Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 2 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 402,028All CVEsplus 19,141 rejected
- 262Last 24 hours3,249 in the last 7 days
- 16,941Last 30 days1,571 of them critical
- 1,769Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 43 | 128 | 147 | 25 | 1 | 344 | 1,591 |
| 2025 | 22 | 42 | 59 | 6 | 0 | 129 | 1,247 |
| 2024 | 13 | 43 | 68 | 7 | 0 | 131 | 1,118 |
| 2023 | 14 | 48 | 66 | 7 | 0 | 135 | 987 |
| 2022 | 9 | 41 | 101 | 4 | 0 | 155 | 852 |
| 2021 | 15 | 45 | 68 | 3 | 0 | 131 | 697 |
| 2020 | 22 | 72 | 96 | 3 | 0 | 193 | 566 |
| 2019 | 31 | 72 | 74 | 8 | 0 | 185 | 373 |
| 2018 | 54 | 40 | 30 | 0 | 0 | 124 | 188 |
| 2017 | 18 | 23 | 7 | 0 | 0 | 48 | 64 |
| 2016 | 0 | 1 | 0 | 0 | 0 | 1 | 16 |
| 2015 | 0 | 0 | 2 | 0 | 0 | 2 | 15 |
| 2014 | 0 | 1 | 2 | 0 | 0 | 3 | 13 |
| 2013 | 0 | 0 | 2 | 2 | 0 | 4 | 10 |
| 2012 | 0 | 1 | 1 | 0 | 0 | 2 | 6 |
| 2011 | 0 | 0 | 0 | 0 | 0 | 0 | 4 |
| 2010 | 0 | 0 | 0 | 0 | 0 | 0 | 4 |
| 2009 | 0 | 0 | 0 | 0 | 0 | 0 | 4 |
| 2008 | 0 | 0 | 0 | 0 | 0 | 0 | 4 |
| 2007 | 1 | 0 | 0 | 0 | 0 | 1 | 4 |
| 2006 | 0 | 0 | 0 | 0 | 0 | 0 | 3 |
| 2005 | 1 | 0 | 0 | 0 | 0 | 1 | 3 |
| 2004 | 0 | 0 | 0 | 0 | 0 | 0 | 2 |
| 2003 | 0 | 0 | 0 | 0 | 0 | 0 | 2 |
| 2002 | 0 | 0 | 0 | 0 | 0 | 0 | 2 |
| 2001 | 1 | 0 | 0 | 0 | 0 | 1 | 2 |
| 2000 | 0 | 0 | 0 | 0 | 0 | 0 | 1 |
| 1999 | 0 | 1 | 0 | 0 | 0 | 1 | 1 |
| Title | ||
|---|---|---|
| CVE-2026-17367 | Multiple Vulnerabilities in IBM API ConnectIBM · API Connect | Medium5.4 |
| CVE-2026-123856 | In JetBrains Toolbox App before 3.6.1 nTLM hash disclosure was possible via SVG tool icons from a Remote Development serverJetBrains · Toolbox App | Medium6.5 |
| CVE-2026-66982 | HCL AION is affected by multiple security vulnerabilities.HCL Software · HCL AION | Low3.3 |
| CVE-2026-119757 | BTCPay Server < 2.4.2 LND Macaroon Credential File DisclosureBTCPay Server · BTCPay Server | Critical9.3 |
| CVE-2026-123059 | Keycloak admin client secret stored in cleartext in a ConfigMap in Eclipse BaSyx Helm ChartsEclipse Foundation · Eclipse BaSyx Helm Charts | High7.5 |
| CVE-2026-123047 | Keycloak admin user password stored in cleartext in a ConfigMap in Eclipse BaSyx Helm ChartsEclipse Foundation · Eclipse BaSyx Helm Charts | High7.5 |
| CVE-2026-73116 | Apache Juneau: REST client forwards credentials to a different origin when following HTTP redirectsApache Software Foundation · Apache Juneau | Critical10.0 |
| CVE-2026-54378 | VitaFit Cloud API Broken Access Control via S3 Token EndpointPublic exploitShenzhen Shine Industrial Co., Ltd. · VitaFit | Critical9.3 |
| CVE-2026-97693 | Yuxi sandbox isolation failure allows cross-tenant access and internal service compromisexerrors · Yuxi | Critical9.9 |
| CVE-2026-113371 | Nexus Repository 3 - Insufficiently Protected Credentials in Repository Signing PassphraseSonatype · Nexus Repository 3 | High7.1 |
| CVE-2026-113372 | Nexus Repository 3 - Insufficiently Protected Credentials in YUM Repository Signing KeySonatype · Nexus Repository 3 | High7.1 |
| CVE-2026-121971 | Symfony: ScopingHttpClient Sends the Credentials of Its Default Scope to Other Origins Through Network-Path Referencessensiolabs · symfony | High8.2 |
| CVE-2026-113733 | Password hash disclosure to "view only" admin users with custom user modelsdjangoproject · Django | Low2.1 |
| CVE-2026-89292 | Unauthenticated SSRF with MNESTIX_BACKEND_API_KEY disclosure in Eclipse Mnestix Browser server actions for configured InfrastructuresEclipse Foundation · Eclipse Mnestix | Critical9.2 |
| CVE-2026-105769 | kaniko can send the build's Azure (Entra ID) access token to lookalike ACR registry hostschainguard · kaniko | Critical9.3 |
| CVE-2026-116252 | pgAdmin 4: Materialized view refresh redirects its connection through a crafted database namepgadmin.org · pgAdmin 4 | High7.1 |
| CVE-2026-116247 | pgAdmin 4: libpq uses the pgAdmin service account's own password file and client certificatepgadmin.org · pgAdmin 4 | High7.1 |
| CVE-2026-116245 | pgAdmin 4: Connection services are not restricted in server modepgadmin.org · pgAdmin 4 | High7.1 |
| CVE-2026-116244 | pgAdmin 4: libpq uses the pgAdmin service account's Kerberos credentialspgadmin.org · pgAdmin 4 | High7.1 |
| CVE-2026-116242 | pgAdmin 4: SSH tunnels use the pgAdmin service account's own SSH identitypgadmin.org · pgAdmin 4 | High7.1 |
| CVE-2026-61730 | SOCFortress CoPilot: Unauthenticated Exposure of ScoutSuite Reports and Uploaded GCP Service-Account Key via Static Mountsocfortress · CoPilot | Critical9.3 |
| CVE-2026-111502 | Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Insufficiently Protected Credentials vulnerability. A low privileged attacker with remote…Dell · OpenManage Enterprise | Medium4.3 |
| CVE-2026-119566 | Prometheus through 3.15.1 Credential Leak via remote_write Cross-Host Redirectsprometheus · prometheus | Medium6.3 |
| CVE-2026-118763 | @sigstore/oci sends the registry Authorization header to a cross-host blob-upload Locationsigstore · sigstore-js | High7.4 |
| CVE-2026-90861 | Password Disclosure via Activity Logs Enabling Administrator Privilege Escalation in WS_FTP ServerProgress Software · WS_FTP Server | Medium6.6 |
| CVE-2026-84295 | Improper Authentication in Progress WS_FTP ServerProgress Software · WS_FTP Server | Critical10.0 |
| CVE-2026-104314 | Langflow OSS is affected by multiple vulnerabilitiesIBM · Langflow OSS | Medium6.5 |
| CVE-2026-110192 | Langflow OSS is affected by multiple vulnerabilitiesIBM · Langflow OSS | Medium6.5 |
| CVE-2026-88967 | Azure Monitor access token disclosure via SSRFGrafana · Grafana Enterprise | High7.7 |
| CVE-2026-87097 | Sensitive information disclosure due to insufficiently protected credentials. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows)…Acronis · Acronis Cyber Protect 17 | Medium5.3 |
| CVE-2026-104384 | Insufficiently protected credentials in EagleCloud Aquila on-premises versionEagleCloud · Aquila | High8.7 |
| CVE-2026-59158 | Nuxt Ollama: public runtime configuration discloses the configured cloud API keyPublic exploitthoda-dev · nuxt-ollama | High7.5 |
| CVE-2026-116683 | CTFer.io's CTFd Terraform Provider allows a local or remote attacker to read team passwords in state as non sensitive valuesctfer-io · terraform-provider-ctfd | High7.1 |
| CVE-2026-101034 | Security Advisory for offline recovery of Symantec GSS 3.3 RU11 stored domain credentialsBroadcom · Symantec Ghost Solution Suite | Medium6.8 |
| CVE-2026-113440 | HTTP/1.1 and HTTP/2 redirects resend basic_auth and cookie to a different scheme or port in hackneybenoitc · hackney | Medium6.0 |
| CVE-2026-115750 | mcp-from-openapi from 2.5.0 before 2.9.0 Credential Leak via Cross-Origin RedirectsPublic exploitagentfront · mcp-from-openapi | Medium6.3 |
| CVE-2026-115371 | LXC Incus 6.0.3 before 6.0.7, 6.6.0 before 7.0.2, and 7.1.0 before 7.5.0 Bucket Credential Disclosure via Storage Bucket Keys Endpointslxc · incus | High7.1 |
| CVE-2026-21811 | Multiple security vulnerabilities affect HCL AppScan Azure Boards Plugin (CVE-2026-12143 and CVE-2026-13149)HCL Software · AppScan Integration with Azure Boards for ASoC & A360 | Low3.8 |
| CVE-2026-114221 | NewType Infortech｜NT OneAPP - Credential DisclosureNewType Infortech · NT OneAPP | Medium5.9 |
| CVE-2026-103090 | Unauthenticated Biscuit Credential Disclosure via GET /enroll/status in Google OSS Agent Mesh (SAM)Public exploitGoogle · SAM | High8.8 |
| CVE-2026-114070 | Trigger.dev 4.5.0 before 4.6.0 Dashboard Agent User Token Disclosure via Session Recordstriggerdotdev · trigger.dev | Medium5.1 |
| CVE-2026-94266 | password leak in CURLINFO_EFFECTIVE_URLPublic exploitcurl · curl | High7.5 |
| CVE-2026-113652 | ApostropheCMS uploadfs Azure backend leaks account-level SAS token into every public attachment URL (sas: true)apostrophecms · apostrophe | Medium5.6 |
| CVE-2026-111765 | A2A Java SDK: Android synchronous POST forwards credentials across authorities after incomplete redirect fixPublic exploita2aproject · a2a-java | High7.5 |
| CVE-2026-111763 | A2A Java SDK send client credentials under server-controlled HTTP header name, enabling leakage via redirecta2aproject · a2a-java | Medium5.7 |
| CVE-2026-112303 | GDevelop through 5.6.284 Cookie Leak via LocalFileDownloader Resource URLsGDevelop · GDevelop | Medium5.3 |
| CVE-2026-111927 | Coder before 2.35.4 Credential Theft via Workspace Proxy Hostname Prefix Matchcoder · coder | High8.7 |
| CVE-2026-96626 | Arcane: Container-registry credential exfiltration via URL repoint + test to attacker hostgetarcaneapp · arcane | High8.5 |
| CVE-2026-104617 | sdbootutil: qrencode invocation leaks PIN/recovery key in /proc/<pid>/cmdlineSUSE · SUSE Linux Enterprise Server 16.1 | Medium5.9 |
| CVE-2026-36436 | An issue in Trisolutions BRPerfX version 1.4.4.0 exposes LDAP credentials in plaintext within the administrative configuration interface. An authenticated… | High7.5 |