Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read just now.
At a glance
Published CVEs; rejected ones are not counted.
- 400,789All CVEsplus 19,114 rejected
- 481Last 24 hours2,892 in the last 7 days
- 16,905Last 30 days1,556 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 6 | 13 | 15 | 2 | 0 | 36 | 149 |
| 2025 | 5 | 8 | 12 | 1 | 0 | 26 | 113 |
| 2024 | 5 | 3 | 7 | 0 | 0 | 15 | 87 |
| 2023 | 1 | 5 | 5 | 1 | 0 | 12 | 72 |
| 2022 | 4 | 5 | 4 | 3 | 0 | 16 | 60 |
| 2021 | 2 | 3 | 3 | 1 | 0 | 9 | 44 |
| 2020 | 3 | 5 | 1 | 0 | 0 | 9 | 35 |
| 2019 | 1 | 5 | 2 | 0 | 0 | 8 | 26 |
| 2018 | 1 | 2 | 3 | 0 | 0 | 6 | 18 |
| 2017 | 0 | 5 | 2 | 0 | 0 | 7 | 12 |
| 2016 | 0 | 0 | 1 | 0 | 0 | 1 | 5 |
| 2015 | 0 | 0 | 0 | 0 | 0 | 0 | 4 |
| 2014 | 0 | 0 | 0 | 0 | 0 | 0 | 4 |
| 2013 | 0 | 0 | 0 | 0 | 0 | 0 | 4 |
| 2012 | 0 | 1 | 0 | 0 | 0 | 1 | 4 |
| 2011 | 0 | 0 | 0 | 0 | 0 | 0 | 3 |
| 2010 | 0 | 0 | 0 | 0 | 0 | 0 | 3 |
| 2009 | 0 | 0 | 0 | 0 | 0 | 0 | 3 |
| 2008 | 1 | 0 | 1 | 0 | 0 | 2 | 3 |
| 2007 | 0 | 0 | 0 | 0 | 0 | 0 | 1 |
| 2006 | 0 | 0 | 0 | 0 | 0 | 0 | 1 |
| 2005 | 0 | 0 | 0 | 0 | 0 | 0 | 1 |
| 2004 | 0 | 0 | 0 | 0 | 0 | 0 | 1 |
| 2003 | 0 | 0 | 0 | 0 | 0 | 0 | 1 |
| 2002 | 0 | 1 | 0 | 0 | 0 | 1 | 1 |
| Title | ||
|---|---|---|
| CVE-2026-92209 | NoMachine Redis Improper Authentication Local Privilege Escalation VulnerabilityNoMachine · NoMachine | High7.8 |
| CVE-2026-112041 | diem-project diem dmString.php random weak prngdiem-project · diem | Medium6.3 |
| CVE-2026-13639 | An insufficient entropy vulnerability in login logic in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075…Synology · DiskStation Manager (DSM) | Critical9.8 |
| CVE-2026-90562 | LangBot before 4.10.11 Authentication Bypass via Weak Recovery Keylangbot-app · LangBot | Critical9.2 |
| CVE-2026-80171 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insufficient Entropy in PRNG…Dell · Secure Connect Gateway 5.0 - Application | Medium4.7 |
| CVE-2026-62646 | A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). A session identifier is generated using an algorithm with insufficient randomness,…Siemens · Reyrolle 7SR5 | Critical9.1 |
| CVE-2026-27490 | Combodo iTop: Weak secret generation for inline imageCombodo · iTop | High7.5 |
| CVE-2026-4936 | Power System Insufficient EntropyIBM · PowerVM Hypervisor | Medium5.1 |
| CVE-2026-4937 | Power System Insufficient EntropyIBM · PowerVM Hypervisor | Medium5.3 |
| CVE-2026-19906 | pkp pkp-lib API Key Generation APIProfileForm.php setData entropypkp · pkp-lib | Medium6.3 |
| CVE-2026-19748 | Tenda CH7 Kylin Web Service CWebSessionManager_ParseSession entropyTenda · CH7 | Medium6.3 |
| CVE-2026-71851 | crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chainbrix · crypto-js | Critical9.0 |
| CVE-2025-15629 | Weak Session Key Generation in TP-Link Omada Adoption ProtocolTP-Link Systems Inc. · Omada Gateways | Medium6.9 |
| CVE-2026-38447 | osTicket 1.18.3 generates API keys using a predictable construction based on MD5 hashing. The use of MD5, combined with predictable inputs such as the current… | Critical9.8 |
| CVE-2026-4932 | This Power System update is being released to address Insufficient EntropyIBM · PowerVM Hypervisor | Medium4.2 |
| CVE-2026-11403 | Nexus Repository Manager - Insufficient Entropy in Format-Specific API Key GenerationSonatype · Nexus Repository Manager | High8.7 |
| CVE-2026-13199 | Insufficient Entropy in Raspberry Pi 5 and Compute Module 5Raspberry Pi · Raspberry Pi 5 and Compute Module 5 | Medium5.1 |
| CVE-2026-4930 | DPA Countermeasures weakening on Series 3 devicessilabs.com · Simplicity SDK | High7.1 |
| CVE-2026-46473 | Authen::TOTP versions before 0.1.1 for Perl generate secrets using randTCHATZI · Authen::TOTP | High7.5 |
| CVE-2026-8700 | Crypt::DSA versions before 1.20 for Perl generate seeds using randTIMLEGGE · Crypt::DSA | High7.3 |
| CVE-2026-46474 | Trog::TOTP versions before 1.006 for Perl generate secrets using randTEODESIAN · Trog::TOTP | High7.5 |
| CVE-2026-42155 | Magento LTS: Weak API Session ID — Predictable MD5 of Time-Derived InputsOpenMage · magento-lts | Critical9.3 |
| CVE-2025-14972 | Insufficient DPA countermeasure reseedingsilabs.com · Simplicity SDK | Medium4.1 |
| CVE-2026-4827 | Insufficient Entropy vulnerability on Multiple ProductsSchneider Electric · Easergy MiCOM C264 | High8.7 |
| CVE-2026-7210 | The expat and elementtree parsers use insufficient entropy for XML hash-flooding protectionPython Software Foundation · CPython | Medium6.3 |
| CVE-2026-2336 | Weak webstax_auth Cookie Authentication Allows Privilege EscalationMicrochip · IStaX | High8.7 |
| CVE-2026-41080 | libexpat before 2.8.0 uses insufficient entropy, and thus hash flooding can occur via a crafted XML document.libexpat project · libexpat | Low2.9 |
| CVE-2026-34236 | Auth0 PHP SDK Insufficient Entropy in Cookie Encryptionauth0 · auth0-PHP | High8.2 |
| CVE-2026-2878 | Insufficient Entropy Vulnerability in Telerik UI for ASP.NET AJAXProgress Software · Telerik UI for ASP.NET AJAX | Medium5.3 |
| CVE-2025-0577 | Glibc: vdso getrandom acceleration may return predictable randomnessglibc | Medium4.8 |
| CVE-2026-2541 | Micca KE700 Brute-force vulnerability due to low entropyMicca Auto Electronics Co., Ltd. · Car Alarm System KE700 | Medium6.4 |
| CVE-2025-7432 | DPA countermeasures not reseeded under certain conditionssilabs.com · Simplicity SDK | Low1.0 |
| CVE-2026-1814 | Rapid7 Nexpose Insecure Java Keystore Password GenerationRapid7 · InsightVM/Nexpose | Medium6.8 |
| CVE-2025-13399 | Insecure Encryption in Communication with the Web Interface on TP-Link VX800vTP-Link Systems Inc. · VX800v v1.0 | High7.7 |
| CVE-2026-22698 | RustCrypto SM2-PKE has 32-bit Biased Nonce VulnerabilityRustCrypto · elliptic-curves | High8.7 |
| CVE-2020-36925 | Arteco Web Client DVR/NVR Session ID Brute Force Authentication BypassArteco-Global · Arteco Web Client DVR/NVR | High8.7 |
| CVE-2025-15387 | QNO Technology｜VPN Firewall - Insufficient EntropyQNO Technology · VPN Firewall | High8.7 |
| CVE-2025-67504 | WBCE CMS has Weak Random Number Generator in Password Generation FunctionWBCE · WBCE_CMS | Critical9.1 |
| CVE-2025-66565 | Fiber Utils UUIDv4 and UUID Silent Fallback to Predictable Valuesgofiber · utils | Critical9.3 |
| CVE-2025-14261 | Lack of entropy allows registered low-privileged users of Litmus to crack valid JWT tokens and gain admin privilegesLitmuschaos · litmus | High7.1 |
| CVE-2025-32898 | The KDE Connect verification-code protocol before 2025-04-18 uses only 8 characters and therefore allows brute-force attacks. This affects KDE Connect before…KDE · KDE Connect verification-code protocol | Medium4.7 |
| CVE-2025-62774 | On Mercku M6a devices through 2.1.0, the authentication system uses predictable session tokens based on timestamps.Mercku · M6a | Low3.1 |
| CVE-2024-58040 | Crypt::RandomEncryption for Perl uses insecure rand() function during encryptionQWER · Crypt::RandomEncryption | Critical9.1 |
| CVE-2025-59015 | Insufficient Entropy in Password GenerationTYPO3 · TYPO3 CMS | Medium6.3 |
| CVE-2025-54885 | Thinbus generates insufficient entropy: 252 bits vs minimum 256 bitssimbo1905 · thinbus-srp-npm | Medium6.9 |
| CVE-2025-50122 | A CWE-331: Insufficient Entropy vulnerability exists that could cause root password discovery when the password generation algorithm is reverse engineered with…Schneider Electric · EcoStruxure™ IT Data Center Expert | High8.9 |
| CVE-2025-6931 | D-Link DCS-6517/DCS-7517 Root Password Generation httpd generate_pass_from_mac entropyD-Link · DCS-6517 | Medium6.3 |
| CVE-2025-52464 | Meshtastic Repeated Public and Private Keypairsmeshtastic · firmware | Critical9.5 |
| CVE-2025-47781 | Rallly Insufficient Password Login Token Entropy Leads to Account Takeoverlukevella · rallly | Critical9.8 |
| CVE-2024-58134 | Mojolicious versions from 0.999922 for Perl uses a hard coded string, or the application's class name, as an HMAC session cookie secret by defaultSRI · Mojolicious | High8.1 |