Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read just now.
At a glance
Published CVEs; rejected ones are not counted.
- 399,660All CVEsplus 18,865 rejected
- 541Last 24 hours2,963 in the last 7 days
- 17,025Last 30 days1,508 of them critical
- 1,766Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 22 | 112 | 124 | 28 | 0 | 286 | 895 |
| 2025 | 9 | 27 | 26 | 4 | 0 | 66 | 609 |
| 2024 | 11 | 36 | 38 | 5 | 0 | 90 | 543 |
| 2023 | 11 | 32 | 35 | 2 | 0 | 80 | 453 |
| 2022 | 22 | 36 | 37 | 3 | 0 | 98 | 373 |
| 2021 | 13 | 43 | 30 | 1 | 0 | 87 | 275 |
| 2020 | 6 | 27 | 25 | 6 | 0 | 64 | 188 |
| 2019 | 4 | 15 | 13 | 0 | 0 | 32 | 124 |
| 2018 | 3 | 21 | 11 | 0 | 0 | 35 | 92 |
| 2017 | 7 | 26 | 15 | 1 | 0 | 49 | 57 |
| 2016 | 3 | 3 | 2 | 0 | 0 | 8 | 8 |
| Title | ||
|---|---|---|
| CVE-2026-59387 | Broken access control restriction in Cloud Controller APICloud Foundry · CAPI (Cloud Controller API) | High8.8 |
| CVE-2026-59385 | Space Developer can extract space-scoped broker credentialsCloud Foundry · CAPI (Cloud Foundry Controller) | Low2.7 |
| CVE-2026-59388 | Cloud Controller exposes secrets in audit logCloud Foundry Foundation · CAPI (Cloud Foundry Controller) | Medium6.5 |
| CVE-2026-59386 | Credential exposure to space supporterCloud Foundry · Cloud Foundry Controller (CAPI) | Medium6.5 |
| CVE-2026-59396 | DoS Vulnerability in UAA Related to JWKS URI HandlingCloud Foundry · UAA | Medium6.9 |
| CVE-2026-59347 | VMware Workstation and Fusion HGFS stack-based buffer-overflow vulnerabilityVMware · VMware Workstation | High8.1 |
| CVE-2026-59346 | VMware Workstation and Fusion VMXNET3 integer-overflow vulnerabilityVMware · VMware Workstation | Critical9.3 |
| CVE-2026-59357 | Self-UAA OIDC Configuration allows JWT injection to establish unauthorized sessionsCloud Foundry · UAA | Medium6.5 |
| CVE-2026-59358 | UAA OAuth Token Endpoint Vulnerability allows user access token reuse for client_credentials grant typeCloud Foundry · UAA | High7.6 |
| CVE-2026-59341 | Sealed Secrets: decryption oracle via Go template injection in unauthenticated controller endpointsBitnami · sealed-secrets | Medium4.2 |
| CVE-2026-47839 | Federated OIDC Users Can Bypass externalGroupsWhitelist to Gain uaa.adminCloud Foundry Foundation · UAA | Critical9.2 |
| CVE-2026-41012 | BOSH vSphere CPI Improper Cert ValidationCloud Foundry · bosh-vsphere-cpi-release | High7.7 |
| CVE-2026-59324 | fluxTransform shared RequestMessageHolder causes cross-message header leakage under async fluxFunctionSpring · Spring Integration | High8.2 |
| CVE-2026-59322 | EmbeddedHeadersJsonMessageMapper default gives wire peer full control of MessageHeadersSpring · Spring Integration | Medium6.3 |
| CVE-2026-59321 | Shared JSR-223 ScriptEngine evaluated concurrently without THREADING checkSpring · Spring Integration | Medium4.2 |
| CVE-2026-59320 | In Spring AMQP the link credit never replenished on listener exception pathSpring · Spring AMQP | Medium6.5 |
| CVE-2026-59319 | RediSearch Tag Injection in RedisChatMemoryRepository Allows Cross-Conversation Data ExposureSpring · Spring AI | Medium4.3 |
| CVE-2026-59317 | In Spring for Apache Kafka, missing header validation in DeadLetterPublishingRecovererFactory enables denial of service via a poison-pill loopSpring · Spring for Apache Kafka | Medium6.5 |
| CVE-2026-59316 | Spring Authorization Server Default Consent Page is vulnerable to Cross-Site Scripting (XSS)Spring · Spring Authorization Server | High8.2 |
| CVE-2026-59315 | Spring Cloud Config Monitor Denial of ServiceSpring · Spring Cloud Config | Medium5.3 |
| CVE-2026-59314 | Spring Framework response splitting in ContentDispositionSpring · Spring Framework | Low3.7 |
| CVE-2026-59311 | Fixed predictable /tmp/ziptransformer work directory enables symlink pre-creationSpring · Spring Integration | Medium6.8 |
| CVE-2026-59306 | Potential for deserialization of untrusted types in Spring Cloud StreamSpring · Spring Cloud Stream | Low3.1 |
| CVE-2026-59313 | Server Sent Event stream corruption in Spring MVC functional web frameworkSpring · Spring Framework | Critical9.8 |
| CVE-2026-59307 | Deserialization allow-list silently bypassed: setBeanClassLoader replaces deserializer but mapper keeps stale referenceSpring · Spring Integration | High8.0 |
| CVE-2026-59305 | Partition interceptor may be improperly added while sending messageSpring · Spring Cloud Stream | Low3.1 |
| CVE-2026-59304 | Improper caching of the original content type in Spring Cloud Stream AvroSpring · Spring Cloud Stream | Low3.1 |
| CVE-2026-59303 | Dynamic destination cache size is not properly bound in Spring Cloud StreamSpring · Spring Cloud Stream | Low3.1 |
| CVE-2026-59302 | Potential for logging sensitive data in Spring Cloud StreamSpring · Spring Cloud Stream | Low3.1 |
| CVE-2026-59301 | Potential for logging sensitive data in Spring Cloud Function AzureSpring · Spring Cloud Function | Low3.1 |
| CVE-2026-59300 | Potential for logging sensitive data in Spring Cloud Function AWSSpring · Spring Cloud Function | Low3.1 |
| CVE-2026-59299 | Composition lookup can potentially poison base function in Spring Cloud FunctionSpring · Spring Cloud Function | Low3.1 |
| CVE-2026-59298 | Potential for improper filtering of HTTP headers in Spring Cloud FunctionSpring · Spring Cloud Function | Low3.1 |
| CVE-2026-59297 | Spring Cloud Function can incorrectly determine if URI is secureSpring · Spring Cloud Function | Low3.1 |
| CVE-2026-59294 | Arbitrary File Write via Path Traversal in ResourceCacheServiceSpring · Spring AI | Medium5.9 |
| CVE-2026-59293 | SMB minimum protocol dialect defaults to SMB1Spring · Spring Integration | Medium6.6 |
| CVE-2026-59292 | World-readable metadata file in PropertiesPersistingMetadataStore (insecure temp-file permissions)Spring · Spring Integration | Low3.2 |
| CVE-2026-59291 | Potential arbitrary file read and SSRF vulnerability in Spring Cloud FunctionSpring · Spring Cloud Function | Low2.0 |
| CVE-2026-59289 | Spring for GraphQL Denial of Service via pagination supportSpring · Spring for GraphQL | High7.5 |
| CVE-2026-59288 | Spring for GraphQL Information Exposure in GraphiQL supportSpring · Spring for GraphQL | High7.5 |
| CVE-2026-59287 | Spring for GraphQL WebSocket Client Denial of ServiceSpring · Spring for GraphQL | Medium5.9 |
| CVE-2026-59286 | Spring for GraphQL loads Untrusted Resources in GraphiQL supportSpring · Spring for GraphQL | High8.1 |
| CVE-2026-59285 | Spring for GraphQL Unsafe Deserialization in pagination supportSpring · Spring for GraphQL | High8.1 |
| CVE-2026-59284 | Spring Cloud Commons no allow list for writable env actuator endpointSpring · Spring Cloud Commons | Medium6.6 |
| CVE-2026-59283 | Spring Framework Safety Guard Bypass via SpEL Expression CompilationSpring · Spring Framework | Critical9.1 |
| CVE-2026-59282 | Spring Framework Denial of Service via Unbounded List Growth in Data BindingSpring · Spring Framework | High7.5 |
| CVE-2026-59281 | Spring Framework Cross-site Scripting via EscapedErrorsSpring · Spring Framework | Medium6.1 |
| CVE-2026-59277 | Spring Security InetAddressMatchers Incomplete Internal Network ClassificationSpring · Spring Security | Low3.7 |
| CVE-2026-59276 | Timing Attack via Non-Constant-Time Comparison of Sensitive ValuesSpring · Spring Security | Medium5.9 |
| CVE-2026-59280 | Spring Framework Path Traversal via Backslash in SpringTemplateLoaderSpring · Spring Framework | Medium4.3 |