Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 2 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,606All CVEsplus 19,141 rejected
- 675Last 24 hours2,973 in the last 7 days
- 17,113Last 30 days1,608 of them critical
- 1,769Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 4 | 6 | 15 | 0 | 0 | 25 | 46 |
| 2025 | 0 | 0 | 2 | 0 | 0 | 2 | 21 |
| 2024 | 0 | 2 | 8 | 0 | 0 | 10 | 19 |
| 2023 | 0 | 1 | 0 | 0 | 0 | 1 | 9 |
| 2022 | 0 | 0 | 0 | 0 | 0 | 0 | 8 |
| 2021 | 0 | 0 | 0 | 0 | 0 | 0 | 8 |
| 2020 | 0 | 0 | 0 | 0 | 0 | 0 | 8 |
| 2019 | 0 | 0 | 0 | 0 | 0 | 0 | 8 |
| 2018 | 0 | 0 | 0 | 0 | 0 | 0 | 8 |
| 2017 | 4 | 4 | 0 | 0 | 0 | 8 | 8 |
| Title | ||
|---|---|---|
| CVE-2026-115473 | Mongoose: Heap OOB reads and null-byte bypass in mg_path_is_sane (util.c)cesanta · mongoose | Medium6.5 |
| CVE-2026-63626 | Mongoose: ppp_handle_ipv6cp() uses attacker-controlled length without bounds check — OOB read and heap overflow (PPP/PPPoE, MG_ENABLE_IPV6)cesanta · mongoose | High8.8 |
| CVE-2026-73261 | Mongoose: handle_opt() missing opts[1] > len check — 1-byte OOB read corrupts TCP MSS, silences mg_send() per connectioncesanta · mongoose | High7.5 |
| CVE-2026-73260 | Mongoose: Out-of-bounds Read via length-counter underflow in built-in TLS X.509 DER parsercesanta · mongoose | High7.5 |
| CVE-2026-73252 | Mongoose: Unauthenticated remote heap out-of-bounds read in built-in TLS: off-by-one length check in mg_tls_recv_record() underflows recv_len to SIZE_MAXcesanta · mongoose | High7.5 |
| CVE-2026-101003 | Cesanta Mongoose MQTT Broker main.c fn stack-based overflowCesanta · Mongoose | Medium6.9 |
| CVE-2026-86716 | Cesanta mJS mjs_tok.c skip_spaces_and_comments heap-based overflowCesanta · mJS | Medium6.9 |
| CVE-2026-73253 | Mongoose: TLS Hostname Verification Bypass via Overly Permissive Wildcard Matchingcesanta · mongoose | Critical9.1 |
| CVE-2026-73255 | Mongoose: Path traversal in SSI #include directives enables arbitrary file readcesanta · mongoose | Medium6.5 |
| CVE-2026-73259 | Mongoose: Reflected XSS via decoded URI in directory listing rendercesanta · mongoose | Medium5.4 |
| CVE-2026-73256 | Mongoose: HTTP/1.0 detection off-by-one enables request smuggling via chunked TEcesanta · mongoose | Critical9.1 |
| CVE-2026-73254 | Mongoose: Stored XSS via unescaped filenames in directory listingcesanta · mongoose | Medium5.4 |
| CVE-2026-73258 | Mongoose: Multipart boundary/header scan logic error in mg_http_next_multipartcesanta · mongoose | Medium6.5 |
| CVE-2026-73251 | Mongoose Built-in TLS: CA-bundle certificate chain accepted without any signature verificationcesanta · mongoose | Critical9.3 |
| CVE-2026-73257 | Mongoose: Content-Length + Transfer-Encoding coexistence enables request smugglingcesanta · mongoose | Critical9.1 |
| CVE-2026-11404 | Cesanta Mongoose Out-of-Bounds Read in MG_TLS_BUILTIN ClientHello Session ID ParsingCesanta · Mongoose | High8.7 |
| CVE-2026-6986 | Cesanta Mongoose GCM Authentication Tag tls_aes128.c mg_aes_gcm_decrypt signature verificationCesanta · Mongoose | Medium6.3 |
| CVE-2026-6985 | Cesanta Mongoose TCP Option net_builtin.c handle_opt infinite loopCesanta · Mongoose | Medium6.9 |
| CVE-2026-5246 | Cesanta Mongoose P-384 Public Key mongoose.c mg_tls_verify_cert_signature authorizationCesanta · Mongoose | Medium6.3 |
| CVE-2026-5245 | Cesanta Mongoose mDNS Record mongoose.c handle_mdns_record stack-based overflowCesanta · Mongoose | Medium6.3 |
| CVE-2026-5244 | Cesanta Mongoose TLS 1.3 mongoose.c mg_tls_recv_cert heap-based overflowCesanta · Mongoose | Medium6.9 |
| CVE-2018-25193 | Mongoose Web Server 6.9 Denial of Service via Socket ConnectionCesanta · Mongoose Web Server | High8.7 |
| CVE-2026-2968 | Cesanta Mongoose Poly1305 Authentication Tag tls_chacha20.c mg_chacha20_poly1305_decrypt signature verificationCesanta · Mongoose | Medium6.3 |
| CVE-2026-2967 | Cesanta Mongoose TCP Sequence Number net_builtin.c getpeer verification of sourceCesanta · Mongoose | Medium6.3 |
| CVE-2026-2966 | Cesanta Mongoose DNS Transaction ID dns.c mg_sendnsreq random valuesCesanta · Mongoose | Medium6.3 |
| CVE-2025-0696 | A NULL Pointer Dereference vulnerability in Cesanta Frozen versions less than 1.7 allows an attacker to induce a crash of the component embedding the library…Cesanta · Frozen | Medium5.3 |
| CVE-2025-0695 | An Allocation of Resources Without Limits or Throttling vulnerability in Cesanta Frozen versions less than 1.7 allows an attacker to induce a crash of the…Cesanta · Frozen | Medium5.3 |
| CVE-2024-42392 | Improper Neutralization of Delimiters in Mongoose Web Server libraryCesanta · Mongoose Web Server | Medium4.0 |
| CVE-2024-42391 | Use of Out-of-range Pointer Offset in Mongoose Web Server libraryCesanta · Mongoose Web Server | Medium4.3 |
| CVE-2024-42390 | Use of Out-of-range Pointer Offset in Mongoose Web Server libraryCesanta · Mongoose Web Server | Medium4.3 |
| CVE-2024-42389 | Use of Out-of-range Pointer Offset in Mongoose Web Server libraryCesanta · Mongoose Web Server | Medium5.3 |
| CVE-2024-42388 | Use of Out-of-range Pointer Offset in Mongoose Web Server libraryCesanta · Mongoose Web Server | Medium5.3 |
| CVE-2024-42387 | Use of Out-of-range Pointer Offset in Mongoose Web Server libraryCesanta · Mongoose Web Server | Medium5.3 |
| CVE-2024-42386 | Use of Out-of-range Pointer Offset in Mongoose Web Server libraryCesanta · Mongoose Web Server | High8.2 |
| CVE-2024-42385 | Improper Neutralization of Delimiters in Mongoose Web Server libraryCesanta · Mongoose Web Server | Medium4.0 |
| CVE-2024-42384 | Integer Overflow or Wraparound in Mongoose Web Server libraryCesanta · Mongoose Web Server | High7.5 |
| CVE-2024-42383 | Use of Out-of-range Pointer Offset in Mongoose Web Server libraryCesanta · Mongoose Web Server | Medium4.2 |
| CVE-2023-2905 | Cesanta Mongoose MQTT Message Parsing Heap OverflowCesanta · Mongoose | High8.8 |
| CVE-2017-2922 | An exploitable memory corruption vulnerability exists in the Websocket protocol implementation of Cesanta Mongoose 6.8. A specially crafted websocket packet…Cesanta · Mongoose | Critical9.8 |
| CVE-2017-2921 | An exploitable memory corruption vulnerability exists in the Websocket protocol implementation of Cesanta Mongoose 6.8. A specially crafted websocket packet…Cesanta · Mongoose | High8.1 |
| CVE-2017-2909 | An infinite loop programming error exists in the DNS server functionality of Cesanta Mongoose 6.8 library. A specially crafted DNS request can cause an…Cesanta · Mongoose | High7.5 |
| CVE-2017-2895 | An exploitable arbitrary memory read vulnerability exists in the MQTT packet parsing functionality of Cesanta Mongoose 6.8. A specially crafted MQTT SUBSCRIBE…Cesanta · Mongoose | High8.2 |
| CVE-2017-2894 | An exploitable stack buffer overflow vulnerability exists in the MQTT packet parsing functionality of Cesanta Mongoose 6.8. A specially crafted MQTT SUBSCRIBE…Cesanta · Mongoose | Critical9.8 |
| CVE-2017-2893 | An exploitable NULL pointer dereference vulnerability exists in the MQTT packet parsing functionality of Cesanta Mongoose 6.8. An MQTT SUBSCRIBE packet can…Cesanta · Mongoose | High7.5 |
| CVE-2017-2892 | An exploitable arbitrary memory read vulnerability exists in the MQTT packet parsing functionality of Cesanta Mongoose 6.8. A specially crafted MQTT packet can…Cesanta · Mongoose | Critical9.8 |
| CVE-2017-2891 | An exploitable use-after-free vulnerability exists in the HTTP server implementation of Cesanta Mongoose 6.8. An ordinary HTTP POST request with a CGI target…Cesanta · Mongoose | Critical9.8 |