Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 4 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 400,411All CVEsplus 18,890 rejected
- 426Last 24 hours3,007 in the last 7 days
- 17,381Last 30 days1,592 of them critical
- 1,767Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 13 | 26 | 9 | 0 | 0 | 48 | 400 |
| 2025 | 14 | 52 | 39 | 0 | 0 | 105 | 352 |
| 2024 | 41 | 111 | 24 | 0 | 0 | 176 | 247 |
| 2023 | 29 | 31 | 9 | 0 | 0 | 69 | 71 |
| 2022 | 0 | 0 | 0 | 0 | 0 | 0 | 2 |
| 2021 | 0 | 0 | 2 | 0 | 0 | 2 | 2 |
| Title | ||
|---|---|---|
| CVE-2026-118527 | Use of predictable filenames in Ivanti Connect Secure before versions 25.1.1.3 and 22.8R2.6 allows a remote authenticated attacker to upload files with…ExploitedIvanti · Connect Secure | Medium4.3 |
| CVE-2026-111357 | Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root,…ExploitedIvanti · Connect Secure | High7.0 |
| CVE-2026-109412 | An exposed dangerous endpoint in Ivanti Neurons Patch for Intune allows a remote authenticated attacker to leak sensitive authentication information.Ivanti · Neurons Patch for Intune | Critical9.9 |
| CVE-2026-106047 | A Path Traversal vulnerability in the template export functionality of Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to read…Ivanti · Xtraction | High7.7 |
| CVE-2026-106043 | A Missing Authentication for Critical Function vulnerability in Ivanti Xtraction before version 2026.4 allows a remote unauthenticated attacker to create,…Ivanti · Xtraction | High7.5 |
| CVE-2026-106042 | An External Control of File Name or Path vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to redirect…Ivanti · Xtraction | Critical9.9 |
| CVE-2026-106035 | An Information Exposure Through Log Files vulnerability in Ivanti Xtraction Cloud Sync before version 2026.4 allows a remote authenticated attacker to disclose…Ivanti · Xtraction | Medium5.5 |
| CVE-2026-106034 | A Path Traversal vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to create, modify, arbitrary directories the…Ivanti · Xtraction | Medium5.0 |
| CVE-2026-104935 | Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact…ExploitedIvanti · Connect Secure | High8.6 |
| CVE-2026-12647 | A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.Ivanti · Ivanti Neurons for ITSM | Critical9.9 |
| CVE-2026-12646 | A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.Ivanti · Ivanti Neurons for ITSM | Critical9.9 |
| CVE-2026-12645 | A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.Ivanti · Ivanti Neurons for ITSM | Critical9.9 |
| CVE-2026-83527 | An Authentication Bypass vulnerability in Sentry before R10.8.2, R10.7.3 and R10.6.4 allows a remote unauthenticated attacker to gain administrative level…Ivanti · Sentry | High8.1 |
| CVE-2026-12648 | A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on…Ivanti · Neurons for ITSM | High8.8 |
| CVE-2026-12650 | A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on…Ivanti · Neurons for ITSM | Critical9.9 |
| CVE-2026-12651 | A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on…Ivanti · Neurons for ITSM | High8.8 |
| CVE-2026-12745 | A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote unauthenticated attacker to execute arbitrary code…Ivanti · Neurons for ITSM | Critical9.8 |
| CVE-2026-12744 | A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote unauthenticated attacker to execute arbitrary code…Ivanti · Neurons for ITSM | Critical9.8 |
| CVE-2026-18851 | Missing authorization in Ivanti Endpoint Manager Mobile before version 12.10.0.0, 12.9.0.2, and 12.8.0.4 allows a remote authenticated attacker to escalate…Ivanti · Endpoint Manager Mobile | High8.8 |
| CVE-2026-18129 | Cleartext transmission of sensitive information in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a remote unauthenticated attacker in a…Ivanti · Endpoint Manager | High8.1 |
| CVE-2026-18127 | External control of a filename in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a remote authenticated attacker full write control over an…Ivanti · Endpoint Manager | High7.7 |
| CVE-2026-18125 | An out-of-bounds read in the Agent of Ivanti Endpoint Manager before version 2024 SU7 allows a remote unauthenticated attacker to crash an agent service.Ivanti · Endpoint Manager | High7.5 |
| CVE-2026-14903 | Path traversal in Ivanti Xtraction before version 2026.2.1 allows a remote authenticated attacker to read arbitrary files outside the web root.ivanti · Xtraction | High7.7 |
| CVE-2026-14902 | An open redirect in Ivanti Xtraction before version 2026.2.1 allows a remote unauthenticated attacker to redirect users to arbitrary external URLs.ivanti · Xtraction | Medium4.0 |
| CVE-2026-10727 | An OS command injection vulnerability in Ivanti EPMM before 12.9.0.1, 12.8.0.3 and 12.7.0.2 versions allows a remote authenticated attacker to execute…Ivanti · Endpoint Manager Mobile | High7.2 |
| CVE-2026-10523 | An Authentication Bypass vulnerability (CWE-288) in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated attacker to…ivanti · Sentry | Critical9.9 |
| CVE-2026-10520 | An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated user to achieve…Exploitedivanti · Sentry | Critical10.0 |
| CVE-2026-9614 | An Improper Access Control vulnerability in Ivanti Neurons for ITSM (cloud and on-premises) allows a remote authenticated attacker to gain administrative…Ivanti · Neurons for ITSM (On-Premises) | High8.8 |
| CVE-2026-8992 | An improper certificate validation vulnerability in Ivanti Secure Access Client before 22.8R6 allows a remote unauthenticated attacker to execute arbitrary…ivanti · Secure Access Client | High8.8 |
| CVE-2026-8111 | SQL injection in the web console of Ivanti Endpoint Manager before version 2024 SU6 allows a remote authenticated attacker to achieve remote code execution.ivanti · Endpoint Manager | High8.8 |
| CVE-2026-8110 | Incorrect permissions assignment in the agent of Ivanti Endpoint Manager before version 2024 SU6 allows a local authenticated attacker to escalate their…ivanti · Endpoint Manager | High7.8 |
| CVE-2026-8109 | An exposed dangerous method on the Core Server of Ivanti Endpoint Manager before version 2024 SU6 allows a remote authenticated attacker to leak access…ivanti · Endpoint Manager | Medium6.5 |
| CVE-2026-8051 | OS command injection in Ivanti Virtual Traffic Manager before version 22.9r4 allows a remote authenticated attacker with admin privileges to achieve remote…ivanti · Virtual Traffic Manager | High7.2 |
| CVE-2026-7432 | A race condition in Ivanti Secure Access Client before 22.8R6 allows a locally authenticated user to escalate privileges to SYSTEMivanti · Secure Access Client | High7.8 |
| CVE-2026-7431 | An incorrect permission assignment for critical resource of Ivanti Secure Access Client before 22.8R6 allows a local authenticated user to read or modify…ivanti · Secure Access Client | Medium4.4 |
| CVE-2026-8043 | External control of a file name in Ivanti Xtraction before version 2026.2 allows a remote authenticated attacker to read sensitive files and write arbitrary…ivanti · Xtraction | Critical9.6 |
| CVE-2026-5787 | An Improper Certificate Validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote unauthenticated attacker to impersonate…Ivanti · Endpoint Manager Mobile | High8.9 |
| CVE-2026-5788 | An Improper Access Control in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote unauthenticated attacker to invoke arbitrary methods.Ivanti · Endpoint Manager Mobile | High7.0 |
| CVE-2026-7821 | Improper certificate validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote unauthenticated attacker to enroll a device…Ivanti · Endpoint Manager Mobile | High7.4 |
| CVE-2026-6973 | An Improper Input Validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remotely authenticated user with administrative access to…ExploitedIvanti · Endpoint Manager Mobile | High7.2 |
| CVE-2026-5786 | An Improper Access Control vulnerability in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote authenticated attacker to gain…Ivanti · Endpoint Manager Mobile | High8.8 |
| CVE-2026-4914 | Stored XSS in Ivanti N-ITSM before version 2025.4 allows a remote authenticated attacker to obtain limited information from other user sessions. User…Ivanti · Neurons for ITSM (On-Premise) | Medium5.4 |
| CVE-2026-4913 | Improper protection of an alternate path in Ivanti N-ITSM before version 2025.4 allows a remote authenticated attacker to retain access when their account has…Ivanti · Neurons for ITSM (On-Premise) | Medium5.7 |
| CVE-2026-3483 | An exposed dangerous method in Ivanti DSM before version 2026.1.1 allows a local authenticated attacker to escalate their privileges.Ivanti · Desktop and Server Management | High7.8 |
| CVE-2026-1603 | An authentication bypass in Ivanti Endpoint Manager before version 2024 SU5 allows a remote unauthenticated attacker to leak specific stored credential data.ExploitedIvanti · Endpoint Manager | High8.6 |
| CVE-2026-1602 | SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database.Ivanti · Endpoint Manager | Medium6.5 |
| CVE-2026-1340 | A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.ExploitedIvanti · Endpoint Manager Mobile | Critical9.8 |
| CVE-2026-1281 | A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.ExploitedIvanti · Endpoint Manager Mobile | Critical9.8 |
| CVE-2025-13662 | Improper verification of cryptographic signatures in the patch management component of Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote…Ivanti · Endpoint Manager | High7.8 |
| CVE-2025-13661 | Path traversal in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote authenticated attacker to write arbitrary files outside of the intended…Ivanti · Endpoint Manager | High7.1 |