Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 4 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,167All CVEsplus 19,120 rejected
- 475Last 24 hours2,785 in the last 7 days
- 16,854Last 30 days1,538 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 1 | 7 | 8 | 0 | 0 | 16 | 23 |
| 2025 | 0 | 0 | 0 | 0 | 0 | 0 | 7 |
| 2024 | 3 | 1 | 0 | 0 | 0 | 4 | 7 |
| 2023 | 1 | 1 | 0 | 0 | 0 | 2 | 3 |
| 2022 | 0 | 0 | 0 | 0 | 0 | 0 | 1 |
| 2021 | 0 | 0 | 0 | 0 | 0 | 0 | 1 |
| 2020 | 0 | 0 | 0 | 0 | 0 | 0 | 1 |
| 2019 | 0 | 1 | 0 | 0 | 0 | 1 | 1 |
| Title | ||
|---|---|---|
| CVE-2026-71417 | Lemur: Any user can revoke arbitrary certificates at the CA by uploading a duplicate record and revoking itNetflix · lemur | High7.3 |
| CVE-2026-71322 | Lemur: Missing authorization check on POST /certificates/<id>/export for plugins with requires_key = FalseNetflix · lemur | Medium4.3 |
| CVE-2026-71317 | Lemur: Sub-CA creation never checks `AuthorityPermission` on the parent authorityNetflix · lemur | Medium6.5 |
| CVE-2026-70666 | Lemur: Server-Side Request Forgery via the ACME client following server-controlled URLsNetflix · lemur | High7.4 |
| CVE-2026-71303 | Lemur: Incomplete fix for CVE-2026-55166 -- ACME authority update endpoint allows non-admin to replace `acme_url` with internal IP, bypassing allowlistNetflix · lemur | High7.7 |
| CVE-2026-71307 | Lemur: Authenticated low-privilege users can read plaintext destination credentials (SFTP password / private-key passphrase) via the destinations APINetflix · lemur | High7.7 |
| CVE-2026-71308 | Lemur: Unchecked `replaces[]` lets any user silence notifications and hijack auto-rotation for arbitrary certificatesNetflix · lemur | High8.1 |
| CVE-2026-70667 | Lemur: SSRF protection in certificate revocation checking bypassable via HTTP redirects and DNS rebinding (incomplete fix for CVE-2026-55162)Netflix · lemur | Medium6.3 |
| CVE-2026-55164 | Lemur: Plaintext password storage in Lemur user-update pathNetflix · lemur | Medium4.9 |
| CVE-2026-55162 | Lemur: Post-authentication SSRF via certificate verification - attacker-controlled CRL and OCSP URLs in uploaded certificatesNetflix · lemur | Medium6.3 |
| CVE-2026-55166 | Lemur: any SSO-authenticated user achieves AWS IAM compromise and permanent PKI key access via ACME acme_url SSRF and creator-equality IDORNetflix · lemur | Critical9.9 |
| CVE-2026-55163 | Lemur: Privilege escalation via PUT /api/1/roles/<id> — non-admin role members can rewrite role membershipNetflix · lemur | Medium6.3 |
| CVE-2026-55165 | Lemur : JWT verifier trusts attacker-supplied alg from token header — defense-in-depth gap; chain-dependent ATO with secret disclosureNetflix · lemur | Medium4.8 |
| CVE-2026-48508 | Lemur: Authorization bypass in StrictRolePermission / AuthorityCreatorPermissionNetflix · lemur | High8.8 |
| CVE-2026-44305 | Lemur: LDAP TLS certificate verification globally disabled enables credential interceptionNetflix · lemur | Medium6.8 |
| CVE-2026-44304 | Lemur: LDAP Filter Injection enables post-authentication privilege escalationNetflix · lemur | High8.1 |
| CVE-2024-9301 | A path traversal issue in E2Nest prior to commit 8a41948e553c89c56b14410c6ed395e9cfb9250aNetflix · E2Nest | High8.7 |
| CVE-2024-7093 | Server-Side Template Injection in Dispatch Message TemplatesNetflix · Dispatch | Critical9.4 |
| CVE-2024-5023 | Arbitrary File Read Vulnerability in ConsoleMe via Limited Git command RCENetflix · ConsoleMe | Critical9.3 |
| CVE-2024-4701 | Path Traversal vulnerability via File Uploads in GenieNetflix · Genie | Critical9.9 |
| CVE-2023-40171 | Dispatch writes JWT tokens in error messageNetflix · dispatch | Critical9.1 |
| CVE-2023-30797 | Insecure Random Generation in Netflix LemurNetflix · Lemur | High7.5 |
| CVE-2019-10028 | Denial of Service (DOS) in Dial Reference Source Code Used before June 18th, 2019.Netflix · Dial Reference Source Code Repo (https://github.com/Netflix/dial-reference) | High7.5 |