Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 3 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,257All CVEsplus 19,138 rejected
- 475Last 24 hours2,755 in the last 7 days
- 16,914Last 30 days1,554 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 5 | 7 | 0 | 0 | 0 | 12 | 15 |
| 2025 | 0 | 1 | 2 | 0 | 0 | 3 | 3 |
| Title | ||
|---|---|---|
| CVE-2026-119706 | LMDeploy 0.9.0 through 0.18.0 Unauthenticated RCE via /update_weights Pickle DeserializationInternLM · lmdeploy | Critical9.3 |
| CVE-2026-105135 | InternLM MindSearch Planner Agent graph.py ExecutionAction.run code injectionInternLM · MindSearch | Critical10.0 |
| CVE-2026-33625 | LMDeploy vulnerable to arbitrary code execution via eval() of untrusted quant_dtype in model config loadingInternLM · lmdeploy | High8.8 |
| CVE-2025-66455 | LMDeploy has Remote Code Execution by Pickle Deserialization via handle_zmq_recv in lmdeploy/lmdeploy/pytorch/disagg/conn/engine_conn.pyInternLM · lmdeploy | Critical9.8 |
| CVE-2026-92983 | InternLM LMDeploy through 0.17.0 Memory Exhaustion via Session ID MismatchInternLM · lmdeploy | High8.7 |
| CVE-2026-92971 | InternLM LMDeploy through 0.17.0 Assertion Denial of ServiceInternLM · lmdeploy | High8.7 |
| CVE-2025-59953 | LMdeploy has Remote Code Execution by Pickle Deserialization via zmq_rpc.call_and_response() in InterLM/lmdeployInternLM · lmdeploy | Critical9.8 |
| CVE-2026-76850 | LMDeploy Remote Code Execution via Unsafe Pickle Deserialization in the Disaggregated Serving Peer ConnectorInternLM · lmdeploy | Critical9.3 |
| CVE-2026-63764 | LMDeploy Server-Side Request Forgery via HTTP Redirect BypassInternLM · lmdeploy | High7.7 |
| CVE-2026-46517 | LMDeploy: Hardcoded trust_remote_code=True is an implicit unsafe remote-code load path with no user opt-outInternLM · lmdeploy | High7.8 |
| CVE-2026-46432 | LMDeploy: Arbitrary code execution via hardcoded trust_remote_code=True in lmdeploy model initializationInternLM · lmdeploy | High7.8 |
| CVE-2026-33626 | LMDeploy Vulnerable to Server-Side Request Forgery (SSRF) via Vision-Language Image LoadingInternLM · lmdeploy | High7.5 |
| CVE-2025-67729 | lmdeploy vulnerable to Arbitrary Code Execution via Insecure Deserialization in torch.load()InternLM · lmdeploy | High8.8 |
| CVE-2025-3163 | InternLM LMDeploy conf.py open code injectionInternLM · LMDeploy | Medium4.8 |
| CVE-2025-3162 | InternLM LMDeploy PT File utils.py load_weight_ckpt deserializationInternLM · LMDeploy | Medium4.8 |