Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 8 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 400,109All CVEsplus 18,875 rejected
- 775Last 24 hours3,263 in the last 7 days
- 17,390Last 30 days1,568 of them critical
- 1,767Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 0 | 0 | 0 | 0 | 0 | 0 | 470 |
| 2025 | 0 | 0 | 0 | 0 | 0 | 0 | 470 |
| 2024 | 0 | 0 | 0 | 0 | 0 | 0 | 470 |
| 2023 | 0 | 0 | 0 | 0 | 0 | 0 | 470 |
| 2022 | 0 | 0 | 0 | 0 | 0 | 0 | 470 |
| 2021 | 0 | 0 | 0 | 0 | 0 | 0 | 470 |
| 2020 | 0 | 0 | 0 | 0 | 0 | 0 | 470 |
| 2019 | 4 | 6 | 5 | 0 | 0 | 15 | 470 |
| 2018 | 25 | 356 | 66 | 2 | 0 | 449 | 455 |
| 2017 | 4 | 2 | 0 | 0 | 0 | 6 | 6 |
| Title | ||
|---|---|---|
| CVE-2017-0938 | Denial of Service attack in airMAX < 8.3.2 , airMAX < 6.0.7 and EdgeMAX < 1.9.7 allow attackers to use the Discovery Protocol in amplification attacks.HackerOne · airMAX, EdgeMAX | High7.5 |
| CVE-2018-16493 | A path traversal vulnerability was found in module static-resource-server 1.7.2 that allows unauthorized read access to any file on the server by appending…HackerOne · static-resource-server | High7.5 |
| CVE-2018-16492 | A prototype pollution vulnerability was found in module extend <2.0.2, ~<3.0.2 that allows an attacker to inject arbitrary properties onto Object.prototype.HackerOne · extend | Critical9.8 |
| CVE-2018-16491 | A prototype pollution vulnerability was found in node.extend <1.1.7, ~<2.0.1 that allows an attacker to inject arbitrary properties onto Object.prototype.HackerOne · node.extend | Critical9.8 |
| CVE-2018-16490 | A prototype pollution vulnerability was found in module mpath <0.5.1 that allows an attacker to inject arbitrary properties onto Object.prototype.HackerOne · mpath | High7.5 |
| CVE-2018-16489 | A prototype pollution vulnerability was found in just-extend <4.0.0 that allows attack to inject properties onto Object.prototype through its functions.HackerOne · just-extend | Critical9.8 |
| CVE-2018-16487 | A prototype pollution vulnerability was found in lodash <4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying…HackerOne · lodash | Medium5.6 |
| CVE-2018-16486 | A prototype pollution vulnerability was found in defaults-deep <=0.2.4 that would allow a malicious user to inject properties onto Object.prototype.HackerOne · defaults-deep | Critical9.8 |
| CVE-2018-16485 | Path Traversal vulnerability in module m-server <1.4.1 allows malicious user to access unauthorized content of any file in the directory tree e.g. /etc/passwd…HackerOne · m-server | Medium6.5 |
| CVE-2018-16484 | A XSS vulnerability was found in module m-server <1.4.2 that allows malicious Javascript code or HTML to be executed, due to the lack of escaping for special…HackerOne · m-server | Medium5.4 |
| CVE-2018-16483 | A deficiency in the access control in module express-cart <=1.1.5 allows unprivileged users to add new users to the application as administrators.HackerOne · express-cart | High8.8 |
| CVE-2018-16482 | A server directory traversal vulnerability was found on node module mcstatic <=0.0.20 that would allow an attack to access sensitive information in the file…HackerOne · mcstatic | High7.5 |
| CVE-2018-16481 | A XSS vulnerability was found in html-page <=2.1.1 that allows malicious Javascript code to be executed in the user's browser due to the absence of…HackerOne · html-pages | Medium6.1 |
| CVE-2018-16480 | A XSS vulnerability was found in module public <0.1.4 that allows malicious Javascript code to run in the browser, due to the absence of sanitization of the…HackerOne · public | Medium6.1 |
| CVE-2018-16479 | Path traversal vulnerability in http-live-simulator <1.0.7 causes unauthorized access to arbitrary files on disk by appending extra slashes after the URL.HackerOne · http-live-simulator | High7.5 |
| CVE-2018-16469 | The merge.recursive function in the merge package <1.2.1 can be tricked into adding or modifying properties of the Object prototype. These properties will be…HackerOne · merge | High7.5 |
| CVE-2018-3787 | Path traversal in simplehttpserver <v0.2.1 allows listing any file on the server.HackerOne · simplehttpserver | High7.5 |
| CVE-2018-3776 | Improper input validator in Nextcloud Server prior to 12.0.3 and 11.0.5 could lead to an attacker's actions not being logged in the audit log.HackerOne · Nextcloud Server | Medium5.3 |
| CVE-2018-3775 | Improper Authentication in Nextcloud Server prior to version 12.0.3 would allow an attacker that obtained user credentials to bypass the 2 Factor…HackerOne · Nextcloud Server | High8.8 |
| CVE-2018-3774 | Incorrect parsing in url-parse <1.4.3 returns wrong hostname which leads to multiple vulnerabilities such as SSRF, Open Redirect, Bypass Authentication…HackerOne · url-parse | Critical10.0 |
| CVE-2018-3779 | active-support ruby gem 5.2.0 could allow a remote attacker to execute arbitrary code on the system, caused by containing a malicious backdoor. An attacker…HackerOne · active-support ruby gem | Critical9.8 |
| CVE-2018-3778 | Improper authorization in aedes version <0.35.0 will publish a LWT in a channel when a client is not authorized.HackerOne · aedes | Medium5.3 |
| CVE-2018-3771 | An XSS in statics-server <= 0.0.9 can be used via injected iframe in the filename when statics-server displays directory index in the browser.HackerOne · statics-server | Medium6.1 |
| CVE-2018-3770 | A path traversal exists in markdown-pdf version <9.0.0 that allows a user to insert a malicious html code that can result in reading the local files.HackerOne · markdown-pdf | Medium5.5 |
| CVE-2018-3760 | There is an information leak vulnerability in Sprockets. Versions Affected: 4.0.0.beta7 and lower, 3.7.1 and lower, 2.12.4 and lower. Specially crafted…HackerOne · Sprockets | High7.5 |
| CVE-2018-3759 | private_address_check ruby gem before 0.5.0 is vulnerable to a time-of-check time-of-use (TOCTOU) race condition due to the address the socket uses not being…HackerOne · private_address_check ruby gem | Low3.7 |
| CVE-2018-3758 | Unrestricted file upload (RCE) in express-cart module before 1.1.7 allows a privileged user to gain access in the hosting machine.HackerOne · express-cart | High8.8 |
| CVE-2018-3739 | https-proxy-agent before 2.1.1 passes auth option to the Buffer constructor without proper sanitization, resulting in DoS and uninitialized memory leak in…HackerOne · https-proxy-agent node module | Critical9.1 |
| CVE-2018-3738 | protobufjs is vulnerable to ReDoS when parsing crafted invalid .proto files.HackerOne · protobufjs node module | Medium5.5 |
| CVE-2018-3737 | sshpk is vulnerable to ReDoS when parsing crafted invalid public keys.HackerOne · sshpk node module | High7.5 |
| CVE-2018-3735 | bracket-template suffers from reflected XSS possible when variable passed via GET parameter is used in templateHackerOne · bracket-template node module | Medium6.1 |
| CVE-2018-3732 | resolve-path node module before 1.4.0 suffers from a Path Traversal vulnerability due to lack of validation of paths with certain special characters, which…HackerOne · resolve-path node module | High7.5 |
| CVE-2018-3731 | public node module suffers from a Path Traversal vulnerability due to lack of validation of filePath, which allows a malicious user to read content of any file…HackerOne · public node module | High7.5 |
| CVE-2018-3730 | mcstatic node module suffers from a Path Traversal vulnerability due to lack of validation of filePath, which allows a malicious user to read content of any…HackerOne · mcstatic node module | High7.5 |
| CVE-2018-3729 | localhost-now node module suffers from a Path Traversal vulnerability due to lack of validation of file, which allows a malicious user to read content of any…HackerOne · localhost-now node module | High7.5 |
| CVE-2018-3727 | 626 node module suffers from a Path Traversal vulnerability due to lack of validation of file, which allows a malicious user to read content of any file with…HackerOne · 626 node module | High7.5 |
| CVE-2018-3726 | crud-file-server node module before 0.8.0 suffers from a Cross-Site Scripting vulnerability to a lack of validation of file names.HackerOne · crud-file-server node module | Medium6.1 |
| CVE-2018-3725 | hekto node module suffers from a Path Traversal vulnerability due to lack of validation of file, which allows a malicious user to read content of any file with…HackerOne · hekto node module | High7.5 |
| CVE-2018-3724 | general-file-server node module suffers from a Path Traversal vulnerability due to lack of validation of currpath, which allows a malicious user to read…HackerOne · general-file-server node module | High7.5 |
| CVE-2018-3723 | defaults-deep node module before 0.2.4 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability, which allows a malicious user to modify the…HackerOne · defaults-deep node module | High8.8 |
| CVE-2018-3722 | merge-deep node module before 3.0.1 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability, which allows a malicious user to modify the…HackerOne · merge-deep node module | High8.8 |
| CVE-2018-3721 | lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via defaultsDeep, merge, and mergeWith functions,…HackerOne · lodash node module | Medium6.5 |
| CVE-2018-3720 | assign-deep node module before 0.4.7 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability, which allows a malicious user to modify the…HackerOne · assign-deep node module | High8.8 |
| CVE-2018-3719 | mixin-deep node module before 1.3.1 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability, which allows a malicious user to modify the…HackerOne · mixin-deep node module | High8.8 |
| CVE-2018-3718 | serve node module suffers from Improper Handling of URL Encoding by permitting access to ignored files if a filename is URL encoded.HackerOne · serve node module | Medium5.3 |
| CVE-2018-3717 | connect node module before 2.14.0 suffers from a Cross-Site Scripting (XSS) vulnerability due to a lack of validation of file in directory.js middleware.HackerOne · connect node module | Medium5.4 |
| CVE-2018-3716 | simplehttpserver node module suffers from a Cross-Site Scripting vulnerability to a lack of validation of file names.HackerOne · simplehttpserver node module | Medium5.4 |
| CVE-2018-3715 | glance node module before 3.0.4 suffers from a Path Traversal vulnerability due to lack of validation of path passed to it, which allows a malicious user to…HackerOne · glance node module | Medium6.5 |
| CVE-2018-3714 | node-srv node module suffers from a Path Traversal vulnerability due to lack of validation of url, which allows a malicious user to read content of any file…HackerOne · node-srv node module | Medium6.5 |
| CVE-2018-3713 | angular-http-server node module suffers from a Path Traversal vulnerability due to lack of validation of possibleFilename, which allows a malicious user to…HackerOne · angular-http-server node module | Medium6.5 |