Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read just now.
At a glance
Published CVEs; rejected ones are not counted.
- 400,245All CVEsplus 18,875 rejected
- 802Last 24 hours3,087 in the last 7 days
- 17,421Last 30 days1,571 of them critical
- 1,767Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 17 | 36 | 16 | 1 | 0 | 70 | 98 |
| 2025 | 0 | 4 | 4 | 1 | 0 | 9 | 28 |
| 2024 | 0 | 2 | 6 | 3 | 0 | 11 | 19 |
| 2023 | 0 | 2 | 2 | 1 | 0 | 5 | 8 |
| 2022 | 0 | 0 | 0 | 0 | 0 | 0 | 3 |
| 2021 | 0 | 0 | 0 | 0 | 0 | 0 | 3 |
| 2020 | 0 | 0 | 0 | 0 | 0 | 0 | 3 |
| 2019 | 0 | 1 | 0 | 1 | 0 | 2 | 3 |
| 2018 | 0 | 0 | 1 | 0 | 0 | 1 | 1 |
| Title | ||
|---|---|---|
| CVE-2026-107929 | local interface connection reuse mixupcurl · curl | High8.1 |
| CVE-2026-107928 | info leak uploading over WebSockets with GnuTLScurl · curl | High8.1 |
| CVE-2026-94266 | password leak in CURLINFO_EFFECTIVE_URLcurl · curl | High7.5 |
| CVE-2026-94265 | Authorization: Negotiate sent to foreign origincurl · curl | Critical9.1 |
| CVE-2026-92391 | curl_mime_free stack overflow by recursioncurl · curl | High7.5 |
| CVE-2026-92390 | -J no-clobber guarantee bypassed with 103 early hintscurl · curl | High7.5 |
| CVE-2026-92389 | TFTP direction confusioncurl · curl | High8.1 |
| CVE-2026-92388 | FTP wildcard write callback mixupcurl · curl | Critical9.1 |
| CVE-2026-92387 | never-ending loop via server response omissioncurl · curl | High8.1 |
| CVE-2026-92386 | server-set cookie aborts cookie jar loadcurl · curl | High8.1 |
| CVE-2026-87866 | wolfSSL public-key pinning bypasscurl · curl | Critical9.1 |
| CVE-2026-87865 | knownhost callback mismatches key as missingcurl · curl | High7.4 |
| CVE-2026-87863 | HSTS response erases persisted entriescurl · curl | High8.1 |
| CVE-2026-87864 | IMAP APPEND plus CRLF conversion command injectioncurl · curl | High8.1 |
| CVE-2026-87862 | HSTS cache import drops longer-lived childcurl · curl | High8.1 |
| CVE-2026-87861 | cross-origin reuse of a Negotiate connectioncurl · curl | Critical9.1 |
| CVE-2026-86415 | auto client cert connection reuse mixupcurl · curl | High7.5 |
| CVE-2026-86414 | leaking host credentials to HTTP proxycurl · curl | Critical9.1 |
| CVE-2026-86413 | Negotiate credentials sent to redirected origincurl · curl | Critical9.1 |
| CVE-2026-86412 | server-set cookie erases cookie jarcurl · curl | High8.1 |
| CVE-2026-86411 | FTP connection reuse inherits client-certificatecurl · curl | Critical9.1 |
| CVE-2026-86410 | redirect to SFTP or SCP bypasses host verificationcurl · curl | High8.1 |
| CVE-2026-86409 | stale SigV4 headers sent unintendedcurl · curl | High8.1 |
| CVE-2026-92392 | HTTP/2 upload Use-After-Freecurl · curl | High8.1 |
| CVE-2026-82209 | domain-scoped PSL domain cookiecurl · curl | High8.2 |
| CVE-2026-82208 | wolfSSL CA-cache hit overrides callbackcurl · curl | High7.5 |
| CVE-2026-80255 | secure cookie attribute bypass with tabcurl · curl | High7.5 |
| CVE-2026-80231 | native CA store conn reusecurl · curl | High7.5 |
| CVE-2026-80230 | OpenSSL pinning bypasscurl · curl | High7.5 |
| CVE-2026-80229 | OpenSSL provider use-after-freecurl · curl | High7.5 |
| CVE-2026-19931 | Negotiate ambient user conn reusecurl · curl | Critical9.8 |
| CVE-2026-18924 | HTTP/2 server push UAFcurl · curl | Critical9.1 |
| CVE-2026-13608 | OpenLDAP SASL authentication bypasscurl · curl | High7.4 |
| CVE-2026-9547 | SSH improper host validationcurl · curl | High7.4 |
| CVE-2026-9546 | sending old referercurl · curl | High7.5 |
| CVE-2026-9545 | exposing HTTP/3 early datacurl · curl | High7.5 |
| CVE-2026-9080 | UAF after pause in socket callbackcurl · curl | High7.3 |
| CVE-2026-9079 | stale proxy password leakcurl · curl | Critical9.8 |
| CVE-2026-8932 | incomplete mTLS config matching in conn reusecurl · curl | High7.5 |
| CVE-2026-8927 | env-set cross-proxy Digest auth state leakcurl · curl | Critical9.1 |
| CVE-2026-8926 | password leak with netrc and user in URLcurl · curl | Critical9.1 |
| CVE-2026-8925 | SASL double-freecurl · curl | Critical9.8 |
| CVE-2026-8924 | trailing dot domain super cookiecurl · curl | Critical9.1 |
| CVE-2026-8458 | wrong reuse for different servicescurl · curl | Medium6.5 |
| CVE-2026-8286 | wrong STARTTLS connection reusecurl · curl | High8.1 |
| CVE-2026-12064 | proto-default skips SSH verificationcurl · curl | High7.5 |
| CVE-2026-11856 | cross-origin Digest auth state leakcurl · curl | Critical9.8 |
| CVE-2026-11586 | WS Auto-PONG memory exhaustioncurl · curl | High7.5 |
| CVE-2026-11564 | Native CA trust persistcurl · curl | Critical9.1 |
| CVE-2026-11352 | QUIC zero-length UDP datagrams busy-loopcurl · curl | High7.5 |