Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 8 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 400,878All CVEsplus 19,117 rejected
- 446Last 24 hours2,934 in the last 7 days
- 16,821Last 30 days1,556 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 0 | 3 | 3 | 0 | 0 | 6 | 29 |
| 2025 | 3 | 1 | 1 | 1 | 0 | 6 | 23 |
| 2024 | 0 | 0 | 2 | 0 | 0 | 2 | 17 |
| 2023 | 0 | 0 | 0 | 0 | 0 | 0 | 15 |
| 2022 | 4 | 0 | 1 | 0 | 0 | 5 | 15 |
| 2021 | 0 | 0 | 0 | 0 | 0 | 0 | 10 |
| 2020 | 0 | 2 | 2 | 0 | 0 | 4 | 10 |
| 2019 | 0 | 5 | 0 | 0 | 0 | 5 | 6 |
| 2018 | 1 | 0 | 0 | 0 | 0 | 1 | 1 |
| Title | ||
|---|---|---|
| CVE-2026-109518 | APT RCE via hard link reuseDebian · APT | High7.7 |
| CVE-2026-89169 | live-boot ff8867c allows attackers to bypass the dm-verity-enforce-roothash-signature protection mechanism when the .verity file is missing.Debian · live-boot | Medium4.1 |
| CVE-2026-77118 | Out-of-bounds write in GraphicsMagick PCD decoderGraphicsMagick Group · GraphicsMagick | High8.4 |
| CVE-2026-11853 | Debusine is an integrated solution to build, distribute and maintain a Debian-based distribution. Debian source packages (.dsc) and upload artifacts (.changes)…Debian · debusine | Medium6.5 |
| CVE-2026-11852 | Debusine is an integrated solution to build, distribute and maintain a Debian-based distribution. Files managed by debusine are organized into artifacts. The…Debian · debusine | Medium6.5 |
| CVE-2026-2219 | It was discovered that dpkg-deb (a component of dpkg, the Debian package management system) does not properly validate the end of the data stream when…Debian · dpkg | High7.5 |
| CVE-2025-68462 | Freedombox before 25.17.1 does not set proper permissions for the backups-data directory, allowing the reading of dump files of databases.Debian · FreedomBox | Low3.2 |
| CVE-2025-8454 | It was discovered that uscan, a tool to scan/watch upstream sources for new releases of software, included in devscripts (a collection of scripts to make the…Debian · devscripts | Critical9.8 |
| CVE-2025-6297 | dpkg-deb: Fix cleanup for control member with restricted directoriesDebian · dpkg | High8.2 |
| CVE-2025-53391 | The Debian zuluPolkit/CMakeLists.txt file for zuluCrypt through the zulucrypt_6.2.0-1 package has insecure PolicyKit allow_any/allow_inactive/allow_active…Debian · zulucrypt | Critical9.3 |
| CVE-2014-7210 | pdns specific as packaged in Debian in version before 3.3.1-1 creates a too privileged MySQL user. It was discovered that the maintainer scripts of…Debian · pdns | Critical9.8 |
| CVE-2025-47153 | Certain build processes for libuv and Node.js for 32-bit systems, such as for the nodejs binary package through nodejs_20.19.0+dfsg-2_i386.deb for Debian…Debian · trixie | Medium6.5 |
| CVE-2024-2312 | GRUB2 does not call the module fini functions on exit, leading to Debian/Ubuntu's peimage GRUB2 module leaving UEFI system table hooks after exit. This lead to…Debian · Debian based GNU GRUB | Medium6.7 |
| CVE-2023-7207 | Debian's cpio contains a path traversal vulnerability. This issue was introduced by reverting CVE-2015-1197 patches which had caused a regression in…Debian · Debian cpio | Medium4.9 |
| CVE-2022-2787 | stricter rules on chroot namesDebian · schroot | Medium4.3 |
| CVE-2022-1664 | directory traversal for in-place extracts with untrusted v2 and v3 source packages with debian.tarDebian · dpkg | Critical9.8 |
| CVE-2016-1239 | duck before 0.10 did not properly handle loading of untrusted code from the current directory.Debian · duck | Critical9.8 |
| CVE-2022-0543 | It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific) Lua sandbox escape, which could…ExploitedDebian · redis | Critical10.0 |
| CVE-2021-20001 | It was discovered, that debian-edu-config, a set of configuration files used for the Debian Edu blend, before 2.12.16 configured insecure permissions for the…Debian · debian-edu-config | Critical9.8 |
| CVE-2020-3811 | qmail-verify as used in netqmail 1.06 is prone to a mail-address verification bypass vulnerability.Debian · netqmail | High7.5 |
| CVE-2020-3812 | qmail-verify as used in netqmail 1.06 is prone to an information disclosure vulnerability. A local attacker can test for the existence of files and directories…Debian · netqmail | Medium5.5 |
| CVE-2020-3810 | Missing input validation in the ar/tar implementations of APT before version 2.1.2 could result in denial of service when processing specially crafted deb…Debian · apt | Medium5.5 |
| CVE-2012-1093 | The init script in the Debian x11-common package before 1:7.6+12 is vulnerable to a symlink attack that can lead to a privilege escalation during package…Debian · x11-common | High7.8 |
| CVE-2019-3467 | Debian-edu-config all versions < 2.11.10, a set of configuration files used for Debian Edu, and debian-lan-config < 0.26, configured too permissive ACLs for…Debian · Debian Edu | High7.8 |
| CVE-2017-5332 | The extract_group_icon_cursor_resource in wrestool/extract.c in icoutils before 0.31.1 can access unallocated memory, which allows local users to cause a…Debian · icoutils | High7.8 |
| CVE-2017-5331 | Integer overflow in the check_offset function in b/wrestool/fileread.c in icoutils before 0.31.1 allows local users to cause a denial of service (process…Debian · icoutils | High7.8 |
| CVE-2017-5333 | Integer overflow in the extract_group_icon_cursor_resource function in b/wrestool/extract.c in icoutils before 0.31.1 allows local users to cause a denial of…Debian · icoutils | High7.8 |
| CVE-2018-5735 | Backport of the fix for CVE-2017-3137 leads to assertion failure in validator.c:1858Debian · BIND9 | High7.5 |
| CVE-2017-0359 | diffoscope writes to arbitrary locations on disk based on the contents of an untrusted archiveDebian · diffoscope | Critical9.8 |