Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 5 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,955All CVEsplus 19,141 rejected
- 330Last 24 hours3,207 in the last 7 days
- 17,019Last 30 days1,575 of them critical
- 1,769Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 19 | 15 | 15 | 2 | 2 | 53 | 95 |
| 2025 | 2 | 9 | 14 | 3 | 0 | 28 | 42 |
| 2024 | 1 | 3 | 6 | 1 | 0 | 11 | 14 |
| 2023 | 0 | 1 | 2 | 0 | 0 | 3 | 3 |
| Title | ||
|---|---|---|
| CVE-2026-80301 | Avast sandbox escape via unpreserved COM pathway through Task SchedulerGen Digital · Avast Antivirus, Avast One, Avast Premium Security, Avast Ultimate | Not scored |
| CVE-2026-80302 | Avast sandbox escape via arbitrary file write in virtualized environmentGen Digital · Avast Antivirus, Avast One, Avast Premium Security, Avast Ultimate | Not scored |
| CVE-2026-113687 | Apache Syncope: RCE via ProcessGroovyMethodsSandbox bypassApache Software Foundation · Apache Syncope | Critical9.8 |
| CVE-2026-109083 | Apache Syncope: Remote Code Execution via Flowable JUEL expressionApache Software Foundation · Apache Syncope | Critical9.8 |
| CVE-2026-120306 | Beta9 build sandbox escape via chroot-only isolationbeam-cloud · Beta9 worker | Critical9.9 |
| CVE-2026-119408 | n8n before 2.42.6, 2.43.3 and 3.0.1 Code Execution Outside Task Runner Isolation via Deprecated Function NodesPublic exploitn8n-io · n8n | High8.7 |
| CVE-2026-115517 | Unrestricted network access between execution contexts in KNIME Business HubKNIME · KNIME Business Hub | Medium6.4 |
| CVE-2026-115416 | Incorrect authorization checks in Amazon Athena engine version 3 query processingAWS · Amazon Athena | Medium6.3 |
| CVE-2026-114087 | Trigger.dev before 4.5.6 Authentication Bypass via Hardcoded Default SecretsPublic exploittriggerdotdev · trigger.dev | Critical9.2 |
| CVE-2026-109443 | JoySafeter through 1.0.0 Authenticated RCE via Copilot Standard Mode ShellPublic exploitjd-opensource · JoySafeter | High8.7 |
| CVE-2026-109441 | LangAlpha through 2026.09.07 Cross-Tenant Sandbox Exposure via Shared Docker BridgePublic exploitginlix-ai · LangAlpha | Medium6.9 |
| CVE-2026-34009 | **Container Escape** Host user home directory mounted with write access into application containerQNAP Systems Inc. · Notes Station 3 | High8.4 |
| CVE-2026-108263 | Astron Agent: Unsandboxed code-node leads to cross-tenant RCEiflytek · astron-agent | Critical9.9 |
| CVE-2026-20032 | Cisco NX-OS Software Python Sandbox Escape VulnerabilityCisco · Cisco NX-OS Software | Medium4.4 |
| CVE-2026-106588 | In sshd in OpenSSH through 10.6, use of the macOS 27 (or later) SDK has the side effect of loss of sandboxing, which is potentially unexpected.OpenBSD · OpenSSH | Low3.1 |
| CVE-2026-105643 | Ghost: Stored XSS via Embed Card PreviewsPublic exploitTryGhost · Ghost | High7.3 |
| CVE-2026-102125 | Kiteworks Core Sandbox EscapeKiteworks · Core | High8.8 |
| CVE-2026-97029 | Flatpak: flatpak: sandboxed app can signal unsandboxed processes in the same process groupRed Hat · Red Hat Enterprise Linux 10 | Medium5.7 |
| CVE-2026-101078 | deepseek-ai deepseek-harness Landlock Backend profiles.ts isolationPublic exploitdeepseek-ai · deepseek-harness | Medium4.8 |
| CVE-2026-95699 | MrSteam iSteamX Improper Isolation or CompartmentalizationMrSteam · iSteamX application | High8.4 |
| CVE-2026-82964 | Avast sandbox privilege escalation via unpreserved DACLs on virtualized files in aswSnx.sysPublic exploitGen Digital · Avast Free Antivirus, Avast One, Avast Premium Security, Avast Ultimate, Avast Business Security | High8.8 |
| CVE-2026-57135 | PraisonAI SandboxExecutor network-isolated mode does not block non-proxy-aware network clientsPublic exploitMervinPraison · PraisonAI | High7.6 |
| CVE-2026-15366 | A control logic defect in a specific built-in webpage of Kids Mode allows users to view local gallery photos directly within the pagevivo · Kids Mode | Low2.4 |
| CVE-2026-71325 | Traefik: `allowCrossNamespace=false` bypass via `@kubernetescrd` TraefikService backendReftraefik · traefik | Medium4.8 |
| CVE-2026-62246 | Kamaji: TenantControlPlane namespace/name collision binds two tenants to the same SQL datastore schema + DB user, breaking per-tenant isolationPublic exploitclastix · kamaji | High8.5 |
| CVE-2026-65635 | Boruta dynamic client registration allows creation of over-privileged OAuth clientsPublic exploitmalach-it · boruta | High8.3 |
| CVE-2026-53421 | Apache Syncope: Remote Code Execution via Scripted ConnectorApache Software Foundation · Apache Syncope | Critical9.8 |
| CVE-2026-53405 | Apache Syncope: Remote Code Execution via Flowable BPMN Groovy ScriptTaskApache Software Foundation · Apache Syncope | Critical9.8 |
| CVE-2026-63071 | Apache Syncope: RCE via Groovy Sandbox bypassApache Software Foundation · Apache Syncope | Critical9.8 |
| CVE-2026-15738 | Cross-namespace traffic interception via incorrect route precedence ordering in AWS Load Balancer ControllerAmazon · aws-load-balancer-controller | Medium5.8 |
| CVE-2026-12297 | Sandbox escape due to incorrect boundary conditions in the Networking componentMozilla · Firefox | Critical9.6 |
| CVE-2026-12295 | Sandbox escape in the DOM: Navigation componentMozilla · Firefox | Critical9.6 |
| CVE-2026-41155 | GPU DDK - SharedSecMem mapped into all GPU virtual address spacesImagination Technologies · Graphics DDK | Medium5.5 |
| CVE-2026-42782 | Apache Syncope: Post-auth RCE via Groovy staticApache Software Foundation · Apache Syncope | High7.2 |
| CVE-2026-8945 | Sandbox escape in Firefox and Firefox Focus for AndroidMozilla · Firefox | High7.5 |
| CVE-2026-44005 | vm2: Sandbox escapePublic exploitpatriksimek · vm2 | Critical10.0 |
| CVE-2026-44009 | vm2: Sandbox Breakout Through Null Proto ExceptionPublic exploitpatriksimek · vm2 | Critical9.8 |
| CVE-2026-43997 | vm2: Sandbox EscapePublic exploitpatriksimek · vm2 | Critical10.0 |
| CVE-2026-8401 | Sandbox escape in the Profile Backup componentMozilla · Firefox | Critical9.8 |
| CVE-2026-26956 | vm2: WASM Sandbox Escape (Node 25 only)Public exploitpatriksimek · vm2 | Critical9.8 |
| CVE-2026-26332 | vm2: Sandbox EscapePublic exploitpatriksimek · vm2 | Critical9.8 |
| CVE-2026-24781 | vm2: Sandbox Breakout Through InspectPublic exploitpatriksimek · vm2 | Critical9.8 |
| CVE-2026-41174 | Traefik Kubernetes CRD allows unauthorized cross-namespace middleware bindingtraefik · traefik | Medium4.8 |
| CVE-2026-40968 | Spring gRPC SecurityContext leaks across requests on authorization failureSpring · Spring gRPC | Medium4.3 |
| CVE-2026-5600 | A new API endpoint introduced in pretix 2025 that is supposed to return all check-in events of a specific event in fact returns all check-in events belonging…pretix · pretix | Medium5.5 |
| CVE-2026-5599 | API allows deletion of users of other instancepretix · Venueless | High7.3 |
| CVE-2026-34775 | Electron: nodeIntegrationInWorker not correctly scoped in shared renderer processeselectron · electron | Medium6.8 |
| CVE-2026-4325 | Keycloak: keycloak: replay of action tokens via improper handling of single-use entriesRed Hat · Red Hat build of Keycloak 26.2 | Medium5.3 |
| CVE-2026-4282 | Keycloak: keycloak: privilege escalation via forged authorization codes due to singleuseobjectprovider isolation flawRed Hat · Red Hat build of Keycloak 26.2 | High7.4 |
| CVE-2025-12805 | Llama-stack-k8s-operator: llama stack service exposed across namespaces due to missing networkpolicyRed Hat · Red Hat OpenShift AI 2.25 | High8.1 |