Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 1 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,359All CVEsplus 19,141 rejected
- 467Last 24 hours2,745 in the last 7 days
- 16,928Last 30 days1,563 of them critical
- 1,769Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 1 | 5 | 12 | 0 | 0 | 18 | 18 |
| Title | ||
|---|---|---|
| CVE-2026-118658 | Echo: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Protolabstack · echo | Medium4.7 |
| CVE-2026-118657 | Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headerslabstack · echo | Medium5.9 |
| CVE-2026-118656 | Echo: Open Redirect via Control-Character Prefix Defeating sanitizeURIlabstack · echo | Medium6.1 |
| CVE-2026-118655 | Echo: Static Middleware Double-Unescape Path Traversallabstack · echo | Medium5.9 |
| CVE-2026-118654 | Echo static file middleware route protection bypass via encoded dot-dot traversallabstack · echo | Medium5.9 |
| CVE-2026-118653 | Echo: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configurationlabstack · echo | Medium5.3 |
| CVE-2026-118652 | Echo: Reflected Cross-Site Scripting (XSS) via unsanitized JSONP callback in Context.JSONP / Context.JSONPBloblabstack · echo | Medium6.1 |
| CVE-2026-118651 | Echo: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Defaultlabstack · echo | Medium5.3 |
| CVE-2026-118650 | Echo: middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served pathlabstack · echo | High7.5 |
| CVE-2026-118266 | Echo: CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Methodlabstack · echo | Medium5.3 |
| CVE-2026-118265 | Echo: X-Real-IP extractor trusts the header value instead of the sending peerlabstack · echo | Medium5.3 |
| CVE-2026-118264 | Echo: Rejected WebSocket upgrades can bypass Echo route-level access controlslabstack · echo | Critical9.1 |
| CVE-2026-118263 | Echo: BodyDump can discard BodyLimit overflow errors for unknown-length requestslabstack · echo | Medium6.3 |
| CVE-2026-118262 | Echo: WebSocket proxy can retain connections and handlers after client disconnectlabstack · echo | High8.2 |
| CVE-2026-118261 | Echo: Decompress permits unbounded gzip expansion in v4labstack · echo | High8.2 |
| CVE-2026-118260 | Echo: BodyDump captures request and response bodies without size limits in v4labstack · echo | High8.2 |
| CVE-2026-55677 | Echo: Encoded slash (%2F) bypasses route-level protection and exposes static fileslabstack · echo | High7.5 |
| CVE-2026-25766 | Echo has a Windows path traversal via backslash in middleware.Static default filesystemlabstack · echo | Medium5.3 |