Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 6 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,298All CVEsplus 19,140 rejected
- 452Last 24 hours2,719 in the last 7 days
- 16,912Last 30 days1,557 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 1 | 15 | 5 | 1 | 0 | 22 | 88 |
| 2025 | 0 | 8 | 8 | 0 | 0 | 16 | 66 |
| 2024 | 1 | 15 | 7 | 1 | 0 | 24 | 50 |
| 2023 | 1 | 3 | 0 | 0 | 0 | 4 | 26 |
| 2022 | 2 | 2 | 2 | 0 | 0 | 6 | 22 |
| 2021 | 0 | 5 | 6 | 0 | 0 | 11 | 16 |
| 2020 | 0 | 3 | 2 | 0 | 0 | 5 | 5 |
| Title | ||
|---|---|---|
| CVE-2026-108717 | Combodo iTop 3.1.0 through 3.3.0 Missing Authorization via LinkSetControllerCombodo · iTop | Medium5.3 |
| CVE-2026-40877 | Combodo iTop: PHP Object Injection Leading to Remote Code Execution on user preferencesCombodo · iTop | High8.7 |
| CVE-2026-30864 | Combodo iTop: Reflected XSS in dashboard revertCombodo · iTop | High8.9 |
| CVE-2026-39975 | Combodo iTop: Remote code execution using external auth variable valueCombodo · iTop | Critical9.4 |
| CVE-2026-34949 | Combodo iTop: Unauthenticated user can delete .readonly fileCombodo · iTop | Medium6.5 |
| CVE-2026-34948 | Combodo iTop: Access control bypass via OQL joinsCombodo · iTop | High7.7 |
| CVE-2026-34836 | Combodo iTop: Improper access control in ajax.render.php and ajax.document.phpCombodo · iTop | Medium6.5 |
| CVE-2026-34741 | Combodo iTop: Authentication bypass in exec.php allows PHP file executionCombodo · iTop | High8.6 |
| CVE-2026-33333 | Combodo iTop: Information disclosure in ajax.render.phpCombodo · iTop | Low3.5 |
| CVE-2026-33240 | Combodo iTop: Reflected XSS in foreign key search criteriaCombodo · iTop | High8.8 |
| CVE-2026-33047 | Combodo iTop: Object can be locked by a user without write permissionsCombodo · iTop | Medium4.3 |
| CVE-2026-31936 | Combodo iTop: Unauthorized access to object information via search operationCombodo · iTop | High8.8 |
| CVE-2026-31880 | Combodo iTop: Reflected XSS in universal searchCombodo · iTop | High8.0 |
| CVE-2026-31803 | Combodo iTop: Reflected XSS in tag adminCombodo · iTop | High8.0 |
| CVE-2026-30890 | Combodo iTop: Reflected XSS in synchro/synchro_import.phpCombodo · iTop | High8.0 |
| CVE-2026-30865 | Combodo iTop: Reflected XSS in dashboard saveCombodo · iTop | High7.1 |
| CVE-2026-30826 | Combodo iTop: Reflected XSS in run_query.phpCombodo · iTop | High8.0 |
| CVE-2026-30819 | Combodo iTop: Reflected XSS in /pages/ajax.render.php dashboard_id parameterCombodo · iTop | High7.3 |
| CVE-2026-27490 | Combodo iTop: Weak secret generation for inline imageCombodo · iTop | High7.5 |
| CVE-2026-27463 | Combodo iTop: Version disclosure via login page logoCombodo · iTop | Medium5.3 |
| CVE-2026-27462 | Combodo iTop: User enumeration via password resetCombodo · iTop | High7.5 |
| CVE-2026-30866 | Combodo iTop: Insecured access to uploaded images via sniffed urlCombodo · iTop | High7.5 |
| CVE-2025-64167 | Combodo iTop vulnerable to reflected XSS in webservices/export.phpCombodo · iTop | High7.1 |
| CVE-2025-49145 | iTop admin can drop iTop database using webhooksCombodo · iTop | High8.7 |
| CVE-2025-48878 | Combodo iTop vulnerable to IDOR with ModuleInstallation objectCombodo · iTop | Medium4.3 |
| CVE-2025-48065 | Combodo iTop vulnerable to reflected XSS via objection edition form errorCombodo · iTop | High8.8 |
| CVE-2025-48055 | Combodo iTop has stored XSS in user portal's browse brickCombodo · iTop | High8.5 |
| CVE-2025-47932 | Combodo iTop vulnerable to reflected XSS in ajax.render.php render_dashboardCombodo · iTop | High8.8 |
| CVE-2025-47773 | Combodo iTop has XSS vulnerability in /pages/ajax.render.phpCombodo · iTop | High8.8 |
| CVE-2025-47286 | Combodo iTop vulnerable to Remote Code Execution in the backup creation functionalityCombodo · iTop | High8.6 |
| CVE-2025-24969 | iTop portal user can see any other contact's pictureCombodo · iTop | Medium5.0 |
| CVE-2025-24785 | iTop dashboard vulnerable to denial of serviceCombodo · iTop | Medium4.3 |
| CVE-2025-24026 | iTop Inefficient Regular Expression Complexity vulnerabilityCombodo · iTop | Medium5.3 |
| CVE-2025-24022 | iTop server vulnerable to portal code injectionCombodo · iTop | High8.6 |
| CVE-2025-24021 | iTop doesn't have mass assignment of fields in the portal formCombodo · iTop | Medium5.0 |
| CVE-2024-56157 | iTop vulnerable to Self XSS in CSV ImportCombodo · iTop | Medium6.3 |
| CVE-2024-52601 | iTop portal Insecure Direct Object Reference vulnerabilityCombodo · iTop | Medium6.5 |
| CVE-2025-27139 | Combodo iTop vulnerable to stored self Cross-site Scripting in preferencesCombodo · iTop | Medium6.8 |
| CVE-2024-54139 | Combodo iTop vulnerable to XSS leading to CSRF breach on _table_id parameterCombodo · iTop | High7.9 |
| CVE-2024-52000 | Reflected Cross-site Scripting exploit in Combodo iTopCombodo · iTop | High8.1 |
| CVE-2024-52001 | Portal user is able to access forbidden services information in Combodo iTopCombodo · iTop | Medium4.3 |
| CVE-2024-52002 | Cross-Site Request Forgery (CSRF) in several iTop pagesCombodo · iTop | High7.6 |
| CVE-2024-51993 | Password is stored in clear in the database in Combodo iTopCombodo · iTop | Low3.4 |
| CVE-2024-51994 | Cross-site Scripting in portal picture upload in Combodo iTopCombodo · iTop | High7.1 |
| CVE-2024-51995 | Logic bug in ajax.render.php allows for bypass of 'backOffice' access control in Combodo iTopCombodo · iTop | High7.1 |
| CVE-2024-51740 | SSRF through arbitrary PHP class instantiation in the user portal in Combodo iTopCombodo · iTop | Medium4.3 |
| CVE-2024-51739 | Users enumeration allowed through Rest API in Combodo iTopCombodo · iTop | High7.5 |
| CVE-2024-32870 | iTop hub connector Information disclosureCombodo · iTop | Medium5.8 |
| CVE-2024-31998 | CSRF security issue on CSV import in Combodo iTopCombodo · iTop | High8.8 |
| CVE-2024-31448 | Cross-site Scripting vulnerability in link CSV import in Combodo iTopCombodo · iTop | High8.8 |