Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 5 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,638All CVEsplus 19,141 rejected
- 668Last 24 hours2,951 in the last 7 days
- 17,123Last 30 days1,606 of them critical
- 1,769Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 18 | 218 | 182 | 42 | 0 | 460 | 955 |
| 2025 | 5 | 54 | 42 | 9 | 0 | 110 | 495 |
| 2024 | 7 | 57 | 26 | 3 | 0 | 93 | 385 |
| 2023 | 2 | 61 | 36 | 3 | 0 | 102 | 292 |
| 2022 | 6 | 36 | 32 | 2 | 0 | 76 | 190 |
| 2021 | 1 | 19 | 8 | 0 | 0 | 28 | 114 |
| 2020 | 0 | 25 | 20 | 2 | 0 | 47 | 86 |
| 2019 | 2 | 12 | 7 | 0 | 0 | 21 | 39 |
| 2018 | 0 | 1 | 2 | 3 | 0 | 6 | 18 |
| 2017 | 0 | 4 | 2 | 0 | 0 | 6 | 12 |
| 2016 | 0 | 0 | 0 | 0 | 0 | 0 | 6 |
| 2015 | 0 | 1 | 1 | 0 | 0 | 2 | 6 |
| 2014 | 0 | 0 | 0 | 0 | 0 | 0 | 4 |
| 2013 | 0 | 1 | 0 | 0 | 0 | 1 | 4 |
| 2012 | 0 | 0 | 0 | 0 | 0 | 0 | 3 |
| 2011 | 0 | 0 | 0 | 0 | 0 | 0 | 3 |
| 2010 | 0 | 0 | 0 | 0 | 0 | 0 | 3 |
| 2009 | 0 | 0 | 0 | 0 | 0 | 0 | 3 |
| 2008 | 0 | 0 | 0 | 0 | 0 | 0 | 3 |
| 2007 | 0 | 0 | 0 | 0 | 0 | 0 | 3 |
| 2006 | 0 | 0 | 0 | 0 | 0 | 0 | 3 |
| 2005 | 0 | 0 | 1 | 0 | 0 | 1 | 3 |
| 2004 | 0 | 0 | 1 | 0 | 0 | 1 | 2 |
| 2003 | 0 | 0 | 1 | 0 | 0 | 1 | 1 |
| Title | ||
|---|---|---|
| CVE-2026-63440 | 2FAuth: Authenticated SSRF via DNS rebinding in the otpauth image= icon fetch (validate-then-fetch TOCTOU)Bubka · 2FAuth | Medium5.9 |
| CVE-2026-123835 | In JetBrains Datalore before 2026.4 code execution was possible in another user's computation via an init script upload race conditionJetBrains · Datalore | Medium5.9 |
| CVE-2026-123486 | WWBN AVideo 29.0 through 29.4.0 Race Condition in PayPal IPN Deduplication via ipn.phpWWBN · AVideo | Medium6.0 |
| CVE-2026-112913 | filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its databasetox-dev · filelock | Low3.3 |
| CVE-2026-123207 | LibreTV before v2.21.2 SSRF Protection Bypass via DNS RebindingLibreSpark · LibreTV | Low2.3 |
| CVE-2026-112110 | Privileged file deletion in SafeNet Authentication Client SACSrvThalesgroup · Safenet Authentication Client Service | Medium5.8 |
| CVE-2026-119345 | Cocos AI Intra-handshake attested TLS implementation is vulnerable to TOCTOU Attacksultravioletrs · cocos | High7.2 |
| CVE-2026-123119 | Symfony: NoPrivateNetworkHttpClient Does Not Pin the Checked IP of Cached Hosts, Letting DNS Rebinding Enumerate Internal Ports (Incomplete Fix for CVE-2024-50342)sensiolabs · symfony | Low2.3 |
| CVE-2026-122321 | Kyverno 1.18.0 before 1.19.2 verifyImages Cache Signature Verification Bypasskyverno · kyverno | High8.5 |
| CVE-2026-109518 | APT RCE via hard link reuseDebian · APT | High7.7 |
| CVE-2026-100235 | Apache ZooKeeper: ACL enforcement bypass allows unauthorized operations to commit after an ACL revocationApache Software Foundation · Apache ZooKeeper | Medium6.0 |
| CVE-2026-87038 | Time-of-check/time-of-use double fetch in the Zephyr i3c_transfer() syscall handler allows kernel-mode control-flow hijack from user modezephyrproject · zephyr | High7.0 |
| CVE-2026-121050 | Race condition in Mobile in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page.…Google · Chrome | High8.8 |
| CVE-2026-121245 | Race condition in Autofill in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially obtain sensitive information via a crafted HTML…Google · Chrome | Medium5.3 |
| CVE-2026-121048 | Race condition in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.…Google · Chrome | High8.8 |
| CVE-2026-88968 | Claude Code: TOCTOU Race in Edit Tool Allows File Writes Outside the Workspaceanthropics · claude-code | High7.7 |
| CVE-2026-119977 | WordPress Core 4.7.0 - 7.1.3 - Unauthenticated Upgrade-Window Staged-Installer Remote Code ExecutionExploitedWordPress Foundation · WordPress | High8.1 |
| CVE-2026-116250 | pgAdmin 4: Files opened in a storage directory follow a symbolic link, hard link or FIFO planted after the containment checkpgadmin.org · pgAdmin 4 | High7.3 |
| CVE-2026-116240 | pgAdmin 4: File Manager and storage-path tools act on a different path from the one checkedpgadmin.org · pgAdmin 4 | High7.1 |
| CVE-2026-115683 | epiphany: TLS certificate warning bypass via race in tlsErrorPage message handlerGNOME · Epiphany | Medium6.8 |
| CVE-2026-119552 | Uptime Kuma through 2.5.8 Race Condition Admin Creation via Setup Handlerlouislam · uptime-kuma | Medium6.3 |
| CVE-2026-92374 | Privilege Escalation via Insecure Package Handling in TeamViewer Full Client and Host for macOSTeamViewer · Full Client | High7.8 |
| CVE-2026-117603 | Electrum before 4.7.2 Nostr Wallet Connect Plugin Daily Spending Limit Bypassspesmilo · electrum | Critical9.3 |
| CVE-2026-112576 | A memory integrity issue was addressed with improved handling of copy-on-write pages. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS…Apple · iOS and iPadOS | Medium6.5 |
| CVE-2026-77059 | TOCTOU Race Condition in boneIOboneIO · boneIO | High8.8 |
| CVE-2026-75524 | OpenReception: race condition in add-to-tunnel and create-new-client allows overlapping appointments for one agentopen-reception · appointment-booking-software | Medium5.4 |
| CVE-2026-105481 | A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request. This is an…nodejs · node | Medium6.5 |
| CVE-2026-57114 | PraisonAI: Jobs webhook SSRF protection bypass via DNS rebindingMervinPraison · PraisonAI | High7.2 |
| CVE-2026-113038 | Race condition in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass system access restrictions…Google · Chrome | Medium6.5 |
| CVE-2026-113103 | Race condition in WebProtect in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process and leveraged social…Google · Chrome | High8.8 |
| CVE-2026-113008 | Race condition in Transactions Platform in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process and…Google · Chrome | High8.8 |
| CVE-2026-113233 | Race condition in Core in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to potentially…Google · Chrome | High8.8 |
| CVE-2026-113064 | Race condition in OptimizationGuide in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to leak sensitive information via a crafted HTML page.…Google · Chrome | High8.8 |
| CVE-2026-113136 | Race condition in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to potentially bypass…Google · Chrome | High8.8 |
| CVE-2026-113041 | Race condition in Actor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to obtain cross-origin data via a…Google · Chrome | High8.8 |
| CVE-2026-113329 | Race condition in Installer in Google Chrome on on Mac prior to 156.0.8078.47 allowed a local attacker to execute arbitrary code outside the sandbox via a…Google · Chrome | Medium6.5 |
| CVE-2026-113076 | Race condition in Toolbar in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass system access…Google · Chrome | High8.8 |
| CVE-2026-113335 | Race condition in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass web origin policy via a…Google · Chrome | High8.8 |
| CVE-2026-113218 | Race condition in DataTransfer in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process and leveraged social…Google · Chrome | High8.8 |
| CVE-2026-113115 | Race condition in Transactions Platform in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process and…Google · Chrome | High8.8 |
| CVE-2026-113112 | Race condition in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass system access…Google · Chrome | High8.8 |
| CVE-2026-113196 | Race condition in Mobile in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium…Google · Chrome | Medium6.5 |
| CVE-2026-113333 | Race condition in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass system access…Google · Chrome | Medium6.5 |
| CVE-2026-113239 | Race condition in SiteIsolation in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to obtain cross-origin data via a crafted HTML…Google · Chrome | High8.8 |
| CVE-2026-113164 | Race condition in Voice in Google Chrome on on Android prior to 156.0.8078.47 allowed a local attacker to bypass system access restrictions into a privileged…Google · Chrome | High8.8 |
| CVE-2026-113078 | Race condition in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to potentially execute…Google · Chrome | Critical9.6 |
| CVE-2026-113141 | Race condition in Transactions Platform in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to obtain…Google · Chrome | High8.8 |
| CVE-2026-112941 | filelock: SoftReadWriteLock follows a lock tree swapped in after its first acquire and writes lock records into directories of the user running the locktox-dev · filelock | Low3.3 |
| CVE-2026-112937 | filelock: ReadWriteLock on the hard-link route deletes any directory another user renames onto its .filelock-* link directory nametox-dev · filelock | Medium6.1 |
| CVE-2026-112935 | filelock: SoftFileLock stale-lock break removes a live lock file on a reused inode number and admits two holderstox-dev · filelock | Medium4.7 |