Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 2 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,792All CVEsplus 19,141 rejected
- 649Last 24 hours3,087 in the last 7 days
- 17,142Last 30 days1,603 of them critical
- 1,769Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 1 | 3 | 1 | 0 | 0 | 5 | 36 |
| 2025 | 2 | 0 | 1 | 0 | 0 | 3 | 31 |
| 2024 | 3 | 8 | 4 | 0 | 0 | 15 | 28 |
| 2023 | 2 | 4 | 0 | 0 | 0 | 6 | 13 |
| 2022 | 1 | 0 | 2 | 0 | 0 | 3 | 7 |
| 2021 | 2 | 1 | 0 | 0 | 0 | 3 | 4 |
| 2020 | 0 | 0 | 0 | 0 | 0 | 0 | 1 |
| 2019 | 0 | 0 | 0 | 0 | 0 | 0 | 1 |
| 2018 | 0 | 0 | 0 | 0 | 0 | 0 | 1 |
| 2017 | 0 | 0 | 0 | 1 | 0 | 1 | 1 |
| Title | ||
|---|---|---|
| CVE-2024-58362 | SurrealDB before 1.5.5 Query Injection via RPC APIsurrealdb · surrealdb | High8.7 |
| CVE-2026-54771 | Langroid: handle_message() executes user-supplied tool JSON without sender verificationlangroid · langroid | High8.1 |
| CVE-2026-31908 | Apache APISIX: forward auth plugin allows header injectionApache Software Foundation · Apache APISIX | Critical9.1 |
| CVE-2026-29042 | Nuclio Shell Runtime Command Injection Leading to Privilege Escalationnuclio · nuclio | High8.9 |
| CVE-2026-27120 | Leaf-kit html escaping does not work on characters that are part of extended grapheme clustervapor · leaf-kit | Medium6.1 |
| CVE-2024-27708 | Iframe injection vulnerability in airc.pt/solucoes-servicos.solucoes MyNET v.26.06 and before allows a remote attacker to execute arbitrary code via the src… | Critical9.6 |
| CVE-2025-61911 | python-ldap has sanitization bypass in ldap.filter.escape_filter_charspython-ldap · python-ldap | Medium5.5 |
| CVE-2025-50213 | Apache Airflow Providers Snowflake: Potential SQL injection in CopyFromExternalStageToSnowflakeOperatorApache Software Foundation · Apache Airflow Providers Snowflake | Critical9.8 |
| CVE-2024-9940 | Calculated Fields Form <= 5.2.45 - HTML Injectioncodepeople · Calculated Fields Form | Medium5.3 |
| CVE-2024-37779 | WoodWing Elvis DAM v6.98.1 was discovered to contain an authenticated remote command execution (RCE) vulnerability via the Apache Ant script functionality. | High8.8 |
| CVE-2024-39227 | GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16,… | Critical9.8 |
| CVE-2024-24257 | An issue in skteco.com Central Control Attendance Machine web management platform v.3.0 allows an attacker to obtain sensitive information via a crafted script… | High7.5 |
| CVE-2024-39243 | An issue discovered in skycaiji 2.8 allows attackers to run arbitrary code via crafted POST request to /index.php?s=/admin/develop/editor_save. | Critical9.8 |
| CVE-2024-35373 | Mocodo Mocodo Online 4.2.6 and below is vulnerable to Remote Code Execution via /web/rewrite.php. | Critical9.8 |
| CVE-2024-31812 | In TOTOLINK EX200 V4.0.3c.7646_B20201211, an attacker can obtain sensitive information without authorization through the function getWiFiExtenderConfig. | Medium6.5 |
| CVE-2024-31809 | TOTOLINK EX200 V4.0.3c.7646_B20201211 was discovered to contain a remote code execution (RCE) vulnerability via the FileName parameter in the setUpgradeFW… | High8.8 |
| CVE-2024-31806 | TOTOLINK EX200 V4.0.3c.7646_B20201211 was discovered to contain a Denial-of-Service (DoS) vulnerability in the RebootSystem function which can reboot the… | Medium6.5 |
| CVE-2024-21503 | Versions of the package black before 24.3.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the lines_with_leading_tabs_expanded function in…black | Medium5.3 |
| CVE-2024-0801 | Unauthenticated DoS in Arcserve Unified Data ProtectionArcserve · Unified Data Protection | High7.5 |
| CVE-2024-0044 | In createSessionInternal of PackageInstallerService.java, there is a possible run-as any app due to improper input validation. This could lead to local…Google · Android | High7.8 |
| CVE-2024-23274 | An injection issue was addressed with improved input validation. This issue is fixed in macOS Monterey 12.7.4, macOS Sonoma 14.4, macOS Ventura 13.6.5. An app…Apple · macOS | High8.4 |
| CVE-2024-23268 | An injection issue was addressed with improved input validation. This issue is fixed in macOS Monterey 12.7.4, macOS Sonoma 14.4, macOS Ventura 13.6.5. An app…Apple · macOS | High8.4 |
| CVE-2024-27622 | A remote code execution vulnerability has been identified in the User Defined Tags module of CMS Made Simple version 2.2.19 / 2.2.21. This vulnerability arises… | High7.2 |
| CVE-2023-40743 | Apache Axis 1.x (EOL) may allow RCE when untrusted input is passed to getServiceApache Software Foundation · Apache Axis | Critical9.8 |
| CVE-2023-1758 | Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in thorsten/phpmyfaqthorsten · thorsten/phpmyfaq | High8.9 |
| CVE-2023-27533 | A vulnerability in input validation exists in curl <8.0 during communication using the TELNET protocol may allow an attacker to pass on maliciously crafted…https://github.com/curl/curl | Critical9.8 |
| CVE-2023-23912 | A vulnerability, found in EdgeRouters Version 2.0.9-hotfix.5 and earlier and UniFi Security Gateways (USG) Version 4.4.56 and earlier with their DHCPv6 prefix…Ubiquiti EdgeRouter(s) and USG(s) | High8.8 |
| CVE-2023-0302 | Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in radareorg/radare2radareorg · radareorg/radare2 | High8.6 |
| CVE-2022-48217 | The tf_remapper_node component 1.1.1 for Robot Operating System (ROS) allows attackers, who control the source code of a different node in the same ROS… | High8.1 |
| CVE-2022-4721 | Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in ikus060/rdiffwebikus060 · ikus060/rdiffweb | Medium6.6 |
| CVE-2022-3607 | Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in octoprint/octoprintoctoprint · octoprint/octoprint | Medium6.0 |
| CVE-2022-24039 | A vulnerability has been identified in Desigo PXC4 (All versions < V02.20.142.10-10884), Desigo PXC5 (All versions < V02.20.142.10-10884). The “addCell”…Siemens · Desigo PXC4 | Critical9.0 |
| CVE-2021-39174 | Configuration leakfiveai · Cachet | High8.8 |
| CVE-2021-22910 | A sanitization vulnerability exists in Rocket.Chat server versions <3.13.2, <3.12.4, <3.11.4 that allowed queries to an endpoint which could result in a NoSQL…Rocket.Chat server | Critical9.8 |
| CVE-2021-22911 | A improper input sanitization vulnerability exists in Rocket.Chat server 3.11, 3.12 & 3.13 that could lead to unauthenticated NoSQL injection, resulting…Rocket.Chat server | Critical9.8 |
| CVE-2016-9471 | Revive Adserver before 3.2.5 and 4.0.0 suffers from Special Element Injection. Usernames weren't properly sanitised when creating users on a Revive Adserver…Revive Adserver All versions before 3.2.5 and 4.0.0 | Low3.1 |