Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read just now.
At a glance
Published CVEs; rejected ones are not counted.
- 401,625All CVEsplus 19,141 rejected
- 680Last 24 hours2,965 in the last 7 days
- 17,121Last 30 days1,607 of them critical
- 1,769Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 28 | 67 | 135 | 34 | 0 | 264 | 703 |
| 2025 | 5 | 31 | 44 | 11 | 0 | 91 | 439 |
| 2024 | 8 | 16 | 39 | 10 | 0 | 73 | 348 |
| 2023 | 2 | 21 | 36 | 6 | 0 | 65 | 275 |
| 2022 | 7 | 13 | 24 | 8 | 0 | 52 | 210 |
| 2021 | 9 | 21 | 21 | 3 | 0 | 54 | 158 |
| 2020 | 6 | 17 | 21 | 7 | 0 | 51 | 104 |
| 2019 | 4 | 10 | 8 | 0 | 0 | 22 | 53 |
| 2018 | 1 | 6 | 9 | 0 | 0 | 16 | 31 |
| 2017 | 2 | 4 | 7 | 0 | 0 | 13 | 15 |
| 2016 | 0 | 0 | 0 | 0 | 0 | 0 | 2 |
| 2015 | 0 | 0 | 0 | 0 | 0 | 0 | 2 |
| 2014 | 0 | 0 | 1 | 0 | 0 | 1 | 2 |
| 2013 | 0 | 1 | 0 | 0 | 0 | 1 | 1 |
| Title | ||
|---|---|---|
| CVE-2026-66986 | HCL AION is affected by multiple security vulnerabilities.HCL Software · HCL AION | Low3.3 |
| CVE-2026-84155 | Session Token Remains Valid After Logout in Multi-Worker DeploymentsEricsson · CodeChecker | Medium5.3 |
| CVE-2026-82907 | Apache OFBiz: externalLoginKey honoured pre-auth, reusable and unboundApache Software Foundation · Apache OFBiz | Critical9.8 |
| CVE-2026-54375 | VitaFit Android < 2.8.1.0 Long-Lived Session Token ExposureShenzhen Shine Industrial Co., Ltd. · VitaFit | High8.6 |
| CVE-2026-121735 | blueprintUE Self-Hosted Edition before 4.3.4 Non-Expiring Account Confirmation Tokensblueprintue · blueprintue-self-hosted-edition | Medium6.3 |
| CVE-2024-9517 | Improper Token Renewal in Refresh Token Grant in Multiple WSO2 Products Allows Unauthorized Access to Blocked AccountsWSO2 · WSO2 API Manager | Medium4.9 |
| CVE-2026-120340 | mathurvishal CloudClassroom-PHP-Project Global Session session expirationmathurvishal · CloudClassroom-PHP-Project | Medium6.3 |
| CVE-2026-82559 | Apache Wicket: WebSocket messages are processed against an HTTP session snapshot that survives invalidationApache Software Foundation · Apache Wicket | Low2.3 |
| CVE-2026-63400 | Coop sessions are not invalidated on password resetroostorg · coop | Low2.3 |
| CVE-2026-116251 | pgAdmin 4: A user's other sessions survive a change of their passwordpgadmin.org · pgAdmin 4 | Low2.3 |
| CVE-2026-119577 | ArcadeDB before 26.10.2 Improper Session Revocation in Wire-Protocol ConnectionsArcadeData · arcadedb | High7.6 |
| CVE-2025-49602 | An issue was discovered in Keyfactor EJBCA 9. When an administrator is removed from its administrator role while having a valid TLS session, EJBCA may, in… | Critical9.8 |
| CVE-2026-118665 | GraphQL Tools: Per-request connection parameters persist into later users' WebSocket authenticationsardatan · graphql-tools | High8.2 |
| CVE-2026-6647 | Incomplete OAuth Token Revocation via Case Mismatch in WSO2 Identity Server Allows Continued Access After Lifecycle EventsWSO2 · WSO2 Identity Server | High7.4 |
| CVE-2026-3583 | Improper Token Revocation via OAuth2 Scope Enforcement in Multiple WSO2 Products [Disrupted Authentication Flows]WSO2 · WSO2 API Manager | Low3.1 |
| CVE-2026-117499 | @fastify/session vulnerable to session revocation bypass via a logout race condition@fastify/session · @fastify/session | Low3.7 |
| CVE-2026-116894 | REDAXO before 5.21.5 Insufficient Session Expiration on Password Changeredaxo · core | Low2.3 |
| CVE-2026-107146 | Insufficient session expiration in twofactor_gauthenticatoralexandregz · twofactor_gauthenticator | Medium6.3 |
| CVE-2026-95663 | Apache Camel: Camel-Keycloak Security Policy Accepts Expired Access Tokens Because Cached Token Introspection Results Are Not Bounded by the Token ExpiryApache Software Foundation · Apache Camel | Medium4.8 |
| CVE-2026-96616 | Kiloview E3 NDI Encoder Insufficient Session ExpirationKiloview · E3 Firmware | High8.3 |
| CVE-2026-115362 | OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Expired AppRole SecretID Authentication Bypassopenbao · openbao | Low2.1 |
| CVE-2026-115356 | OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Kubernetes Auth Method Token Renewal After Revocationopenbao · openbao | Medium5.3 |
| CVE-2026-54238 | Supabase Realtime: Expired JWTs with string exp are accepted by REST broadcast authorizationsupabase · realtime | Low3.1 |
| CVE-2026-114137 | Django REST framework: TokenProxy.delete() reports success and revokes nothingencode · django-rest-framework | High7.4 |
| CVE-2026-89035 | MikroTik RouterOS 7.24.5 WebFig Session Token Replay Authentication BypassMikroTik · RouterOS | Critical9.1 |
| CVE-2025-0326 | Improper Token Revocation in WSO2 Identity Server Allows Unauthorized AccessWSO2 · WSO2 Identity Server | High7.4 |
| CVE-2025-36069 | TS4500 Tape Library Insufficient Session ExpirationIBM · Storage TS4500 Library | Medium5.5 |
| CVE-2025-36252 | TS4500 Tape Library Insufficient Session ExpirationIBM · Storage TS4500 Library | Medium6.3 |
| CVE-2025-13173 | Improper Token Revocation via Session-Bound Token Flow in Multiple WSO2 Products Allows Unauthorized Access After Session TerminationWSO2 · WSO2 API Control Plane | Medium6.5 |
| CVE-2026-12254 | Netskope Client Captive Portal WebView Persistence allowing SWG bypass issueNetskope Inc. · Netskope Client | Medium6.4 |
| CVE-2026-110008 | @fastify/oauth2 vulnerable to Login CSRF via OAuth state cookie not cleared after callback@fastify/oauth2 · @fastify/oauth2 | Medium4.2 |
| CVE-2026-79624 | Apache Answer: Stale Visit Tokens Retain Access to Private Uploads After Session RevocationApache Software Foundation · Apache Answer | Critical9.8 |
| CVE-2026-110024 | @fastify/jwt vulnerable to missing token expiration when per-call options drop global defaults@fastify/jwt · @fastify/jwt | Medium6.8 |
| CVE-2026-111919 | Vikunja 0.22.0 before 2.7.0 Improper Access Revocation via Webhooksgo-vikunja · vikunja | High7.1 |
| CVE-2026-111917 | Vikunja 2.3.0 before 2.7.0 WebSocket Authentication Ignores Session Revocationgo-vikunja · vikunja | High7.1 |
| CVE-2025-71435 | Coder before 2.23.0 Session Expiration Bypass via OIDC Without Refresh Tokencoder · coder | Low2.3 |
| CVE-2026-96806 | Apache Airflow Keycloak provider: Keycloak auth manager: logout does not invalidate the session — JWTMiddleware mints an unrevoked replacement tokenApache Software Foundation · Apache Airflow Keycloak provider | Medium5.8 |
| CVE-2026-57493 | FileRise: Remember-me auto-login uses stale admin role from token instead of current roleerror311 · FileRise | Medium6.8 |
| CVE-2026-89073 | MOVEit Transfer Access restriction bypass in OAuth authenticationProgress · MOVEit Transfer | High7.5 |
| CVE-2026-107371 | Missing Verification of auth_time Claim in auth0.jsAuth0 · auth0.js | Medium5.4 |
| CVE-2026-74037 | Wazuh 4.0.0 before 4.14.8 Session Invalidation Bypass in check_tokenWazuh · wazuh-manager | High8.6 |
| CVE-2026-84321 | Nginx UI: Standalone short tokens survive administrative revocation in cache and authenticate again after account re-enable0xJacky · nginx-ui | Medium5.4 |
| CVE-2026-109362 | Heym v0.0.5 before v0.0.113 Broken Access Control via Workflow Execution Tokensheymrun · heym | Medium5.3 |
| CVE-2026-109320 | Grav API Plugin before 1.0.36 Disabled Account Session Access Bypassgetgrav · grav-plugin-api | Medium5.3 |
| CVE-2026-109289 | Open WebUI 0.8.8 before 0.11.4 Improper Session Revocation via Terminal WebSocketopen-webui · open-webui | Medium5.3 |
| CVE-2026-78357 | Insufficient Session Revocation for JWT AuthenticationOTRS GmbH (former OTRS AG) · OTRS | Critical9.1 |
| CVE-2026-108809 | Eleveo Call Recording Software logout session expirationEleveo · Call Recording Software | Medium5.1 |
| CVE-2026-108803 | y_project RuoYi Disable API add changeStatus session expirationy_project · RuoYi | Medium5.3 |
| CVE-2026-108785 | macrozheng mall JwtAuthenticationTokenFilter refreshToken JwtTokenUtil.refreshHeadToken session expirationmacrozheng · mall | Medium5.3 |
| CVE-2026-104084 | SmarterMail < Build 9777 Stale JWT Role Claim Privilege Escalation via Refresh TokenSmartertools · Smartermail | High8.7 |