Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 2 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,804All CVEsplus 19,141 rejected
- 515Last 24 hours3,084 in the last 7 days
- 17,030Last 30 days1,596 of them critical
- 1,769Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 0 | 3 | 3 | 0 | 0 | 6 | 14 |
| 2025 | 0 | 3 | 0 | 0 | 0 | 3 | 8 |
| 2024 | 0 | 0 | 2 | 0 | 0 | 2 | 5 |
| 2023 | 0 | 0 | 0 | 0 | 0 | 0 | 3 |
| 2022 | 0 | 1 | 1 | 0 | 0 | 2 | 3 |
| 2021 | 0 | 0 | 1 | 0 | 0 | 1 | 1 |
| Title | ||
|---|---|---|
| CVE-2026-77912 | Stored cross-site scripting vulnerability in GitHub Enterprise Server allowed HTML attribute injection via the Markdown rendering pipelineGitHub · Enterprise Server | High7.4 |
| CVE-2026-54163 | secure_headers: CSP directive injection via sandbox, plugin_types, and report_to when given untrusted inputPublic exploitgithub · secure_headers | Medium4.7 |
| CVE-2026-10585 | Stored cross-site scripting vulnerability in GitHub Enterprise Server allowed arbitrary JavaScript execution via crafted Discussion titles in the Q&A categoryGitHub · Enterprise Server | Medium6.3 |
| CVE-2026-8106 | Reflected HTML injection vulnerability in GitHub Enterprise Server Management Console login page allowed credential theftGitHub · Enterprise Server | Medium5.9 |
| CVE-2026-2266 | Improper neutralization of input vulnerability was identified in GitHub Enterprise Server that allowed cross-site scripting via task list content and enabled arbitrary HTML injectionGitHub · Enterprise Server | High7.4 |
| CVE-2025-13744 | Improper Neutralization of Input During Web Page Generation vulnerability was identified in GitHub Enterprise Server that allowed rendering of malicious HTMLGitHub · Enterprise Server | High8.4 |
| CVE-2025-14046 | Insufficient HTML Sanitization Allows User-Controlled DOM Elements to Overwrite Server-Initialized Data Islands and Trigger Unintended Server-Side POST RequestsGitHub · Enterprise Server | High8.6 |
| CVE-2025-11892 | DOM-based Cross-Site Scripting was identified in GitHub Enterprise Server Issues search allows privilege escalation and unauthorized workflow triggersGitHub · Enterprise Server | High8.6 |
| CVE-2025-3246 | Markdown math block sanitization bypass allows privilege escalation and unauthorized workflow triggersGitHub · GitHub Enterprise Server | High8.6 |
| CVE-2024-8770 | A Cross-Site Scripting (XSS) vulnerability was identified in the repository transfer feature of GitHub Enterprise Server, which allows attackers to steal…GitHub · GitHub Enterprise Server | Medium5.8 |
| CVE-2024-1084 | Cross-site Scripting in the tag name pattern field in the tag protections UI in GitHub Enterprise Server allows a malicious website that requires user…GitHub · Enterprise Server | Medium6.5 |
| CVE-2022-23733 | Stored XSS vulnerability in GitHub Enterprise Server leading to injection of arbitrary attributesGitHub · GitHub Enterprise Server | Medium5.4 |
| CVE-2022-24722 | Cross-site Scripting in view_componentgithub · view_component | High8.1 |
| CVE-2021-37700 | Clipboard-based DOM-XSSgithub · paste-markdown | Medium6.5 |