Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 3 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,625All CVEsplus 19,141 rejected
- 672Last 24 hours2,950 in the last 7 days
- 17,120Last 30 days1,607 of them critical
- 1,769Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 4 | 13 | 19 | 2 | 1 | 39 | 57 |
| 2025 | 1 | 3 | 4 | 0 | 0 | 8 | 18 |
| 2024 | 1 | 6 | 2 | 0 | 0 | 9 | 10 |
| 2023 | 0 | 0 | 1 | 0 | 0 | 1 | 1 |
| Title | ||
|---|---|---|
| CVE-2026-122233 | FrankenPHP before 1.13.4 Cross-Request Response Header Leak in Worker Modephp · frankenphp | Medium6.3 |
| CVE-2026-121966 | Traefik before 2.11.60 and 3.7.16 ForwardAuth NTLM/Negotiate Identity Leaktraefik · traefik | High7.0 |
| CVE-2026-120634 | CGI::Carp versions before 5.00 for Perl leak warnings across requests in persistent environments via the warningsToBrowser bufferCGI | Not scored |
| CVE-2026-115419 | Unintended disclosure of data element to wrong session in Strands Agents SDK A2A ServerAWS · strands-agents | High8.6 |
| CVE-2026-114637 | Traefik v3.2.0 before v3.7.14 FastProxy NTLM/Negotiate Connection Pool Identity Leaktraefik · traefik | High7.0 |
| CVE-2026-112921 | Robots::Validate versions from 0.4.3 before 0.4.10 for Perl report clients as imposter robots when User-Agent matcher state carries over from a previous requestRobots-Validate | High7.3 |
| CVE-2026-107929 | local interface connection reuse mixupcurl · curl | High8.1 |
| CVE-2026-86411 | FTP connection reuse inherits client-certificatecurl · curl | Critical9.1 |
| CVE-2026-85296 | Apache Camel: Camel-AS2 Cross-Partner Signing Key Confusion via Shared Per-Request StateApache Software Foundation · Apache Camel | Medium6.5 |
| CVE-2026-85245 | Apache Camel: Camel-Thrift Cross-Exchange Data Disclosure via a Shared Deserialization TargetApache Software Foundation · Apache Camel | Medium5.9 |
| CVE-2026-82416 | FrankenPHP: Cross-request PHP session ID leak in worker mode when the session extension is a shared modulephp · frankenphp | High7.7 |
| CVE-2026-103869 | Pulp-ansible: bearer tokens are reused across remotes in a workerRed Hat · Red Hat Ansible Automation Platform 2 | Medium6.5 |
| CVE-2026-103868 | Pulp-container: registry credentials are reused across remotes in a workerRed Hat · Red Hat Ansible Automation Platform 2 | Medium6.5 |
| CVE-2026-82806 | Apache APISIX: cross-request permission pollution via static permission list mutationApache Software Foundation · Apache APISIX | Medium5.3 |
| CVE-2026-103544 | datadrivenconstruction OpenConstructionERP Al Provider Configuration ai_client.py wrong sessiondatadrivenconstruction · OpenConstructionERP | Medium5.3 |
| CVE-2026-88017 | rclone: FTP cross-session auth-proxy backend confusionrclone · rclone | High7.3 |
| CVE-2026-84685 | Improper Cache Isolation in auth0/react-native-auth0 SDK Web Platform Credential ManagementAuth0 · react-native-auth0 | Medium6.5 |
| CVE-2026-86492 | In JetBrains YouTrack before 2026.2.18634 a shared token cache allowed cross-tenant theft of GitHub App installation tokensJetBrains · YouTrack | High8.5 |
| CVE-2026-80231 | native CA store conn reusecurl · curl | High7.5 |
| CVE-2026-19931 | Negotiate ambient user conn reusecurl · curl | Critical9.8 |
| CVE-2026-18489 | IBM ContextForge Translate is affected by cross-client credential context confusionIBM · ContextForge MCP Gateway - Translate utility | High7.4 |
| CVE-2026-82367 | Re-entrant synchronous publish in AshGraphql subscription batcher delivers one subscriber's records to another's topicash-project · ash_graphql | Low2.3 |
| CVE-2026-71850 | Hono: `memo()` retains SSR output across requests, leading to cross-user data disclosurehonojs · hono | Medium4.8 |
| CVE-2026-16326 | consul-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless modeHashiCorp · Tooling | Critical10.0 |
| CVE-2026-16498 | terraform-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless modeHashiCorp · Tooling | Critical10.0 |
| CVE-2026-54497 | view_component: Reused Component Instances Retain Stale Render ContextViewComponent · view_component | Medium6.8 |
| CVE-2026-14621 | FederatedAI FATE OSX Broker QueuePushReqStreamObserver.java QueuePushReqStreamObserver.initEggroll wrong sessionFederatedAI · FATE | Low2.3 |
| CVE-2026-8458 | wrong reuse for different servicescurl · curl | Medium6.5 |
| CVE-2026-54311 | n8n: Merge Node SQL Mode Prototype Pollutionn8n-io · n8n | Medium6.0 |
| CVE-2026-9831 | ExtremeCloud IQ Cross Tenant Data Exposure via Extreme Platform One Authentication Race ConditionExtreme Networks · Extreme Platform ONE | Medium6.3 |
| CVE-2026-46416 | Microsoft UFO shared WebSocket handler state causes cross-client response hijackingmicrosoft · UFO | Medium6.3 |
| CVE-2026-5773 | wrong reuse of SMB connectioncurl · curl | High7.5 |
| CVE-2026-34391 | Fleet Vulnerable to Windows MDM cross-device command disclosurefleetdm · fleet | Medium6.6 |
| CVE-2026-33215 | NATS is vulnerable to MQTT hijacking via Client IDnats-io · nats-server | Medium6.5 |
| CVE-2026-23919 | Insufficient isolation of JavaScript (Duktape) execution context on Zabbix ServerZabbix · Zabbix | High7.1 |
| CVE-2025-15576 | Jail chroot escape via fd exchange with a different jailFreeBSD · FreeBSD | High7.5 |
| CVE-2026-27492 | Lettermint Node.js SDK leaks email properties to unintended recipients when client instance is reusedlettermint · lettermint-node | Medium4.7 |
| CVE-2026-23844 | Whisper Money has IDOR Vulnerability on sync/balances endpointwhisper-money · whisper-money | Medium4.9 |
| CVE-2026-23646 | OpenProject users can delete other user's session, causing them to be logged outopf · openproject | Medium6.5 |
| CVE-2025-24934 | SO_REUSEPORT_LB breaks connect(2) for UDP socketsFreeBSD · FreeBSD | Medium5.4 |
| CVE-2025-47928 | Spotipy repo vulnerable to secrets exfiltration via `pull_request_target`spotipy-dev · spotipy | Critical9.1 |
| CVE-2025-30073 | An issue was discovered in OPC cardsystems Webapp Aufwertung 2.1.0. The reference assigned to transactions can be reused. When completing a payment, the first… | High7.5 |
| CVE-2025-2312 | cifs.upcall makes an upcall to the wrong namespace in containerized environmentscifs-utils · cifs-utils | Medium5.9 |
| CVE-2024-8314 | Improper session handling in B&R APROLB&R Industrial Automation GmbH · APROL | Medium5.5 |
| CVE-2025-27606 | Element Android PIN autologout bypasselement-hq · element-android | Medium5.1 |
| CVE-2025-1247 | Io.quarkus:quarkus-rest: quarkus rest endpoint request parameter leakage due to shared instancequarkus-rest | High8.3 |
| CVE-2023-1907 | Pgadmin: users authenticated simultaneously via ldap may be attached to the wrong sessionpgadmin | High8.0 |
| CVE-2024-11094 | 404 Solution <= 2.35.17 - Missing Authentication to Sensitive Information Exposureaaron13100 · 404 Solution | Medium5.3 |
| CVE-2024-5148 | Gnome-remote-desktop: inadequate validation of session agents using d-bus methods may expose rdp tls certificategnome-remote-desktop | High7.5 |
| CVE-2024-41977 | A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.1), RUGGEDCOM RM1224 LTE(4G) NAM…Siemens · RUGGEDCOM RM1224 LTE(4G) EU | High7.3 |