Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 8 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,806All CVEsplus 19,141 rejected
- 504Last 24 hours3,085 in the last 7 days
- 17,013Last 30 days1,593 of them critical
- 1,769Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 0 | 3 | 3 | 0 | 0 | 6 | 31 |
| 2025 | 0 | 2 | 8 | 1 | 0 | 11 | 25 |
| 2024 | 0 | 3 | 5 | 0 | 0 | 8 | 14 |
| 2023 | 0 | 1 | 1 | 0 | 0 | 2 | 6 |
| 2022 | 0 | 2 | 1 | 0 | 0 | 3 | 4 |
| 2021 | 0 | 0 | 0 | 0 | 0 | 0 | 1 |
| 2020 | 0 | 0 | 0 | 0 | 0 | 0 | 1 |
| 2019 | 0 | 0 | 0 | 0 | 0 | 0 | 1 |
| 2018 | 0 | 1 | 0 | 0 | 0 | 1 | 1 |
| Title | ||
|---|---|---|
| CVE-2026-108304 | Tanium addressed a local privilege escalation vulnerability in End-User Notifications.Tanium · Endpoint Configuration Toolset Solution | High7.8 |
| CVE-2026-86769 | Snipe-IT before 8.7.0 Audit Log Misattribution via Consumables Checkoutgrokability · snipe-it | Medium5.3 |
| CVE-2026-50130 | Pi-hole: Local privilege escalation from `pihole` user to root via `/etc/pihole/logrotate`Public exploitpi-hole · pi-hole | High8.8 |
| CVE-2026-40214 | In OpenStack Cyborg before 16.0.1, the Accelerator Request (ARQ) API does not enforce project ownership at any layer. The project_id column in the database is…OpenStack · Cyborg | Medium6.3 |
| CVE-2026-3867 | An improper ownership management vulnerability has been identified in Moxa’s Secure Router. Because of improper ownership management, a low-privileged…Moxa · EDR-8010 Series | Medium6.0 |
| CVE-2026-23514 | Kiteworks Core before 9.2.2 is vulnerable to Improper Ownership Managementkiteworks · core | High8.8 |
| CVE-2025-67642 | Jenkins HashiCorp Vault Plugin 371.v884a_4dd60fb_6 and earlier does not set the appropriate context for Vault credentials lookup, allowing attackers with…Jenkins Project · Jenkins HashiCorp Vault Plugin | Medium4.3 |
| CVE-2025-57732 | In JetBrains TeamCity before 2025.07.1 privilege escalation was possible due to incorrect directory ownershipJetBrains · TeamCity | High7.5 |
| CVE-2025-1112 | IBM OpenPages with Watson information disclosureIBM · OpenPages with Watson | Medium4.3 |
| CVE-2025-46416 | The Nix, Lix, and Guix package managers allow a bypass of build isolation in which a user can elevate their privileges to the build user account (e.g., nixbld…NixOS · Nix | Low2.9 |
| CVE-2025-3629 | IBM InfoSphere Information Server file manipulationIBM · InfoSphere Information Server | Medium4.3 |
| CVE-2025-32946 | PeerTube Arbitrary Playlist Creation via ActivityPub ProtocolPublic exploitChocobozzz/PeerTube | Medium5.3 |
| CVE-2025-32945 | PeerTube Arbitrary Playlist Creation via REST APIPublic exploitChocobozzz/PeerTube | Medium4.3 |
| CVE-2025-27254 | CWE-282 "Improper Ownership Management" in GE Vernova EnerVista UR Setup allows Authentication Bypass. The software's startup authentication can be disabled by…GE Vernova · EnerVista UR Setup | High8.0 |
| CVE-2024-13249 | Node Access Rebuild Progressive - Less critical - Access bypass - SA-CONTRIB-2024-013Drupal · Node Access Rebuild Progressive | Medium5.4 |
| CVE-2024-13246 | Node Access Rebuild Progressive - Less critical - Access bypass - SA-CONTRIB-2024-010Drupal · Node Access Rebuild Progressive | Medium5.3 |
| CVE-2024-43176 | IBM OpenPages information disclosureIBM · OpenPages | Medium5.4 |
| CVE-2024-47816 | Users can impersonate import requesters if their actor IDs coincide in ImportDumpmiraheze · ImportDump | Medium6.4 |
| CVE-2024-39755 | A privilege escalation vulnerability exists in the node update functionality of Veertu Anka Build 1.42.0. A specially crafted PKG file can lead to execute…Public exploitVeertu · Anka Build | High7.8 |
| CVE-2024-8949 | SourceCodester Online Eyewear Shop Cart Content Master.php improper ownership managementPublic exploitSourceCodester · Online Eyewear Shop | Medium5.3 |
| CVE-2024-45104 | A valid, authenticated LXCA user without sufficient privileges may be able to use the device identifier to modify an LXCA managed device through a specially…Lenovo · XClarity Administrator | Medium6.3 |
| CVE-2024-45103 | A valid, authenticated LXCA user may be able to unmanage an LXCA managed device in through the LXCA web interface without sufficient privileges.Lenovo · XClarity Administrator | Medium4.3 |
| CVE-2024-37999 | A vulnerability has been identified in Medicalis Workflow Orchestrator (All versions). The affected application executes as a trusted account with high…Siemens · Medicalis Workflow Orchestrator | High8.5 |
| CVE-2024-3383 | PAN-OS: Improper Group Membership Change Vulnerability in Cloud Identity Engine (CIE)Palo Alto Networks · PAN-OS | High7.4 |
| CVE-2023-7226 | meetyoucrop big-whale Admin Module all.api improper ownership managementPublic exploitmeetyoucrop · big-whale | Medium6.3 |
| CVE-2023-0989 | Improper Ownership Management in GitLabPublic exploitGitLab · GitLab | Medium4.3 |
| CVE-2023-0386 | A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux kernel’s OverlayFS…ExploitedPublic exploitKernel | High7.8 |
| CVE-2022-29187 | Bypass of safe.directory protections in Gitgit · git | High7.8 |
| CVE-2022-0026 | Cortex XDR Agent: Unintended Program Execution Leads to Local Privilege Escalation (PE) VulnerabilityPalo Alto Networks · Cortex XDR Agent | Medium6.7 |
| CVE-2020-10632 | ICSA-20-140-02 Emerson OpenEnterpriseEmerson · OpenEnterprise SCADA Software | High8.8 |
| CVE-2017-12189 | It was discovered that the jboss init script as used in Red Hat JBoss Enterprise Application Platform 7.0.7.GA performed unsafe file handling which could…Red Hat, Inc. · Red Hat JBoss Enterprise Application Platform | High7.8 |