Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 6 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 400,454All CVEsplus 18,890 rejected
- 361Last 24 hours2,973 in the last 7 days
- 17,372Last 30 days1,592 of them critical
- 1,767Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 3 | 27 | 11 | 7 | 0 | 48 | 90 |
| 2025 | 0 | 16 | 5 | 1 | 0 | 22 | 42 |
| 2024 | 0 | 15 | 5 | 0 | 0 | 20 | 20 |
| Title | ||
|---|---|---|
| CVE-2026-94084 | Suricata before 8.0.7 has an Http2ThreadMultiBuf use-after-free when a transaction is inspected by rules that use http.response_header with and without a…OISF · Suricata | Critical9.4 |
| CVE-2026-94083 | Suricata before 8.0.7 has a DoH2 type confusion that can cause an invalid free, because cleanup code for the HTTP2 state is executed even though the actual…OISF · Suricata | Critical9.4 |
| CVE-2026-71855 | Suricata flow: IPv4/IPv6 hash collision can reuse wrong flow stateOISF · suricata | Medium5.9 |
| CVE-2026-71418 | Suricata doh2: crafted HTTP/2 DATA frames can cause quadratic CPU consumptionOISF · suricata | High7.5 |
| CVE-2026-57223 | Suricata windows: unquoted LocalSystem service ImagePath can allow local privilege escalationOISF · suricata | High7.0 |
| CVE-2026-63446 | Suricata app-layer: passed flows can retain transactions, causing resource exhaustionOISF · suricata | High7.5 |
| CVE-2026-63447 | Suricata ftp: crafted FTP traffic can cause quadratic CPU consumptionOISF · suricata | High7.5 |
| CVE-2026-63448 | Suricata smb: some SMB flows can cause resource exhaustionOISF · suricata | Medium5.9 |
| CVE-2026-57229 | Suricata smtp/mime: incomplete state reset allows detection bypassOISF · suricata | Medium5.3 |
| CVE-2026-57225 | Suricata datasets: NULL pointer dereference in JSON/NDJSON dataset loadingOISF · suricata | Low3.3 |
| CVE-2026-63452 | Suricata http1: repeated brotli compression bombs can cause excessive CPU consumptionOISF · suricata | High7.5 |
| CVE-2026-63451 | Suricata detect: frame rules without content and with transform can cause heap buffer overflow during rule loadOISF · suricata | Low3.3 |
| CVE-2026-57227 | Suricata mqtt: unbounded resource consumption from repeated pubrec and pubrel messagesOISF · suricata | High7.5 |
| CVE-2026-63450 | Suricata ftp: RETR/STOR before PORT/PASV can disable further IDS app-layer detectionOISF · suricata | Low3.7 |
| CVE-2026-63449 | Suricata sip: large SIP message bodies can evade detection with frame keywordOISF · suricata | Low3.7 |
| CVE-2026-57228 | Suricata smtp/mime: heap out-of-bounds read quoted-printable decoderOISF · suricata | High8.2 |
| CVE-2026-57224 | Suricata dhcp: unbounded transactions in unidirectional traffic can lead to resource exhaustionOISF · suricata | Medium6.5 |
| CVE-2026-57226 | Suricata swf: heap buffer overflow in SWF decompression depth handlingOISF · suricata | Low3.7 |
| CVE-2026-57222 | Suricata ippair: hash collision can cause incorrect state reuse across IPv4 and IPv6OISF · suricata | Medium5.3 |
| CVE-2026-46352 | Suricata defrag: fragmented encapsulated traffic with fragments can lead to deadlockOISF · suricata | High7.5 |
| CVE-2026-45770 | Suricata lua: excessive flow variable registration can bypass sandboxOISF · suricata | High7.5 |
| CVE-2026-45769 | ikev2: unbounded client transform storage can lead to resource exhaustionOISF · suricata | High7.5 |
| CVE-2026-45768 | Suricata ldap: unbounded responses per transaction can lead to resource exhaustionOISF · suricata | High7.5 |
| CVE-2026-45767 | Suricata datasets: save to absolute filename can be bypassed when combined with load commandOISF · suricata | Medium4.4 |
| CVE-2026-45766 | Suricata nfs: unbounded stateful structures can lead to resource exhaustionOISF · suricata | High7.5 |
| CVE-2026-45765 | Suricata dnp3: unbounded reassembly can lead to resource exhaustionOISF · suricata | High7.5 |
| CVE-2026-45764 | Suricata http2: protocol-change type confusion can lead to denial of serviceOISF · suricata | Critical9.1 |
| CVE-2026-45762 | Suricata defrag: missing address-family check can lead to remote crashOISF · suricata | High7.5 |
| CVE-2026-45761 | Suricata detect: case-insensitive frame handling can cause heap buffer overflow during rule loadOISF · suricata | Low3.3 |
| CVE-2026-45759 | Suricata http1: quadratic Content-Disposition processing can lead to denial of serviceOISF · suricata | High7.5 |
| CVE-2026-45752 | Suricata detect/transform: use-after-free in decompress transformsOISF · suricata | Medium5.9 |
| CVE-2026-45751 | Suricata detect/transform: use-after-free in dotprefix transformOISF · suricata | Medium5.9 |
| CVE-2026-45747 | Suricata lua/tls: null dereference in TlsGetCertInfoOISF · suricata | High7.5 |
| CVE-2026-46387 | Suricata http2: decompression bomb can cause denial of service in SuricataOISF · suricata | High7.5 |
| CVE-2026-45763 | Suricata lua: sandbox allocation limit not enforced for new allocationsOISF · suricata | Medium5.9 |
| CVE-2026-31937 | Suricata dcerpc: quadratic complexity in dcerpc bufferingOISF · suricata | High7.5 |
| CVE-2026-31935 | Suricata http2: unbounded resource consumptionOISF · suricata | High7.5 |
| CVE-2026-31934 | Suricata smtp/mine: quadratic complexity in extracting urlsOISF · suricata | High7.5 |
| CVE-2026-31933 | Suricata stream: quadratic complexity in stream inspectionOISF · suricata | High7.5 |
| CVE-2026-31932 | Suricata krb5: quadratic complexity in krb5 bufferingOISF · suricata | High7.5 |
| CVE-2026-31931 | Suricata tls: null dereference in tls.alpn rule keywordOISF · suricata | High7.5 |
| CVE-2026-22264 | Suricata detect/alert: heap-use-after-free on alert queue expansionOISF · suricata | High7.4 |
| CVE-2026-22263 | Suricata http1: quadratic complexity in headers parsing over multiple packetsOISF · suricata | Medium5.3 |
| CVE-2026-22262 | Suricata datasets: stack overflow when saving a setOISF · suricata | Medium5.9 |
| CVE-2026-22261 | Suricata eve/alert: http1 xff handling can lead to denial of serviceOISF · suricata | Low3.7 |
| CVE-2026-22260 | Suricata http1: infinite recursion in decompressionOISF · suricata | High7.5 |
| CVE-2026-22259 | Suricata dnp3: unbounded transaction growthOISF · suricata | High7.5 |
| CVE-2026-22258 | Suricata DCERPC: unbounded fragment buffering leads to memory exhaustionOISF · suricata | High7.5 |
| CVE-2025-64344 | Suricata is vulnerable to a stack overflow from unbounded stack allocation in LuaPushStringBufferOISF · suricata | High7.5 |
| CVE-2025-64330 | Suricata is vulnerable to a heap buffer overflow on verdictOISF · suricata | High7.5 |