Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 4 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 400,645All CVEsplus 18,889 rejected
- 398Last 24 hours2,969 in the last 7 days
- 17,128Last 30 days1,580 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 243 | 580 | 416 | 41 | 81 | 1,361 | 2,894 |
| 2025 | 30 | 90 | 93 | 5 | 0 | 218 | 1,533 |
| 2024 | 55 | 99 | 99 | 8 | 0 | 261 | 1,315 |
| 2023 | 56 | 99 | 100 | 3 | 1 | 259 | 1,054 |
| 2022 | 57 | 91 | 70 | 2 | 0 | 220 | 795 |
| 2021 | 50 | 72 | 50 | 0 | 0 | 172 | 575 |
| 2020 | 10 | 9 | 12 | 0 | 0 | 31 | 403 |
| 2019 | 6 | 26 | 15 | 0 | 0 | 47 | 372 |
| 2018 | 25 | 71 | 68 | 3 | 0 | 167 | 325 |
| 2017 | 34 | 82 | 41 | 0 | 0 | 157 | 158 |
| 2016 | 0 | 1 | 0 | 0 | 0 | 1 | 1 |
| Title | ||
|---|---|---|
| CVE-2026-66903 | Apache OFBiz: Authenticated Path Traversal in Catalog Image ManagementApache Software Foundation · Apache OFBiz | Not scored |
| CVE-2026-71901 | Apache OFBiz: Dispatch arbitrary internal services on SFA componentApache Software Foundation · Apache OFBiz | Not scored |
| CVE-2026-68524 | Apache OFBiz: Pre-Authentication Remote Code Execution via Attacker-Controlled Screen Definition LoadingApache Software Foundation · Apache OFBiz | Not scored |
| CVE-2026-73577 | Apache OFBiz: Unauthenticated path-suffix view authorization bypassApache Software Foundation · Apache OFBiz | Not scored |
| CVE-2026-73578 | Apache OFBiz: Unauthenticated saved-view authorization bypass with RCE impactApache Software Foundation · Apache OFBiz | Not scored |
| CVE-2026-73580 | Apache OFBiz: Unauthenticated HR organization and employee disclosureApache Software Foundation · Apache OFBiz | Not scored |
| CVE-2026-74841 | Apache OFBiz: Denial of Service via unauthenticated userTenantId in multitenant modeApache Software Foundation · Apache OFBiz | Not scored |
| CVE-2026-76150 | Apache OFBiz: Authenticated path traversal and missing authorization check in replaceImageToExistImageApache Software Foundation · Apache OFBiz | Not scored |
| CVE-2026-81734 | Apache OFBiz: Missing authorization - catalog quick-admin product writesApache Software Foundation · Apache OFBiz | Not scored |
| CVE-2026-76152 | Apache OFBiz: Authenticated path traversal and missing authorization check in imageCrop and imageRotate servicesApache Software Foundation · Apache OFBiz | Not scored |
| CVE-2026-81744 | Apache OFBiz: Authorization bypass - self-grant content OWNERApache Software Foundation · Apache OFBiz | Not scored |
| CVE-2026-81808 | Apache OFBiz: Missing authorization - search-result bulk catalog mutationApache Software Foundation · Apache OFBiz | Not scored |
| CVE-2026-81815 | Apache OFBiz: SQL injection - performFind ignore-case values, MySQL/MariaDBApache Software Foundation · Apache OFBiz | Not scored |
| CVE-2026-81816 | Apache OFBiz: XML external entity injection (XXE)Apache Software Foundation · Apache OFBiz | Not scored |
| CVE-2026-81828 | Apache OFBiz: Server-side request forgery in SurveyWrapperApache Software Foundation · Apache OFBiz | Not scored |
| CVE-2026-82894 | Apache OFBiz: Content renderer runs a service name stored on the rowApache Software Foundation · Apache OFBiz | Not scored |
| CVE-2026-82902 | Apache OFBiz: Unfiltered server-side URL fetch in webtools viewdatafileApache Software Foundation · Apache OFBiz | Not scored |
| CVE-2026-82904 | Apache OFBiz: Unbounded multi-form row count from a parameter nameApache Software Foundation · Apache OFBiz | Not scored |
| CVE-2026-82907 | Apache OFBiz: externalLoginKey honoured pre-auth, reusable and unboundApache Software Foundation · Apache OFBiz | Not scored |
| CVE-2026-82910 | Apache OFBiz: renderLink compiles link parameters as FreeMarker sourceApache Software Foundation · Apache OFBiz | Not scored |
| CVE-2026-82912 | Apache OFBiz: Unsandboxed Groovy compiled from a service parameterApache Software Foundation · Apache OFBiz | Not scored |
| CVE-2026-82916 | Apache OFBiz: webtools xmldsdump exports any entity to any pathApache Software Foundation · Apache OFBiz | Not scored |
| CVE-2026-82960 | Apache OFBiz: Widget use-when Expression Injection Bypasses Groovy Sandbox for authenticated RCEApache Software Foundation · Apache OFBiz | Not scored |
| CVE-2026-83538 | Apache OFBiz: Unauthenticated disclosure through HR, Catalog, and Order Manager helpersApache Software Foundation · Apache OFBiz | Not scored |
| CVE-2026-83542 | Apache OFBiz: Unauthenticated RCE via login-page widget injectionApache Software Foundation · Apache OFBiz | Not scored |
| CVE-2026-84183 | Apache OFBiz: Content Manager VIEW-only RCE in updateLayoutApache Software Foundation · Apache OFBiz | Not scored |
| CVE-2026-84728 | Apache OFBiz: Cross-tenant authorization bypass in mapped-domain loginApache Software Foundation · Apache OFBiz | Not scored |
| CVE-2026-85627 | Apache OFBiz: Authenticated Code Execution VulnerabilityApache Software Foundation · Apache OFBiz | Not scored |
| CVE-2026-92887 | Apache OFBiz: REST API authentication bypassed by default when the auth attribute is omitted from a .rest.xml operationApache Software Foundation · Apache OFBiz | Not scored |
| CVE-2026-97355 | Apache OFBiz: Hard-coded Credentials in AdminServer Enable Unauthenticated Denial of ServiceApache Software Foundation · Apache OFBiz | Not scored |
| CVE-2026-97356 | Apache OFBiz: Insufficiently Protected Credentials in ViewFile Enable Authentication BypassApache Software Foundation · Apache OFBiz | Not scored |
| CVE-2026-100168 | Apache OFBiz: Missing Authorization vulnerabilityApache Software Foundation · Apache OFBiz | Not scored |
| CVE-2026-100228 | Apache OFBiz: Improper Input Validation in Order Returns Enables Unauthorized Refund Price ManipulationApache Software Foundation · Apache OFBiz | Not scored |
| CVE-2026-105325 | Apache OFBiz: Missing authorization in payment application services allows view-only users to modify payment allocationsApache Software Foundation · Apache OFBiz | Not scored |
| CVE-2026-105330 | Apache OFBiz: Use of Hard-coded Cryptographic Key in JWT Token Authentication Enables Unauthenticated Administrative AccessApache Software Foundation · Apache OFBiz | Not scored |
| CVE-2026-105461 | Apache OFBiz: Missing authorization in updateOrderItems allows view-only users to modify order prices and quantitiesApache Software Foundation · Apache OFBiz | Not scored |
| CVE-2026-109129 | Apache OFBiz: Authorization Bypass Through User-Controlled Key in OrderServices Enables Unauthorized Payment Preference ModificationApache Software Foundation · Apache OFBiz | Not scored |
| CVE-2026-109837 | Apache OFBiz: Authorization Bypass Through User-Controlled Key in Order Returns Enables Cross-Party OrderItem AssociationApache Software Foundation · Apache OFBiz | Not scored |
| CVE-2026-109856 | Apache OFBiz: Missing Authorization in Financial Account Services Enables Unauthorized Balance ManipulationApache Software Foundation · Apache OFBiz | Not scored |
| CVE-2026-109928 | Apache OFBiz: Incorrect Authentication Algorithm Implementation in Password Reset Enables Full Account TakeoverApache Software Foundation · Apache OFBiz | Not scored |
| CVE-2026-114229 | Apache OFBiz: Reflected Cross-site Scripting in Catalog Image Viewer Enables Script Execution in a User SessionApache Software Foundation · Apache OFBiz | Not scored |
| CVE-2026-114233 | Apache OFBiz: Incorrect Privilege Assignment in Order Manager Enables Unauthorized Modification of Approved OrdersApache Software Foundation · Apache OFBiz | Not scored |
| CVE-2026-114235 | Apache OFBiz: Direct Request in Order Manager Enables Unauthorized Tracking Number ModificationApache Software Foundation · Apache OFBiz | Not scored |
| CVE-2026-114271 | Apache OFBiz: Authorization Bypass Through User-Controlled Key in Shopping Lists Enables Cross-Party Shopping List ModificationApache Software Foundation · Apache OFBiz | Not scored |
| CVE-2026-114272 | Apache OFBiz: Authorization Bypass Through User-Controlled Key in Content Viewing Enables Unauthorized Content DisclosureApache Software Foundation · Apache OFBiz | Not scored |
| CVE-2026-114277 | Apache OFBiz: Janrain Engage Social Login Improperly Binds External Identities to Local AccountsApache Software Foundation · Apache OFBiz | Not scored |
| CVE-2026-103866 | Apache Sling Engine: Hand-rolled parameter parser diverges from RFC/container parsing, enabling smugglingApache Software Foundation · Apache Sling Engine | Not scored |
| CVE-2026-103864 | Apache Sling Engine: Request-derived values reach log sinks without CR/LF neutralizationApache Software Foundation · Apache Sling Engine | Not scored |
| CVE-2026-103863 | Apache Sling Engine: Include-protection mitigations bypassable via uncovered response-wrapper pathsApache Software Foundation · Apache Sling Engine | Not scored |
| CVE-2026-121489 | Apache Juneau: Path traversal in DirectoryResource allows reading files outside the configured root directoryApache Software Foundation · Apache Juneau | Critical10.0 |