9 | Medium5.3 |
| CVE-2026-93011 | Dnsmasq: dnsmasq: heap out-of-bounds write in dnssec validator via to_wire/from_wire transformsRed Hat · Red Hat Ceph Storage 9 | Medium5.3 |
| CVE-2026-93008 | Dnsmasq: dnsmasq: out-of-bailiwick cache injection through cname chase in split-dns configurationsRed Hat · Red Hat Ceph Storage 9 | Medium6.8 |
| CVE-2026-85498 | Polkit: regression in cve-2026-4897 fix (polkit read_cookie()) - stack buffer underflowRed Hat · Red Hat Hardened Images | Low3.5 |
| CVE-2026-118030 | Keycloak-services: keycloak-services: hotp race condition allows single otp code reuse across concurrent loginsRed Hat · Red Hat Build of Keycloak | Medium4.2 |
| CVE-2026-117859 | Keycloak-services: keycloak-services: par single-use bypass via flow restartRed Hat · Red Hat Build of Keycloak | Medium5.4 |
| CVE-2026-117688 | Keycloak-services: keycloak-services: vault secret disclosure via client registration installation configurationRed Hat · Red Hat Build of Keycloak | Medium5.3 |
| CVE-2026-117548 | 389-ds-base: 389-ds-base: null pointer dereference via modifydn using an attribute's schema alias name causes denial of serviceRed Hat · Red Hat Directory Server 11 | Medium6.5 |
| CVE-2026-117627 | Keycloak-services: keycloak-services: jwt authorization grant bypasses identity provider login restrictionsRed Hat · Red Hat Build of Keycloak | Medium5.4 |
| CVE-2026-114488 | Wildfly: wildfly-iiop: wildfly-ejb3: wildfly: authentication bypass on iiop ejb invocations as csiv2 ittprincipalname accepted without transport bindingRed Hat · Red Hat Fuse 7 | High7.4 |
| CVE-2026-19610 | Wildfly-platform-mbean: wildfly-platform-mbean: rbac sensitive attribute read bypass for platform runtimemxbeanRed Hat · Red Hat JBoss Enterprise Application Platform 7 | Medium6.5 |