Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read just now.
At a glance
Published CVEs; rejected ones are not counted.
- 401,089All CVEsplus 19,119 rejected
- 503Last 24 hours2,853 in the last 7 days
- 16,878Last 30 days1,552 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 0 | 1 | 4 | 0 | 1 | 6 | 35 |
| 2025 | 4 | 6 | 0 | 0 | 0 | 10 | 29 |
| 2024 | 4 | 1 | 2 | 1 | 0 | 8 | 19 |
| 2023 | 0 | 0 | 1 | 0 | 0 | 1 | 11 |
| 2022 | 1 | 2 | 4 | 0 | 0 | 7 | 10 |
| 2021 | 1 | 1 | 1 | 0 | 0 | 3 | 3 |
| Title | ||
|---|---|---|
| CVE-2026-120988 | billboard.js before 4.1.3 allows an attacker to execute malicious JavaScript due to improper sanitization of series ids during legend template rendering.NAVER · billboard.js | Medium6.1 |
| CVE-2026-120987 | Whale Browser before 5.39.412.57 allows an attacker to bypass the iframe sandbox in a dual-tab environment.NAVER · NAVER Whale browser | Not scored |
| CVE-2026-8148 | NAVER MYBOX Explorer for Windows before 3.0.11.160 allows a local attacker to escalate privileges to NT AUTHORITY\SYSTEM via registry manipulation due to…NAVER · NAVER MYBOX Explorer | High7.8 |
| CVE-2026-1513 | billboard.js before 3.18.0 allows an attacker to execute malicious JavaScript due to improper sanitization during chart option binding.NAVER · billboard.js | Medium6.1 |
| CVE-2026-23769 | lucy-xss-filter before commit e5826c0 allows an attacker to execute malicious JavaScript due to improper sanitization caused by misconfigured default superset…NAVER · lucy-xss-filter | Medium6.5 |
| CVE-2026-23768 | lucy-xss-filter before commit 7c1de6d allows an attacker to induce server-side HEAD requests to arbitrary URLs when the ObjectSecurityListener or…NAVER · lucy-xss-filter | Medium6.1 |
| CVE-2025-69235 | Whale browser before 4.35.351.12 allows an attacker to bypass the Same-Origin Policy in a sidebar environment.NAVER · NAVER Whale browser | High7.5 |
| CVE-2025-69234 | Whale browser before 4.35.351.12 allows an attacker to escape the iframe sandbox in a sidebar environment.NAVER · NAVER Whale browser | Critical9.1 |
| CVE-2025-62585 | Whale browser before 4.33.325.17 allows an attacker to bypass the Content Security Policy via a specific scheme in a dual-tab environment.NAVER · NAVER Whale browser | High7.5 |
| CVE-2025-62584 | Whale browser before 4.33.325.17 allows an attacker to bypass the Same-Origin Policy in a dual-tab environment.NAVER · NAVER Whale browser | High7.5 |
| CVE-2025-62583 | Whale Browser before 4.33.325.17 allows an attacker to escape the iframe sandbox in a dual-tab environment.NAVER · NAVER Whale browser | Critical9.8 |
| CVE-2025-58323 | NAVER MYBOX Explorer for Windows before 3.0.8.133 allows a local attacker to escalate privileges to NT AUTHORITY\SYSTEM by executing arbitrary files due to…NAVER · NAVER MYBOX Explorer | High7.7 |
| CVE-2025-58322 | NAVER MYBOX Explorer for Windows before 3.0.8.133 allows a local attacker to escalate privileges to NT AUTHORITY\SYSTEM by invoking arbitrary DLLs due to…NAVER · NAVER MYBOX Explorer | High7.8 |
| CVE-2025-53600 | Whale browser before 4.32.315.22 allow an attacker to bypass the Same-Origin Policy in a dual-tab environment.NAVER · NAVER Whale browser | High7.5 |
| CVE-2025-53599 | Whale browser for iOS before 3.9.1.4206 allow an attacker to execute malicious scripts in the browser via a crafted javascript scheme.NAVER · NAVER Whale browser | Critical9.8 |
| CVE-2025-49223 | billboard.js before 3.15.1 was discovered to contain a prototype pollution via the function generate, which could allow attackers to execute arbitrary code or…NAVER · billboard.js | Critical9.8 |
| CVE-2024-50583 | Whale browser Installer before 3.1.0.0 allows an attacker to execute a malicious DLL in the user environment due to improper permission settings.NAVER · Naver Whale browser Installer | Medium6.3 |
| CVE-2024-40618 | Whale browser before 3.26.244.21 allows an attacker to execute malicious JavaScript due to improper sanitization when processing a built-in extension.NAVER · NAVER Whale browser | Critical9.6 |
| CVE-2024-28216 | nGrinder before 3.5.9 allows an attacker to obtain the results of webhook requests due to lack of access control, which could be the cause of information…NAVER · nGrinder | Medium5.4 |
| CVE-2024-28215 | nGrinder before 3.5.9 allows an attacker to create or update webhook configuration due to lack of access control, which could be the cause of information…NAVER · nGrinder | High7.5 |
| CVE-2024-28214 | nGrinder before 3.5.9 allows to set delay without limitation, which could be the cause of Denial of Service by remote attacker.NAVER · nGrinder | Low2.7 |
| CVE-2024-28213 | nGrinder before 3.5.9 allows to accept serialized Java objects from unauthenticated users, which could allow remote attacker to execute arbitrary code via…NAVER · nGrinder | Critical9.8 |
| CVE-2024-28212 | nGrinder before 3.5.9 uses old version of SnakeYAML, which could allow remote attacker to execute arbitrary code via unsafe deserialization.NAVER · nGrinder | Critical9.8 |
| CVE-2024-28211 | nGrinder before 3.5.9 allows connection to malicious JMX/RMI server by default, which could be the cause of executing arbitrary code via RMI registry by remote…NAVER · nGrinder | Critical9.8 |
| CVE-2023-25632 | The Android Mobile Whale browser app before 3.0.1.2 allows the attacker to bypass its browser unlock function via 'Open in Whale' feature.NAVER · NAVER Whale browser | Medium5.5 |
| CVE-2020-9754 | NAVER Whale browser mobile app before 1.10.6.2 allows the attacker to bypass its browser unlock function via incognito mode.NAVER · NAVER Whale browser | Medium5.3 |
| CVE-2022-24077 | Naver Cloud Explorer Beta allows the attacker to execute arbitrary code as System privilege via malicious DLL injection.NAVER · NAVER Cloud Explorer Beta | High7.8 |
| CVE-2022-24075 | Whale browser before 3.12.129.18 allowed extensions to replace JavaScript files of the HWP viewer website which could access to local HWP files. When the HWP…NAVER · NAVER Whale browser | Medium6.5 |
| CVE-2022-24074 | Whale Bridge, a default extension in Whale browser before 3.12.129.18, allowed to receive any SendMessage request from the content script itself that could…NAVER · NAVER Whale browser | Critical9.8 |
| CVE-2022-24073 | The Web Request API in Whale browser before 3.12.129.18 allowed to deny access to the extension store or redirect to any URL when users access the store.NAVER · NAVER Whale browser | High7.1 |
| CVE-2022-24072 | The devtools API in Whale browser before 3.12.129.18 allowed extension developers to inject arbitrary JavaScript into the extension store web page via…NAVER · NAVER Whale browser | Medium6.1 |
| CVE-2022-24071 | A Built-in extension in Whale browser before 3.12.129.46 allows attackers to compromise the rendering process which could lead to controlling browser internal…NAVER · NAVER Whale browser | Medium4.3 |
| CVE-2021-33593 | Whale browser for iOS before 1.14.0 has an inconsistent user interface issue that allows an attacker to obfuscate the address bar which may lead to address bar…NAVER · NAVER Whale browser | Medium5.3 |
| CVE-2021-33592 | NAVER Toolbar before 4.0.30.323 allows remote attackers to execute arbitrary code via a crafted upgrade.xml file. Special characters in filename parameter can…NAVER · NAVER Toolbar | Critical9.8 |
| CVE-2021-33591 | An exposed remote debugging port in Naver Comic Viewer prior to 1.0.15.0 allowed a remote attacker to execute arbitrary code via a crafted HTML page.NAVER · Naver Comic Viewer | High8.8 |