Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 2 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,956All CVEsplus 19,141 rejected
- 254Last 24 hours3,184 in the last 7 days
- 16,914Last 30 days1,564 of them critical
- 1,769Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 2 | 7 | 11 | 1 | 0 | 21 | 49 |
| 2025 | 3 | 2 | 6 | 1 | 0 | 12 | 28 |
| 2024 | 1 | 3 | 2 | 0 | 0 | 6 | 16 |
| 2023 | 0 | 2 | 2 | 0 | 0 | 4 | 10 |
| 2022 | 0 | 0 | 3 | 0 | 0 | 3 | 6 |
| 2021 | 0 | 0 | 1 | 0 | 0 | 1 | 3 |
| 2020 | 0 | 0 | 0 | 0 | 0 | 0 | 2 |
| 2019 | 0 | 1 | 1 | 0 | 0 | 2 | 2 |
| Title | ||
|---|---|---|
| CVE-2026-112917 | Docker Desktop WSL2 AF_VSOCK isolation bypass via 32-bit socketcallDocker · Docker Desktop | Critical9.2 |
| CVE-2026-121440 | Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 Forwarded Trailers Header Filter Bypassbytecodealliance · wasmtime | Medium6.3 |
| CVE-2026-89419 | OpenStack Ironic before 39.0.1 sometimes allows a user to change the maintenance setting on a node via PATCH to /v1/nodes/{ident} - in other words, not using…OpenStack · Ironic | Medium5.0 |
| CVE-2026-114659 | Grav Flex Objects 1.4.0 before 1.4.17 Authorization Bypass via Pages API Routesgetgrav · grav-plugin-flex-objects | High7.1 |
| CVE-2026-76529 | Improper Protection of Alternate Path in Splunk SOARSplunk · Splunk SOAR | Critical9.8 |
| CVE-2026-110865 | Renovate before 44.60.1 HTTP Header Allowlist Bypass via Shared Presetsrenovatebot · renovate | High7.1 |
| CVE-2026-69979 | Windows AppX Deployment Service Security Feature Bypass VulnerabilityMicrosoft · Windows 10 Version 21H2 | Medium5.5 |
| CVE-2026-107352 | Missing authorization checks in Amazon Athena engine version 3 request handlingAWS · Amazon Athena | Medium6.3 |
| CVE-2026-89039 | Arbitrary file read via the convert_playwright_script prompt in mcp-k6Grafana · mcp-k6 | Medium6.5 |
| CVE-2026-93353 | copyparty SFTP Volume Restriction Bypass via mkdir/rmdir/chattr HandlersPublic exploit9001 · copyparty | Low2.3 |
| CVE-2026-37008 | CrewAI before fb2323b offers a Python blocklist approach that operates at the wrong level of abstraction, a different vulnerability than CVE-2026-2275.…Public exploitCrewAI · CrewAI | High8.1 |
| CVE-2026-82586 | AshLua read operation aggregate bypasses the exposed-field allow-list, exposing private attributesash-project · ash_lua | High8.2 |
| CVE-2026-82754 | ash_authentication_oauth2_server aliases every protocol endpoint under /.well-known, bypassing path-scoped controlsash-project · ash_authentication_oauth2_server | Medium6.3 |
| CVE-2026-86145 | PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size…PCRE · PCRE2 | High8.2 |
| CVE-2026-58428 | Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)Public exploitGitea · Gitea Open Source Git Server | Medium6.5 |
| CVE-2026-66756 | Apache Tika: unpack endpoint in tika-server allows configuration with unsecureFeatures=falseApache Software Foundation · Apache Tika | Medium6.9 |
| CVE-2026-54423 | In OpenStack Ironic before 37.0.1, an Ironic user with the ability to deploy nodes using the IPMI management interface can maliciously use the send_raw step to…OpenStack · Ironic | High8.2 |
| CVE-2026-0268 | Prisma Access Agent: Local Authenticated VPN Enforcement Bypass on LinuxPalo Alto Networks · Prisma Access Agent | Medium4.4 |
| CVE-2026-0237 | Prisma Browser: Improperly Restricted Automation Bridge Allows Security BypassPalo Alto Networks · Prisma Browser | High7.3 |
| CVE-2026-4913 | Improper protection of an alternate path in Ivanti N-ITSM before version 2025.4 allows a remote authenticated attacker to retain access when their account has…Ivanti · Neurons for ITSM (On-Premise) | Medium5.7 |
| CVE-2026-4270 | AWS API MCP File Access Restriction BypassAWS · AWS API MCP Server | Medium6.8 |
| CVE-2025-68939 | Gitea before 1.23.0 allows attackers to add attachments with forbidden file extensions by editing an attachment name via an attachment API.Gitea · Gitea | High8.2 |
| CVE-2025-4617 | Prisma Browser: Insufficient Policy Enforcement Vulnerability in Prisma BrowserPalo Alto Networks · Prisma Browser | Low1.1 |
| CVE-2025-58079 | Improper Protection of Alternate Path (CWE-424) in the AppSuite of desknet's NEO V4.0R1.0 to V9.0R2.0 allows an attacker to create malicious AppSuite…NEOJAPAN Inc. · desknet's NEO | Medium5.3 |
| CVE-2025-6250 | Privilege Management for Windows - Elevation of PrivilegeBeyondTrust · Privilege Management for Windows | High7.1 |
| CVE-2025-49163 | Arris VIP1113 devices through 2025-05-30 with KreaTV SDK allow booting an arbitrary image via a crafted /usr/bin/gunzip file.Public exploitArris · VIP1113 | Medium6.7 |
| CVE-2025-49162 | Arris VIP1113 devices through 2025-05-30 with KreaTV SDK allow file overwrite via TFTP because a remote filename with a space character allows an attacker to…Public exploitArris · VIP1113 | Medium6.4 |
| CVE-2025-48828 | Certain vBulletin versions might allow attackers to execute arbitrary PHP code by abusing Template Conditionals in the template engine. By crafting template…Public exploitvBulletin · vBulletin | Critical9.0 |
| CVE-2025-48827 | vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 allows unauthenticated users to invoke protected API controllers' methods when running on PHP 8.1 or…Public exploitvBulletin · vBulletin | Critical10.0 |
| CVE-2025-46655 | CodiMD through 2.5.4 has a CSP-based protection mechanism against XSS through uploaded SVG documents containing JavaScript, but it can be bypassed in certain…Public exploitHackMD · CodiMD | Medium4.9 |
| CVE-2025-46654 | CodiMD through 2.2.0 has a CSP-based protection mechanism against XSS through uploaded JavaScript content, but it can be bypassed by uploading a .html file…Public exploitHackMD · CodiMD | Medium4.9 |
| CVE-2024-58136 | Yii 2 before 2.0.52 mishandles the attaching of behavior that is defined by an __class array key, a CVE-2024-4990 regression, as exploited in the wild in…ExploitedPublic exploityiiframework · Yii | Critical9.0 |
| CVE-2025-0113 | Cortex XDR Broker VM: Unauthorized Access to Broker VM Docker ContainersPalo Alto Networks · Cortex XDR Broker VM | Medium5.3 |
| CVE-2024-8781 | Container Escape Vulnerability in TR7's Application Security Platform (ASP)TR7 · Application Security Platform (ASP) | High8.7 |
| CVE-2023-52952 | A vulnerability has been identified in HiMed Cockpit 12 pro (J31032-K2017-H259) (All versions >= V11.5.1 < V11.6.2), HiMed Cockpit 14 pro+ (J31032-K2017-H435)…Siemens · HiMed Cockpit 12 pro | Critical9.3 |
| CVE-2024-8311 | Improper Protection of Alternate Path in GitLabGitLab · GitLab | Medium6.5 |
| CVE-2024-3927 | Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.6.3 - Form Submission Admin Email Bypassbdthemes · Element Pack – Widgets, Templates & Addons for Elementor | Medium5.3 |
| CVE-2024-3460 | In KioWare for Windows (versions all through 8.34) it is possible to exit this software and use other already opened applications utilizing a short time window…Kioware · Kioware | High7.4 |
| CVE-2024-3459 | KioWare for Windows (versions all through 8.34) allows to escape the environment by downloading PDF files, which then by default are opened in an external PDF…Kioware · Kioware | High8.4 |
| CVE-2023-20272 | A vulnerability in the web-based management interface of Cisco Identity Services Engine could allow an authenticated, remote attacker to upload malicious files…Cisco · Cisco Identity Services Engine Software | Medium6.7 |
| CVE-2023-46176 | IBM MQ privilege escalationIBM · MQ Appliance | Medium6.7 |
| CVE-2023-5165 | Docker Desktop before 4.23.0 allows Enhanced Container Isolation bypass via debug shellDocker Inc. · Docker Desktop | High7.1 |
| CVE-2023-0629 | Docker Desktop before 4.17.0 allows an unprivileged user to bypass Enhanced Container Isolation restrictions via the raw Docker socket and launch privileged containersDocker Inc. · Docker Desktop | High7.1 |
| CVE-2022-1742 | 2.2.4 IMPROPER PROTECTION OF ALTERNATE PATH CWE-424Dominion Voting Systems · ImageCast X application | Medium6.8 |
| CVE-2022-28782 | Improper access control vulnerability in Contents To Window prior to SMR May-2022 Release 1 allows physical attacker to install package before completion of…Samsung Mobile · Samsung Mobile Devices | Medium4.6 |
| CVE-2022-24932 | Improper Protection of Alternate Path vulnerability in Setup wizard process prior to SMR Mar-2022 Release 1 allows physical attacker package installation…Samsung Mobile · Samsung Mobile Devices | Medium4.2 |
| CVE-2021-3793 | An improper access control vulnerability was reported in some Motorola-branded Binatone Hubble Cameras which could allow an unauthenticated attacker on the…Motorola · Binatone Hubble Cameras | Medium6.5 |
| CVE-2019-18996 | ABB PB610 HMIStudio accepts malicious DLL file in an applicationABB · PB610 Panel Builder 600 | High7.1 |
| CVE-2019-18997 | PB610 HMISimulator provides interface with access to arbitrary filesABB · PB610 Panel Builder 600 | Medium4.3 |