Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 1 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,955All CVEsplus 19,141 rejected
- 331Last 24 hours3,207 in the last 7 days
- 17,025Last 30 days1,575 of them critical
- 1,769Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 23 | 44 | 59 | 1 | 0 | 127 | 548 |
| 2025 | 5 | 38 | 42 | 0 | 0 | 85 | 421 |
| 2024 | 11 | 26 | 31 | 2 | 0 | 70 | 336 |
| 2023 | 4 | 34 | 27 | 4 | 0 | 69 | 266 |
| 2022 | 2 | 31 | 45 | 1 | 0 | 79 | 197 |
| 2021 | 4 | 18 | 20 | 0 | 0 | 42 | 118 |
| 2020 | 3 | 12 | 19 | 0 | 0 | 34 | 76 |
| 2019 | 0 | 6 | 10 | 1 | 0 | 17 | 42 |
| 2018 | 0 | 4 | 3 | 1 | 0 | 8 | 25 |
| 2017 | 3 | 5 | 5 | 0 | 0 | 13 | 17 |
| 2016 | 0 | 0 | 2 | 0 | 0 | 2 | 4 |
| 2015 | 0 | 0 | 0 | 0 | 0 | 0 | 2 |
| 2014 | 0 | 0 | 0 | 0 | 0 | 0 | 2 |
| 2013 | 0 | 0 | 0 | 0 | 0 | 0 | 2 |
| 2012 | 0 | 0 | 0 | 0 | 0 | 0 | 2 |
| 2011 | 0 | 0 | 0 | 0 | 0 | 0 | 2 |
| 2010 | 0 | 0 | 0 | 0 | 0 | 0 | 2 |
| 2009 | 0 | 0 | 1 | 0 | 0 | 1 | 2 |
| 2008 | 0 | 0 | 0 | 0 | 0 | 0 | 1 |
| 2007 | 0 | 0 | 0 | 0 | 0 | 0 | 1 |
| 2006 | 0 | 0 | 0 | 0 | 0 | 0 | 1 |
| 2005 | 0 | 0 | 1 | 0 | 0 | 1 | 1 |
| Title | ||
|---|---|---|
| CVE-2026-123988 | SililaWijesinghe Food Ordering System admin exposure of information through directory listingPublic exploitSililaWijesinghe · Food Ordering System | Medium6.9 |
| CVE-2026-119757 | BTCPay Server < 2.4.2 LND Macaroon Credential File DisclosureBTCPay Server · BTCPay Server | Critical9.3 |
| CVE-2026-65983 | OpenEMR FaxSMS module: insecure staging of decrypted patient documents in webrootopenemr · openemr | High7.5 |
| CVE-2026-123197 | WPPConnect Server through 2.10.76 Unauthenticated Sticker Media Disclosure via /fileswppconnect · wppconnect-server | Medium6.9 |
| CVE-2026-90632 | Apache OpenOffice: Local file inclusion via GStreamer pluginApache Software Foundation · Apache OpenOffice | Medium5.5 |
| CVE-2026-90627 | Apache OpenOffice: Local file inclusion via SQL provider and flat file database referencesApache Software Foundation · Apache OpenOffice | Medium5.5 |
| CVE-2026-120501 | An Otter Wiki 2.20.1 before 2.26.2 Repository File Disclosure via DataTable srcredimp · otterwiki | Medium6.9 |
| CVE-2026-84172 | Apache Wicket: Component markup is served as a package resource when wicket-core has its own class loaderApache Software Foundation · Apache Wicket | Medium6.3 |
| CVE-2026-61730 | SOCFortress CoPilot: Unauthenticated Exposure of ScoutSuite Reports and Uploaded GCP Service-Account Key via Static Mountsocfortress · CoPilot | Critical9.3 |
| CVE-2026-119201 | Nuxt dev server exposes generated appSecret through Vite file servingnuxt · nuxt | Medium4.8 |
| CVE-2026-67073 | HCL BigFix AEX is affected by multiple security vulnerabilities.HCL Software · BigFix AEX | High8.6 |
| CVE-2026-65210 | Supermicro BMC IPMI feature contains Arbitrary File Access vulnerabilitySMCI · MBD-X12SPI | Medium4.9 |
| CVE-2026-46651 | Unauthenticated SSRF and local file inclusion via DownloadTaskEndpoint WebSocket in Goobi viewerintranda · goobi-viewer-core | Critical9.8 |
| CVE-2026-76531 | Files or Directories Accessible to External Parties in Splunk SOARSplunk · Splunk SOAR | Critical9.9 |
| CVE-2026-114400 | Trudesk through 1.2.11 Missing Authentication for Ticket Attachments via /uploadsPublic exploitpolonel · trudesk | High8.2 |
| CVE-2026-87348 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Mgmt). Supported versions that are affected…Oracle Corporation · PeopleSoft Enterprise PeopleTools | Medium4.2 |
| CVE-2026-112948 | Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token filevitest-dev · vitest | Medium6.5 |
| CVE-2026-112144 | satya-vinay Events-Management-System project.sql file accessPublic exploitsatya-vinay · Events-Management-System | Medium6.9 |
| CVE-2026-102695 | OmniFaces: Forged combined-resource IDs and related output/push boundariesomnifaces · omnifaces | High8.2 |
| CVE-2026-108070 | Improper Access Control Allows Unauthorized Access to Protected Internal Web Resources in TSplus Remote AccessTSplus · TSplus Remote Access | High8.7 |
| CVE-2026-96857 | Windows Projected File System Information Disclosure VulnerabilityMicrosoft · Windows 10 Version 1809 | Medium5.5 |
| CVE-2026-88137 | WebDAV Information Disclosure VulnerabilityMicrosoft · Windows 10 Version 1607 | Medium6.5 |
| CVE-2026-85840 | Windows Event Viewer Information Disclosure VulnerabilityMicrosoft · Windows 10 Version 1607 | Medium6.5 |
| CVE-2026-85812 | Windows Bind Filter Driver Information Disclosure VulnerabilityMicrosoft · Windows 10 Version 21H2 | Medium5.5 |
| CVE-2026-109162 | TYPO3 CMS - Security Misconfiguration in Form FrameworkTYPO3 · TYPO3 CMS | Medium6.3 |
| CVE-2026-89118 | Information Disclosure vulnerability in SAP NetWeaver Enterprise PortalSAP_SE · SAP NetWeaver Enterprise Portal | Medium5.3 |
| CVE-2026-108938 | code-projects Matrimonial System matrimony.sql file accessPublic exploitcode-projects · Matrimonial System | Medium6.9 |
| CVE-2026-94375 | Order Export & Order Import for WooCommerce <= 2.7.8 - Unauthenticated Sensitive File Exposure via Missing Directory Guard Re-verification in get_file_path()webtoffee · Order Export & Order Import for WooCommerce | Medium5.3 |
| CVE-2026-105750 | Docling: `enable_local_fetch` is not enforced in HTML browser-rendering modedocling-project · docling | Medium5.9 |
| CVE-2026-21589 | This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center.…ExploitedPublic exploitAtlassian · Bamboo Data Center | Critical9.3 |
| CVE-2026-100727 | An improper access control vulnerability exists in GROWI, which allow an unauthenticated attacker to read files contained in non-public pages of the affected…GROWI, Inc. · GROWI | Medium6.9 |
| CVE-2026-58415 | Apache HTTP Server: mod_dav_fs property database read accessApache Software Foundation · Apache HTTP Server | Medium5.3 |
| CVE-2026-71379 | Toptech TMS7 and TopHAT Files or Directories Accessible to External PartiesToptech Systems · TMS7 | Critical10.0 |
| CVE-2026-6544 | Multiple Vulnerabilities in IBM Concert SoftwareIBM · Concert | Medium6.2 |
| CVE-2026-15915 | Multiple Vulnerabilities in IBM Concert SoftwareIBM · Concert | Medium6.2 |
| CVE-2026-77259 | MCP Atlassian: Arbitrary file read via confluence_upload_attachment allows exfiltration of server credentialsPublic exploitsooperset · mcp-atlassian | High7.7 |
| CVE-2026-88623 | NUUO Network Video Recorder 2.0.0 is vulnerable to arbitrary file read. In up.php, the url parameter submitted by the user via POST is received, and fopen() is…Public exploit | High7.5 |
| CVE-2026-54629 | Anyquery: Local File Read (LFR) via Unrestricted SQLite Virtual Table Modules in Server Modejulien040 · anyquery | High7.5 |
| CVE-2026-77884 | Gallery - Private Photo Vault 1.0.41 - Unauthenticated local-network HTTP file exposurePublic exploitBrain Trust · Gallery - Private Photo Vault | High7.1 |
| CVE-2026-80494 | Yogeta WP Cloud <= 1.0 - Unauthenticated Arbitrary File DownloadPublic exploitUnknown · Yogeta WP Cloud | High8.6 |
| CVE-2026-68831 | Windows Defender Firewall Service Information Disclosure VulnerabilityMicrosoft · Windows 10 Version 1607 | Medium5.5 |
| CVE-2026-74853 | Pods < 3.3.9.2 - Author+ Arbitrary File Read via Shortcode Display CallbackPublic exploitUnknown · Pods | Medium6.8 |
| CVE-2026-75164 | An arbitrary file read vulnerability in /cgi-bin/ugwdownload.cgi of MBS-Solutions X-Serie Gateway firmware V6_00_05 allows a remote authenticated user with the… | Medium6.5 |
| CVE-2026-67402 | An insecure Apache configuration in ConfigServer Security & Firewall maps /usr/bin as CGI programs through the Messenger v3 HTTPS virtual host. A remote…WebPros · ConfigServer Security & Firewall | Critical9.2 |
| CVE-2026-85175 | SiYuan before v3.8.2 TLS Private Key Disclosure via getFilePublic exploitsiyuan-note · siyuan | High8.7 |
| CVE-2026-73736 | Unauthenticated Limited Information Disclosure leads to Data Exposure in HPE Networking Fabric ComposerHewlett Packard Enterprise (HPE) · Fabric Composer | Medium5.3 |
| CVE-2026-73735 | Authenticated Access Control Vulnerabilities allow Information Disclosure in HPE Networking Fabric Composer APIHewlett Packard Enterprise (HPE) · Fabric Composer | Medium5.4 |
| CVE-2026-73705 | Authenticated Arbitrary File Write leads to Remote Code Execution in HPE Networking Fabric ComposerHewlett Packard Enterprise (HPE) · Fabric Composer | High8.8 |
| CVE-2026-82020 | Hermes Agent 0.16.0 < 0.17.0 Credential Store Overwrite via File-Write ToolNousResearch · hermes-agent | High7.6 |
| CVE-2026-53580 | Trilium arbitrary file read and denial of service via file:// URLs in the automatic image-download featurePublic exploitTriliumNext · Trilium | High8.1 |