Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read just now.
At a glance
Published CVEs; rejected ones are not counted.
- 400,985All CVEsplus 19,118 rejected
- 417Last 24 hours2,843 in the last 7 days
- 16,805Last 30 days1,543 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 1 | 3 | 2 | 0 | 0 | 6 | 31 |
| 2025 | 1 | 5 | 4 | 2 | 0 | 12 | 25 |
| 2024 | 1 | 1 | 1 | 1 | 0 | 4 | 13 |
| 2023 | 0 | 0 | 1 | 0 | 0 | 1 | 9 |
| 2022 | 0 | 2 | 1 | 0 | 0 | 3 | 8 |
| 2021 | 0 | 3 | 2 | 0 | 0 | 5 | 5 |
| Title | ||
|---|---|---|
| CVE-2026-61552 | Icinga 2 DSL Injection via Unescaped Import Template NameIcinga · icinga2 | High7.2 |
| CVE-2026-61551 | Icinga 2: Stack overflow via deeply nested JSON objectsIcinga · icinga2 | High8.6 |
| CVE-2026-61550 | Icinga 2: Improper access control for JSON-RPC update certificate messagesIcinga · icinga2 | Critical9.8 |
| CVE-2026-42224 | ipl/web is vulnerable to reflected XSS by malformed search requestsIcinga · ipl-web | High7.6 |
| CVE-2026-24414 | Icinga for Windows certificate can have too-open permissionsIcinga · icinga-powershell-framework | Medium6.8 |
| CVE-2026-24413 | Icinga has insecure permission of %ProgramData%\icinga2\var on WindowsIcinga · icinga2 | Medium6.8 |
| CVE-2025-61909 | Icinga 2 signals sent as root to processes based on PID file written by the Icinga 2 daemon userIcinga · icinga2 | Medium4.0 |
| CVE-2025-61908 | Icinga 2 Denial of Service (DoS) By Dereferencing Invalid ReferenceIcinga · icinga2 | High7.1 |
| CVE-2025-61907 | Icinga 2 API users could access restricted values in filter expressionsIcinga · icinga2 | High7.1 |
| CVE-2025-61789 | Icinga DB Web hidden/protected custom variables are prone to filter enumerationIcinga · icingadb-web | Medium5.3 |
| CVE-2025-53840 | Icinga DB Web Exposure of Sensitive Information to an Unauthorized Actor vulnerabilityIcinga · icingadb-web | Low2.4 |
| CVE-2025-48057 | Icinga 2 certificate renewal might incorrectly renew an invalid certificateIcinga · icinga2 | Critical9.3 |
| CVE-2025-30164 | Icinga Web 2 has open redirect on login pageIcinga · icingaweb2 | Medium4.1 |
| CVE-2025-27609 | Icinga Web 2 Vulnerable to Reflected XSSIcinga · icingaweb2 | Low1.1 |
| CVE-2025-27406 | Icinga Reporting Stored XSS leads to SSRFIcinga · icingaweb2-module-reporting | High7.7 |
| CVE-2025-27405 | Icinga Web 2 has XSS in embedded contentIcinga · icingaweb2 | High7.7 |
| CVE-2025-27404 | Icinga Web 2 DOM-based XSS vulnerabilityIcinga · icingaweb2 | High7.7 |
| CVE-2025-23203 | Icinga has rest API endpoints accessible to restricted usersIcinga · icingaweb2-module-director | Medium5.5 |
| CVE-2024-49369 | Icinga 2 has a TLS Certificate Validation Bypass for JSON-RPC and HTTP API ConnectionsIcinga · icinga2 | Critical9.8 |
| CVE-2024-41811 | ipl/web susceptible to Cross-Site Request Forgery (CSRF)Icinga · ipl-web | Low3.9 |
| CVE-2024-24819 | icingaweb2-module-incubator base implementation for HTML forms is susceptible to CSRFIcinga · icingaweb2-module-incubator | Medium5.3 |
| CVE-2024-24820 | Icinga Director configuration is susceptible to Cross-Site Request ForgeryIcinga · icingaweb2-module-director | High8.3 |
| CVE-2023-30607 | icingaweb2-module-jira template and field configuration are susceptible to CSRFIcinga · icingaweb2-module-jira | Medium5.0 |
| CVE-2022-24714 | Disclosure of hosts and related data, linked to decommissioned services in Icinga Web 2Icinga · icingaweb2 | Medium5.3 |
| CVE-2022-24716 | Path traversal in Icinga Web 2Icinga · icingaweb2 | High7.5 |
| CVE-2022-24715 | Arbitrary code execution for authenticated users in Icinga Web 2Icinga · icingaweb2 | High8.5 |
| CVE-2021-37698 | Missing TLS service certificate validation in GelfWriter, ElasticsearchWriter, InfluxdbWriter and Influxdb2WriterIcinga · icinga2 | High7.5 |
| CVE-2021-32743 | Passwords used to access external services inadvertently exposed through APIIcinga · icinga2 | High8.8 |
| CVE-2021-32739 | Results of queries for ApiListener objects include the ticket salt which allows in turn to steal (more privileged) identitiesIcinga · icinga2 | High8.8 |
| CVE-2021-32747 | Custom variable protection and blacklists can be circumventedIcinga · icingaweb2 | Medium5.3 |
| CVE-2021-32746 | Possible path traversal by use of the `doc` moduleIcinga · icingaweb2 | Medium5.3 |