Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 1 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,764All CVEsplus 19,141 rejected
- 677Last 24 hours3,064 in the last 7 days
- 17,175Last 30 days1,610 of them critical
- 1,769Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 7 | 18 | 28 | 2 | 0 | 55 | 193 |
| 2025 | 2 | 2 | 5 | 1 | 0 | 10 | 138 |
| 2024 | 3 | 5 | 11 | 2 | 0 | 21 | 128 |
| 2023 | 3 | 16 | 20 | 2 | 0 | 41 | 107 |
| 2022 | 1 | 4 | 17 | 0 | 0 | 22 | 66 |
| 2021 | 4 | 13 | 8 | 0 | 0 | 25 | 44 |
| 2020 | 1 | 11 | 2 | 1 | 0 | 15 | 19 |
| 2019 | 0 | 0 | 0 | 0 | 0 | 0 | 4 |
| 2018 | 0 | 0 | 1 | 0 | 0 | 1 | 4 |
| 2017 | 0 | 1 | 0 | 0 | 0 | 1 | 3 |
| 2016 | 0 | 0 | 0 | 0 | 0 | 0 | 2 |
| 2015 | 0 | 0 | 0 | 0 | 0 | 0 | 2 |
| 2014 | 0 | 0 | 0 | 0 | 0 | 0 | 2 |
| 2013 | 0 | 0 | 0 | 0 | 0 | 0 | 2 |
| 2012 | 0 | 0 | 0 | 0 | 0 | 0 | 2 |
| 2011 | 0 | 0 | 1 | 0 | 0 | 1 | 2 |
| 2010 | 0 | 0 | 0 | 0 | 0 | 0 | 1 |
| 2009 | 0 | 0 | 0 | 0 | 0 | 0 | 1 |
| 2008 | 0 | 0 | 0 | 0 | 0 | 0 | 1 |
| 2007 | 0 | 0 | 0 | 0 | 0 | 0 | 1 |
| 2006 | 0 | 0 | 0 | 0 | 0 | 0 | 1 |
| 2005 | 0 | 1 | 0 | 0 | 0 | 1 | 1 |
| Title | ||
|---|---|---|
| CVE-2026-115732 | Certificate Name Authorization BypassPerforce · Puppet Enterprise | Critical9.0 |
| CVE-2026-104198 | ZoneMinder failed token handling bypasses web authenticationZoneMinder · zoneminder | Medium5.3 |
| CVE-2026-108969 | itsmeravitejak Online-Examination-System Session session.php checkLogin comparisonitsmeravitejak · Online-Examination-System | Medium6.9 |
| CVE-2026-106252 | Incorrect comparison in Fonts in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a…Google · Chrome | High8.8 |
| CVE-2026-71892 | CMS key-transport recipient key-size validation never runs for RFC 9709 HKDF-derived keysLegion of the Bouncy Castle Inc. · BC-JAVA | Medium6.9 |
| CVE-2026-102715 | mDNS string-cache lookup matches on slot size, so a peer name aliases a shorter one and the response encoder writes past the packetEclipse Foundation · Eclipse ThreadX NetX Duo | High7.1 |
| CVE-2026-101913 | ip-address: Address6.isLinkLocal() recognizes fe80::/64 rather than fe80::/10, allowing SSRF and trust-boundary bypass to on-link hostsbeaugunderson · ip-address | Medium6.3 |
| CVE-2026-101912 | ip-address: isInSubnet() and isHostInSubnet() compare addresses of different families as if they shared an address space, allowing an allowlist check to admit an address outside its rangebeaugunderson · ip-address | Medium6.3 |
| CVE-2026-85292 | InvoicePlane: Loose Type Comparison in Core Authentication Check (Defense-in-Depth)InvoicePlane · InvoicePlane | Medium4.8 |
| CVE-2026-79913 | Cloudreve: SSRF guard bypass: checkIP does not decode IPv6-transition wrappers (NAT64, IPv4-compatible, 6to4) reaching internal and cloud-metadata addressescloudreve · cloudreve | Medium6.5 |
| CVE-2026-93957 | olivier-ls PHP-FTS Filter Matching SearchEngine.php matchesSingleFilter comparisonolivier-ls · PHP-FTS | Medium5.3 |
| CVE-2026-71855 | Suricata flow: IPv4/IPv6 hash collision can reuse wrong flow stateOISF · suricata | Medium5.9 |
| CVE-2026-57222 | Suricata ippair: hash collision can cause incorrect state reuse across IPv4 and IPv6OISF · suricata | Medium5.3 |
| CVE-2026-61795 | Capsule: hostnameRegexHandler.OnUpdate validates stale (old) Tenant regex, allowing invalid AllowedHostnames regex to bypass webhook validationprojectcapsule · capsule | Medium6.8 |
| CVE-2026-61672 | Capsule: Tenant owner bypasses Capsule's forbidden namespace/service/node label and annotation enforcementprojectcapsule · capsule | High7.1 |
| CVE-2026-90977 | Clean Login < 1.19 - Unauthenticated CAPTCHA Bypass via Empty Session ComparisonUnknown · Clean Login | Medium5.3 |
| CVE-2026-20333 | Cisco Secure Adaptive Security Appliance Software, Secure Firewall Threat Defense Software and Secure Firewall Management Center Software Hardening Release - Incorrect Comparison VulnerabilitiesCisco · Cisco Secure Firewall Adaptive Security Appliance (ASA) Software | High8.8 |
| CVE-2026-92395 | @fastify/proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet@fastify/proxy-addr · @fastify/proxy-addr | Critical9.1 |
| CVE-2026-92087 | @fastify/auth vulnerable to Authorization Bypass via order-dependent evaluation of composed auth@fastify/auth · @fastify/auth | High8.1 |
| CVE-2026-91997 | evolution-api through 2.3.7 Prometheus Metrics IP Allowlist Bypassevolution-foundation · evolution-api | Medium6.9 |
| CVE-2026-91851 | MISP Dashboard Template ACL Bypass Due to VARCHAR-to-Integer Type Coercion in Permission Flag ComparisonMISP · MISP | Medium5.3 |
| CVE-2026-90711 | proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnetproxy-addr · proxy-addr | Critical9.1 |
| CVE-2026-49846 | libks has path traversal in kws HTTP parser via URI segment overflowsignalwire · libks | High7.5 |
| CVE-2026-64836 | ICEcoder through 8.1 Path Traversal via Ineffective File::check() ConfinementICEcoder · ICEcoder | High8.7 |
| CVE-2026-56101 | OpenBSD ieee80211_crypto_tkip.c TKIP MIC Countermeasure Logic Inversion DoSOpenBSD · OpenBSD | Medium6.0 |
| CVE-2026-73309 | XenForo < 2.3.13 Authentication Bypass via OAuth2 Token EndpointXenForo · XenForo | Critical9.1 |
| CVE-2026-80227 | SQL string_trim removes only spaces, diverging from in-memory trimming in AshSqlash-project · ash_sql | Low2.1 |
| CVE-2026-18664 | Wrong interpretation of ACL rangesNLnet Labs · NSD | High8.2 |
| CVE-2026-73258 | Mongoose: Multipart boundary/header scan logic error in mg_http_next_multipartcesanta · mongoose | Medium6.5 |
| CVE-2026-75110 | MemOS Authentication Bypass via Unset INTERNAL_SERVICE_SECRETMemTensor · MemOS | Critical9.3 |
| CVE-2026-50029 | js-toml has silent type confusion via falsy-primitive duplicate-key bypasssunnyadn · js-toml | Medium5.3 |
| CVE-2026-20765 | Incorrect comparison for some Intel(R) TDX Guest software before version 0.3.1 within Ring 3: User Applications may allow an escalation of privilege. System…Intel(R) TDX Guest software | Medium4.6 |
| CVE-2026-67207 | Wolf CMS 0.8.3.1 Authorization Bypass via BackupRestoreControllerwolfcms · wolfcms | High8.7 |
| CVE-2026-48032 | Hulumi: IAM-role policy checks bypassed when the role trusts multiple OIDC providerskerberosmansour · hulumi | High8.3 |
| CVE-2026-65903 | DOMPurify before 3.4.0 ADD_TAGS Function Bypasses FORBID_TAGScure53 · DOMPurify | Medium5.1 |
| CVE-2026-55771 | CedarJava has policy injection, type confusion, and incorrect equality comparison vulnerabilitiescedar-policy · cedar-java | High8.8 |
| CVE-2026-22660 | FlaskBB Logic Flaw Authorization Group Deletion via Bulk AJAX Endpointflaskbb · flaskbb | High8.6 |
| CVE-2026-59890 | setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) on macOS APFS/HFS+pypa · setuptools | Medium6.1 |
| CVE-2026-14687 | 666ghj BettaFish InsightEngine search-result Deduplication agent.py _deduplicate_results partial string comparison666ghj · BettaFish | Medium6.9 |
| CVE-2026-14686 | HdrHistogram Range Check DoubleHistogram.java org.HdrHistogram.DoubleHistogram.recordValue comparisonHdrHistogram | Medium4.8 |
| CVE-2026-14617 | NousResearch hermes-agent Streaming Reasoning Tag Filter stream_consumer.py GatewayStreamConsumer._filter_and_accumulate case sensitivityNousResearch · hermes-agent | Low2.3 |
| CVE-2026-10097 | ML-KEM-1024 x64 AVX2 incomplete cipher text comparison enables IND-CCA2 break and static private-key recoverywolfSSL · wolfSSL | High8.3 |
| CVE-2026-49340 | gonic has arbitrary file write in createPlaylist: any authenticated user can write playlist M3U content to attacker-controlled path on the hostsentriz · gonic | High8.1 |
| CVE-2026-44249 | Netty has an IPv6 Subnet Filter Bypass via Incorrect Comparator Maskingnetty · netty | High8.1 |
| CVE-2026-45569 | Roxy-WI: Path-traversal patch in commit d4d10006 is a no-op (tuple-membership bug)roxy-wi · roxy-wi | High8.1 |
| CVE-2026-45567 | Roxy-WI: Authentication bypass via 'api' substring in URL + unauthenticated /api/gptroxy-wi · roxy-wi | High8.3 |
| CVE-2026-47202 | Kavita: Pre-Auth Account TakeoverKareadita · Kavita | Critical9.3 |
| CVE-2026-9369 | NousResearch hermes-agent CLI web-dashboard web_server.py _discover_dashboard_plugins comparisonNousResearch · hermes-agent | Medium4.8 |
| CVE-2026-44196 | Pingvin Share X: TOTP Authentication Bypass via Password-only Loginsmp46 · pingvin-share-x | Critical9.1 |
| CVE-2026-35040 | fast-jwt: Stateful RegExp (/g or /y) causes non-deterministic allowed-claim validation (logical DoS)nearform · fast-jwt | Medium5.3 |