Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 9 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,082All CVEsplus 19,119 rejected
- 502Last 24 hours2,856 in the last 7 days
- 16,885Last 30 days1,547 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 0 | 3 | 10 | 0 | 0 | 13 | 14 |
| 2025 | 0 | 0 | 0 | 0 | 0 | 0 | 1 |
| 2024 | 0 | 1 | 0 | 0 | 0 | 1 | 1 |
| Title | ||
|---|---|---|
| CVE-2026-92707 | MessagePack: Nested arrays can blow past buffer length limitsMessagePack-CSharp · MessagePack-CSharp | Medium5.3 |
| CVE-2026-48109 | MessagePack-CSharp: LZ4 decompression may fail with AccessViolationException after dereferencing memory from bad inputMessagePack-CSharp · MessagePack-CSharp | High8.2 |
| CVE-2026-48502 | MessagePack-CSharp: Denial of service vulnerabilities can swamp the CPU or crash the process with stack and heap overflowsMessagePack-CSharp · MessagePack-CSharp | High8.2 |
| CVE-2026-48506 | MessagePack-CSharp: MessagePackReader.Skip can recurse without enforcing maximum object graph depthMessagePack-CSharp · MessagePack-CSharp | High7.5 |
| CVE-2026-48509 | MessagePack-CSharp: ASP.NET Core MessagePackInputFormatter defaults to TrustedData for HTTP request bodiesMessagePack-CSharp · MessagePack-CSharp | Medium6.3 |
| CVE-2026-48510 | MessagePack-CSharp: LZ4 decompression allocates from unbounded declared output lengthsMessagePack-CSharp · MessagePack-CSharp | Medium6.3 |
| CVE-2026-48511 | MessagePack-CSharp: ExpandoObject formatter can perform quadratic insertion work on untrusted mapsMessagePack-CSharp · MessagePack-CSharp | Medium6.3 |
| CVE-2026-48512 | MessagePack-CSharp: JSON conversion APIs can recurse without consistent depth enforcementMessagePack-CSharp · MessagePack-CSharp | Medium6.3 |
| CVE-2026-48513 | MessagePack-CSharp: DynamicUnionResolver generated deserializers miss depth enforcementMessagePack-CSharp · MessagePack-CSharp | Medium6.3 |
| CVE-2026-48514 | MessagePack-CSharp: Unity unsafe blit formatter allocates from unbounded byte lengthMessagePack-CSharp · MessagePack-CSharp | Medium6.3 |
| CVE-2026-48515 | MessagePack-CSharp: Multi-dimensional array formatters allocate from unchecked dimensionsMessagePack-CSharp · MessagePack-CSharp | Medium6.3 |
| CVE-2026-48516 | MessagePack-CSharp: InterfaceLookupFormatter bypasses collision-resistant comparer settingsMessagePack-CSharp · MessagePack-CSharp | Medium6.3 |
| CVE-2026-48517 | MessagePack-CSharp: Typeless deserialization type restrictions do not recurse into arrays or generic argumentsMessagePack-CSharp · MessagePack-CSharp | Medium6.3 |
| CVE-2024-48924 | MessagePack allows untrusted data to lead to DoS attack due to hash collisions and stack overflowMessagePack-CSharp · MessagePack-CSharp | High8.7 |