Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 3 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 400,451All CVEsplus 18,890 rejected
- 365Last 24 hours2,971 in the last 7 days
- 17,371Last 30 days1,592 of them critical
- 1,767Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 0 | 4 | 4 | 0 | 0 | 8 | 11 |
| 2025 | 0 | 3 | 0 | 0 | 0 | 3 | 3 |
| Title | ||
|---|---|---|
| CVE-2026-116686 | Model Context Protocol Python SDK: Client fetched server-chosen $ref URLs while validating tool results against output schemasmodelcontextprotocol · python-sdk | Medium6.5 |
| CVE-2026-116685 | Model Context Protocol Python SDK: HTTP client transports followed cross-origin redirects carrying custom headers and bodiesmodelcontextprotocol · python-sdk | Medium5.9 |
| CVE-2026-116684 | Model Context Protocol Python SDK: Server bearer-token authentication accepts tokens issued for a different resource servermodelcontextprotocol · python-sdk | Medium6.8 |
| CVE-2026-109527 | Model Context Protocol Python SDK HTTP and OAuth endpoints allow memory exhaustion through unbounded request bodiesmodelcontextprotocol · python-sdk | High7.5 |
| CVE-2026-59951 | MCP Python SDK: Unbounded Session Accumulation in StreamableHTTP Transport Enables Resource Exhaustionmodelcontextprotocol · python-sdk | Medium6.9 |
| CVE-2026-59950 | MCP Python SDK: WebSocket server transport does not support Host/Origin validationmodelcontextprotocol · python-sdk | High7.6 |
| CVE-2026-52870 | MCP Python SDK: Experimental task handlers allow any client to access and cancel other clients' tasksmodelcontextprotocol · python-sdk | High7.6 |
| CVE-2026-52869 | MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principalmodelcontextprotocol · python-sdk | High7.1 |
| CVE-2025-66416 | DNS Rebinding Protection Disabled by Default in Model Context Protocol Python SDK for Servers Running on Localhostmodelcontextprotocol · python-sdk | High7.6 |
| CVE-2025-53366 | MCP SDK Vulnerable to FastMCP Server Validation Error, Leading to Denial of Servicemodelcontextprotocol · python-sdk | High8.7 |
| CVE-2025-53365 | MCP Python SDK has Unhandled Exception in Streamable HTTP Transport ,Leading to Denial of Servicemodelcontextprotocol · python-sdk | High8.7 |