Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 1 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 400,177All CVEsplus 18,875 rejected
- 818Last 24 hours3,237 in the last 7 days
- 17,402Last 30 days1,566 of them critical
- 1,767Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 1 | 15 | 12 | 0 | 0 | 28 | 33 |
| 2025 | 0 | 1 | 1 | 0 | 0 | 2 | 5 |
| 2024 | 0 | 0 | 0 | 0 | 0 | 0 | 3 |
| 2023 | 0 | 0 | 1 | 0 | 0 | 1 | 3 |
| 2022 | 0 | 0 | 0 | 0 | 0 | 0 | 2 |
| 2021 | 0 | 0 | 0 | 0 | 0 | 0 | 2 |
| 2020 | 0 | 0 | 0 | 0 | 0 | 0 | 2 |
| 2019 | 0 | 0 | 0 | 0 | 0 | 0 | 2 |
| 2018 | 2 | 0 | 0 | 0 | 0 | 2 | 2 |
| Title | ||
|---|---|---|
| CVE-2026-110879 | jackson-databind: PolymorphicTypeValidator bypass via generic type arguments and array element types allows arbitrary class instantiation (incomplete fix for CVE-2026-54512)FasterXML · jackson-databind | Critical9.8 |
| CVE-2026-110747 | jackson-dataformat-protobuf: integer overflow in ProtobufParser._readStringKey() allows OutOfMemoryError from an 8-byte payloadFasterXML · jackson-dataformat-protobuf | High7.5 |
| CVE-2026-104895 | jackson-dataformat-smile: unbounded eager byte[] allocation for raw binary in the async parser allows OutOfMemoryError denial of serviceFasterXML · jackson-dataformat-smile | High7.5 |
| CVE-2026-104016 | jackson-dataformat-protobuf: signed integer overflow in string-length paths allows unbounded array allocation and OutOfMemoryErrorFasterXML · jackson-dataformat-protobuf | High7.5 |
| CVE-2026-68498 | jackson-core: Delayed maxNameLength enforcement for char-backed input (ReaderBasedJsonParser) allows memory-exhaustion denial of serviceFasterXML · jackson-core | High7.5 |
| CVE-2026-68496 | jackson-dataformats-binary: Smile parser does not enforce StreamReadConstraints.maxNameLength, enabling memory-exhaustion denial of serviceFasterXML · jackson-dataformats-binary | High7.5 |
| CVE-2026-68495 | jackson-dataformats-binary: CBOR parser does not enforce StreamReadConstraints.maxNameLength, enabling memory-exhaustion denial of serviceFasterXML · jackson-dataformats-binary | High7.5 |
| CVE-2026-91777 | jackson-databind: quadratic forward-reference completion in Collection and Map deserializersFasterXML · jackson-databind | High7.5 |
| CVE-2026-91776 | jackson-databind: unbounded growth of the type id cache in TypeDeserializerBase retains every unknown raw type IDFasterXML · jackson-databind | High7.5 |
| CVE-2026-89425 | jackson-core: UTF8DataInputJsonParser._reportInvalidToken() does not honor maxErrorTokenLength, allowing unbounded StringBuilder growthFasterXML · jackson-core | High7.5 |
| CVE-2026-89407 | jackson-core: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber() enables ReDoSFasterXML · jackson-core | High7.5 |
| CVE-2026-68497 | jackson-databind: unbounded numeric parse in Duration and XMLGregorianCalendar deserialization allows CPU denial of serviceFasterXML · jackson-databind | High7.5 |
| CVE-2026-83557 | jackson-databind omits java.lang.Comparable from DefaultBaseTypeLimitingValidator's unsafe base typesFasterXML · jackson-databind | Medium5.6 |
| CVE-2026-19032 | jackson-databind resolves attacker-controlled URI schemes when deserializing java.nio.file.PathFasterXML · jackson-databind | Medium5.3 |
| CVE-2026-77310 | jackson-databind: Eager DNS resolution (SSRF) still present in InetAddress deserialization (Incomplete fix for CVE-2026-54514)FasterXML · com.fasterxml.jackson.core:jackson-databind | Medium5.3 |
| CVE-2026-68494 | jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for CVE-2026-18401 / GHSA-72hv-8253-57qq)FasterXML · jackson-core | High8.7 |
| CVE-2026-18401 | jackson-core: Number length constraint bypass in non-blocking (async) JSON parser leads to potential denial of serviceFasterXML · jackson-core | Medium6.9 |
| CVE-2026-59889 | jackson-databind: @JsonView ypassed for @JsonUnwrapped container properties on deserializationFasterXML · jackson-databind | Medium6.5 |
| CVE-2026-59888 | jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategyFasterXML · jackson-databind | Medium6.5 |
| CVE-2026-54518 | jackson-databind: @JsonView bypass for unwrapped creator parameters in jackson-databindFasterXML · jackson-databind | Medium6.5 |
| CVE-2026-50193 | jackson-databind: Deeply nested JsonNode throws StackOverflowError for toString()FasterXML · jackson-databind | Medium6.3 |
| CVE-2026-54512 | jackson-databind: PolymorphicTypeValidator bypass via generic type parameters allows arbitrary class instantiationFasterXML · jackson-databind | High8.1 |
| CVE-2026-54513 | jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)FasterXML · jackson-databind | High8.1 |
| CVE-2026-54514 | jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF)FasterXML · jackson-databind | Medium5.3 |
| CVE-2026-54515 | jackson-databind: Case-insensitive deserialization bypasses per-property @JsonIgnorePropertiesFasterXML · jackson-databind | Medium5.3 |
| CVE-2026-54516 | jackson-databind: Renamed @JsonIgnore'd setters can deserialize via private fieldsFasterXML · jackson-databind | Medium5.3 |
| CVE-2026-54517 | jackson-databind: @JsonView bypass for setterless creator propertiesFasterXML · jackson-databind | Medium5.3 |
| CVE-2026-29062 | jackson-core: Nesting Depth Constraint Bypass in `UTF8DataInputJsonParser` potentially allowing Resource ExhaustionFasterXML · jackson-core | High8.7 |
| CVE-2025-52999 | jackson-core Has Potential for StackoverflowError if user parses an input file that contains very deeply nested dataFasterXML · jackson-core | High8.7 |
| CVE-2025-49128 | Jackson-core Vulnerable to Memory Disclosure via Source Snippet in JsonLocationFasterXML · jackson-core | Medium4.0 |
| CVE-2023-3894 | DOS in jackson-dataformats-textFasterXML · jackson-dataformats-text | Medium5.8 |
| CVE-2017-15095 | A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code…FasterXML · jackson-databind | Critical9.8 |
| CVE-2017-7525 | A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform…FasterXML · jackson-databind | Critical9.8 |