Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 3 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,956All CVEsplus 19,141 rejected
- 254Last 24 hours3,184 in the last 7 days
- 16,914Last 30 days1,564 of them critical
- 1,769Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 1 | 1 | 2 | 1 | 0 | 5 | 19 |
| 2025 | 0 | 2 | 4 | 0 | 0 | 6 | 14 |
| 2024 | 0 | 1 | 4 | 0 | 0 | 5 | 8 |
| 2023 | 0 | 0 | 0 | 0 | 0 | 0 | 3 |
| 2022 | 0 | 1 | 0 | 0 | 0 | 1 | 3 |
| 2021 | 0 | 0 | 0 | 0 | 0 | 0 | 2 |
| 2020 | 0 | 0 | 1 | 0 | 0 | 1 | 2 |
| 2019 | 0 | 0 | 0 | 1 | 0 | 1 | 1 |
| Title | ||
|---|---|---|
| CVE-2026-85724 | Moquette pattern ACL wildcard injection allows cross-tenant authorization bypassPublic exploitmoquette-io · moquette | Critical9.6 |
| CVE-2026-87016 | Open WebUI: Sign-in as another user via wildcard characters in the OAuth subject claim on SQLitePublic exploitopen-webui · open-webui | High8.1 |
| CVE-2026-68939 | Pyenv: Glob/wildcard metacharacters bypass is_version_safe(), causing silent version/interpreter substitution via unquoted expansion (CVE-2022-35861 residual)Public exploitpyenv · pyenv | Low2.0 |
| CVE-2026-73412 | Shescape: Path disclosure on Unix with Zshericcornelissen · shescape | Medium6.3 |
| CVE-2026-49482 | ClipBucket: SQL Wildcard Injection in Subtitle Edit Endpoint Allows Mass Subtitle OverwritePublic exploitMacWarrior · clipbucket-v5 | Medium4.3 |
| CVE-2025-11757 | Improper Neutralization of Wildcards or Matching Symbols in CloudEdge Online Cameras and AppCloudEdge · CloudEdge App | High8.7 |
| CVE-2025-4232 | GlobalProtect: Authenticated Code Injection Through Wildcard on macOSPalo Alto Networks · GlobalProtect App | High8.5 |
| CVE-2025-27515 | Laravel has a File Validation Bypasslaravel · framework | Medium6.9 |
| CVE-2025-0681 | New Rock Technologies Cloud Connected Devices Improper Neutralization of Wildcards or Matching SymbolsNew Rock Technologies · OM500 IP-PBX | Medium6.9 |
| CVE-2025-24376 | The kubewarden-controller AdmissionPolicy and AdmissionPolicyGroup policies can be used to alter PolicyReport resourceskubewarden · kubewarden-controller | Medium6.5 |
| CVE-2025-0106 | Expedition: Wildcard Expansion VulnerabilityPalo Alto Networks · Cloud NGFW | Medium6.9 |
| CVE-2024-47791 | Ruijie Reyee OS Improper Neutralization of Wildcards or Matching SymbolsRuijie · Reyee OS | High8.7 |
| CVE-2024-8688 | PAN-OS: Arbitrary File Read Vulnerability in the Command Line Interface (CLI)Palo Alto Networks · PAN-OS | Medium6.7 |
| CVE-2024-6509 | Marinus Pfund, member of the AXIS OS Bug Bounty Program, has found the VAPIX API alwaysmulti.cgi was vulnerable for file globbing which could lead to resource…Axis Communications AB · AXIS OS | Medium6.5 |
| CVE-2024-0055 | Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX APIs mediaclip.cgi and playclip.cgi was vulnerable for file globbing which…Axis Communications AB · AXIS OS | Medium6.5 |
| CVE-2024-0054 | Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX APIs local_list.cgi, create_overlay.cgi and irissetup.cgi was vulnerable for…Axis Communications AB · AXIS OS | Medium6.5 |
| CVE-2022-21646 | Lookup operations do not take into account wildcards in SpiceDBauthzed · spicedb | High8.1 |
| CVE-2020-1772 | Information DisclosureOTRS AG · ((OTRS)) Community Edition | Medium6.5 |
| CVE-2019-3802 | Additional information exposure with Spring Data JPA example matcherSpring · Spring Data JPA | Low3.5 |