Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 6 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,060All CVEsplus 19,119 rejected
- 493Last 24 hours2,912 in the last 7 days
- 16,873Last 30 days1,544 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 0 | 1 | 9 | 0 | 0 | 10 | 12 |
| 2025 | 0 | 0 | 1 | 0 | 0 | 1 | 2 |
| 2024 | 0 | 1 | 0 | 0 | 0 | 1 | 1 |
| Title | ||
|---|---|---|
| CVE-2026-54738 | Lemmy: Rate limit bypass via X-Forwarded-For header spoofing in actix-web ConnectionInfoLemmyNet · lemmy | Medium6.5 |
| CVE-2026-54743 | Lemmy: Stored XSS via markdown image alt-text in lemmy-ui html5-embedLemmyNet · lemmy | Medium6.4 |
| CVE-2026-54739 | Lemmy: Login Endpoint User Enumeration via HTTP Response Code DifferentialLemmyNet · lemmy | Medium6.9 |
| CVE-2026-54740 | Lemmy: Lower-ranked federated moderator can remove higher-ranked moderatorsLemmyNet · lemmy | Medium6.5 |
| CVE-2026-54741 | Lemmy: Blocked users can edit private messages sent before the blockLemmyNet · lemmy | Medium5.3 |
| CVE-2026-54742 | Lemmy: `CollectionAdd::Featured` does not check the post is in the communityLemmyNet · lemmy | Medium5.1 |
| CVE-2026-42180 | Lemmy: SSRF in /api/v3/post via Webmention dispatchLemmyNet · lemmy | Medium6.3 |
| CVE-2026-42181 | Lemmy: SSRF and internal image disclosure in post link metadata via unvalidated og:imageLemmyNet · lemmy | Medium6.5 |
| CVE-2026-33693 | Lemmy's Activitypub-Federation has SSRF via 0.0.0.0 bypass in activitypub-federation-rust v4_is_invalid()LemmyNet · lemmy | Medium6.5 |
| CVE-2026-29178 | Lemmy: Unauthenticated SSRF via file_type query parameter injection in image endpointLemmyNet · lemmy | High7.7 |
| CVE-2025-25194 | Server-Side Request Forgery (SSRF) in activitypub_federationLemmyNet · lemmy | Medium4.0 |
| CVE-2024-23649 | Any authenticated user may obtain private message details from other users on the same instanceLemmyNet · lemmy | High7.5 |