Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read just now.
At a glance
Published CVEs; rejected ones are not counted.
- 400,985All CVEsplus 19,118 rejected
- 417Last 24 hours2,843 in the last 7 days
- 16,805Last 30 days1,543 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 0 | 2 | 0 | 0 | 0 | 2 | 22 |
| 2025 | 1 | 5 | 11 | 1 | 0 | 18 | 20 |
| 2024 | 0 | 0 | 0 | 0 | 0 | 0 | 2 |
| 2023 | 0 | 0 | 1 | 0 | 0 | 1 | 2 |
| 2022 | 0 | 0 | 1 | 0 | 0 | 1 | 1 |
| Title | ||
|---|---|---|
| CVE-2025-68402 | FreshRSS has an authentication bypass due to truncated bcrypt hash [edge branch]FreshRSS · FreshRSS | High8.2 |
| CVE-2025-62166 | FreshRSS has an IDOR which allows for viewing feeds of any user and leaking tokensFreshRSS · FreshRSS | High7.5 |
| CVE-2025-68148 | FreshRSS globally denies access to feed via proxy modifying to 429 Retry-AfterFreshRSS · FreshRSS | Medium4.3 |
| CVE-2025-68932 | FreshRSS has weak cryptographic randomness in remember-me token and nonce generationFreshRSS · FreshRSS | Low2.9 |
| CVE-2025-59949 | FreshRSS has Logout CSRF that Leads to DoS via <track src>FreshRSS · FreshRSS | Medium5.3 |
| CVE-2025-58173 | FreshRSS vulnerable to authenticated RCE via path traversal inside include()FreshRSS · FreshRSS | High7.4 |
| CVE-2025-59950 | FreshRSS: Double clickjacking can lead to privilege escalationFreshRSS · FreshRSS | Medium6.7 |
| CVE-2025-61586 | FreshRSS is vulnerable to directory enumeration by setting path in its theme fieldFreshRSS · FreshRSS | Medium6.9 |
| CVE-2025-59948 | FreshRSS is vulnerable to XSS due to lack of CSP on HTML query pageFreshRSS · FreshRSS | Medium6.7 |
| CVE-2025-57769 | FressRSS: Clickjacking can lead to XSS and/or privilege escalationFreshRSS · FreshRSS | Medium5.3 |
| CVE-2025-54875 | FreshRSS: Unauthorized creation of admin user when registration is enabledFreshRSS · FreshRSS | Critical9.8 |
| CVE-2025-54592 | FreshRSS has Incomplete Session Termination on LogoutFreshRSS · FreshRSS | High8.8 |
| CVE-2025-54591 | FreshRSS: Unauthenticated users can view default user's informationFreshRSS · FreshRSS | High7.5 |
| CVE-2025-54593 | FreshRSS is vulnerable to RCE attacks by authenticated adminFreshRSS · FreshRSS | High7.2 |
| CVE-2025-46341 | Privilege escalation via SSRF when using HTTP authFreshRSS · FreshRSS | High7.1 |
| CVE-2025-46339 | FreshRSS vulnerable to favicon cache poisoning via proxyFreshRSS · FreshRSS | Medium4.3 |
| CVE-2025-32015 | FreshRSS vulnerable to Cross-site Scripting by embedding <script> tag inside <iframe srcdoc>FreshRSS · FreshRSS | Medium6.7 |
| CVE-2025-31482 | FreshRSS vulnerable to DoS by malicious feed entry loading logout URLFreshRSS · FreshRSS | Medium4.3 |
| CVE-2025-31136 | FreshRSS vulnerable to Cross-site Scripting by <iframe>'ing a vulnerable same-origin page in a feed entryFreshRSS · FreshRSS | Medium6.7 |
| CVE-2025-31134 | FreshRSS vulnerable to directory enumeration via ext.phpFreshRSS · FreshRSS | Medium5.5 |
| CVE-2023-22481 | Sensitive information exposure in the logs of greader API in FreshRSSFreshRSS · FreshRSS | Medium4.0 |
| CVE-2022-23497 | Insecure file access in FreshRSSFreshRSS · FreshRSS | Medium6.5 |