Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 7 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 400,161All CVEsplus 18,875 rejected
- 813Last 24 hours3,232 in the last 7 days
- 17,421Last 30 days1,567 of them critical
- 1,767Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 102 | 80 | 23 | 1 | 0 | 206 | 1,767 |
| 2025 | 85 | 87 | 24 | 1 | 0 | 197 | 1,561 |
| 2024 | 63 | 69 | 28 | 0 | 0 | 160 | 1,364 |
| 2023 | 51 | 89 | 24 | 2 | 0 | 166 | 1,204 |
| 2022 | 54 | 59 | 16 | 2 | 0 | 131 | 1,038 |
| 2021 | 70 | 113 | 31 | 1 | 0 | 215 | 907 |
| 2020 | 58 | 70 | 18 | 0 | 0 | 146 | 692 |
| 2019 | 48 | 73 | 8 | 0 | 0 | 129 | 546 |
| 2018 | 24 | 46 | 6 | 0 | 0 | 76 | 417 |
| 2017 | 25 | 59 | 5 | 0 | 0 | 89 | 341 |
| 2016 | 7 | 39 | 8 | 0 | 0 | 54 | 252 |
| 2015 | 8 | 36 | 3 | 0 | 0 | 47 | 198 |
| 2014 | 4 | 26 | 4 | 0 | 0 | 34 | 151 |
| 2013 | 6 | 23 | 4 | 2 | 0 | 35 | 117 |
| 2012 | 8 | 12 | 2 | 0 | 0 | 22 | 82 |
| 2011 | 2 | 6 | 1 | 0 | 0 | 9 | 60 |
| 2010 | 3 | 17 | 2 | 1 | 0 | 23 | 51 |
| 2009 | 1 | 12 | 1 | 0 | 0 | 14 | 28 |
| 2008 | 1 | 5 | 0 | 0 | 0 | 6 | 14 |
| 2007 | 1 | 1 | 0 | 0 | 0 | 2 | 8 |
| 2006 | 0 | 2 | 0 | 0 | 0 | 2 | 6 |
| 2005 | 1 | 0 | 1 | 0 | 0 | 2 | 4 |
| 2004 | 0 | 1 | 0 | 0 | 0 | 1 | 2 |
| 2003 | 0 | 1 | 0 | 0 | 0 | 1 | 1 |
| Title | ||
|---|---|---|
| CVE-2026-118527 | Use of predictable filenames in Ivanti Connect Secure before versions 25.1.1.3 and 22.8R2.6 allows a remote authenticated attacker to upload files with…ExploitedIvanti · Connect Secure | Medium4.3 |
| CVE-2026-119977 | WordPress Core 4.7.0 - 7.1.3 - Unauthenticated Upgrade-Window Staged-Installer Remote Code ExecutionExploitedWordPress Foundation · WordPress | High8.1 |
| CVE-2026-76418 | Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Tunnel Denial of Service VulnerabilityExploitedCisco · Cisco Secure Firewall Adaptive Security Appliance (ASA) Software | High8.6 |
| CVE-2026-114625 | Security Advisory 0199ExploitedArista Networks · VeloCloud Orchestrator | Critical9.4 |
| CVE-2026-111497 | Out-of-Bounds Write in Google Brotli DecoderExploitedGoogle · Brotli | Critical9.2 |
| CVE-2026-109619 | RCE via stale global stateExploitedPHP Group · PHP | Critical9.2 |
| CVE-2026-109618 | RCE via OOM corruptionExploitedPHP Group · PHP | Critical9.2 |
| CVE-2026-111357 | Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root,…ExploitedIvanti · Connect Secure | High7.0 |
| CVE-2026-102764 | Improper Origin Validation in Internal Messaging Components of BeyondTrust Remote SupportExploitedBeyondTrust · Remote Support | Critical9.3 |
| CVE-2026-110936 | A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8). The affected application loads dynamic-link libraries (DLLs) from an…ExploitedSiemens · Siemens Software Center | High8.4 |
| CVE-2026-0322 | PAN-OS: Authenticated Remote Code Execution (RCE) in the Management InterfaceExploitedPalo Alto Networks · Cloud NGFW | High8.6 |
| CVE-2026-76519 | Cisco Secure Email Gateway Arbitrary File Write VulnerabilityExploitedCisco · Cisco Secure Email | Critical9.8 |
| CVE-2026-106931 | SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with root or SYSTEM…ExploitedEG Secure Solutions Inc. · SiteGuard Server Edition for Apache httpd | High8.5 |
| CVE-2026-110447 | Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September…ExploitedCollabora · Collabora Online - Built-in CODE Server | Critical9.2 |
| CVE-2026-96951 | Windows Shell Security Feature Bypass VulnerabilityExploitedMicrosoft · Microsoft Edge (Chromium-based) | High8.8 |
| CVE-2026-104935 | Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact…ExploitedIvanti · Connect Secure | High8.6 |
| CVE-2026-97229 | Integer Overflow or Wraparound in GitLabExploitedGitLab · GitLab | Critical10.0 |
| CVE-2026-21589 | This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center.…ExploitedAtlassian · Bamboo Data Center | Critical9.3 |
| CVE-2026-105134 | Ahsay AhsayCBS Replication Receiver UpdateReceivers.do os command injectionExploitedAhsay · AhsayCBS | Critical10.0 |
| CVE-2026-105133 | Ahsay AhsayCBS API ApiStructsAction.java checkSysPwd improper authenticationExploitedAhsay · AhsayCBS | Medium6.9 |
| CVE-2026-88779 | Memory overflow vulnerability leading to Denial of ServiceExploitedNetScaler · ADC | High8.7 |
| CVE-2026-104286 | An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0…ExploitedFortinet · FortiMail | Critical9.8 |
| CVE-2026-102490 | Local privilege escalation in Zammad v1.5.0 to v7.2.2 installed via DEB or RPM packageExploitedZammad GmbH · Zammad | High8.5 |
| CVE-2026-102489 | Undisclosed RCE in Zammad v6.3 and higherExploitedZammad GmbH · Zammad | High8.7 |
| CVE-2026-76504 | Cisco Catalyst SD-WAN Manager System Account Authorization Bypass VulnerabilityExploitedCisco · Cisco Catalyst SD-WAN Manager | Critical9.8 |
| CVE-2026-86950 | An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.11 and iPadOS 18.7.11, iOS 26.7.1 and iPadOS 26.7.1,…ExploitedApple · iOS and iPadOS | High8.8 |
| CVE-2026-88772 | Memory overflow vulnerability leading to Remote Code Execution or Denial of ServiceExploitedCitrix NetScaler · ADC | Critical9.5 |
| CVE-2026-88771 | A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commandsExploitedCitrix NetScaler · ADC | Critical9.5 |
| CVE-2026-96656 | Plex Media Server arbitrary file writeExploitedPlex · Media Server | High8.6 |
| CVE-2026-96655 | Plex Media Server arbitrary-host SSRFExploitedPlex · Media Server | Medium5.3 |
| CVE-2026-96654 | Plex Media Server URL injectionExploitedPlex · Media Server | Medium6.9 |
| CVE-2026-96652 | Plex Media Server SSRFExploitedPlex · Media Server | Medium5.3 |
| CVE-2026-87902 | An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme…ExploitedWordPress · WordPress | High8.1 |
| CVE-2026-94127 | BIG-IP APM OAuth vulnerabilityExploitedF5 · BIG-IP | Critical9.3 |
| CVE-2026-93616 | Directory Traversal and File upload allows execution of arbitrary script on the Management ServerExploitedcheckpoint · Quantum Security Management | Critical9.8 |
| CVE-2026-93952 | Security Advisory 0183ExploitedArista Networks · VeloCloud Orchestrator (VCO) On-Prem | Critical9.5 |
| CVE-2026-87886 | Local privilege escalation due to insecure file permissions. The following products are affected: Acronis Backup plugin for cPanel & WHM (Linux) before build…ExploitedAcronis · Acronis Backup plugin for cPanel & WHM | High7.8 |
| CVE-2026-76460 | Cisco Identity Services Engine Authentication Bypass VulnerabilityExploitedCisco · Cisco Identity Services Engine Software | Critical10.0 |
| CVE-2026-58704 | In Cellular Modem, there is a possible permission bypass due to a logic error in the code. This could lead to remote (proximal/adjacent) escalation of…ExploitedGoogle · Android | High8.8 |
| CVE-2026-76461 | Cisco Secure Email Gateway SQL Injection VulnerabilityExploitedCisco · Cisco Secure Email | Critical9.8 |
| CVE-2026-85706 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLabExploitedGitLab · GitLab | Critical10.0 |
| CVE-2026-85102 | Improper Certificate Validation in Quantum Security GatewayExploitedcheckpoint · Quantum Security Gateway | Critical9.8 |
| CVE-2026-87491 | Out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML…ExploitedGoogle · Chrome | High8.8 |
| CVE-2026-84869 | ScreenConnect Client: Guest-to-Host File Execution via File-Transfer ActionsExploitedConnectWise · ScreenConnect | Critical9.9 |
| CVE-2026-81963 | Windows Update Stack Elevation of Privilege VulnerabilityExploitedMicrosoft · Windows 11 version 23H2 | High7.8 |
| CVE-2026-85880 | Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege VulnerabilityExploitedMicrosoft · Windows 10 Version 1607 | High7.8 |
| CVE-2026-75650 | Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)ExploitedAdobe · Adobe Commerce | Critical10.0 |
| CVE-2026-86218 | pre-authentication remote code executionExploitedN-able · N-central | Critical10.0 |
| CVE-2026-86060 | SSH session privilege manipulation via a crafted username in Mikrotik RouterOSExploitedMikrotik · RouterOS | Critical9.2 |
| CVE-2026-67279 | SSH Pre-Authentication Rekey State Bypass in MikroTik RouterOSExploitedMikrotik · RouterOS | Medium6.9 |