Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 8 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,644All CVEsplus 19,141 rejected
- 674Last 24 hours2,957 in the last 7 days
- 17,129Last 30 days1,607 of them critical
- 1,769Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 12 | 8 | 3 | 0 | 0 | 23 | 26 |
| 2025 | 0 | 1 | 1 | 0 | 0 | 2 | 3 |
| 2024 | 0 | 1 | 0 | 0 | 0 | 1 | 1 |
| Title | ||
|---|---|---|
| CVE-2026-112047 | OneUptime 14.0.2 before 14.0.69 Incorrect Authorization in Kubernetes AI ActionsOneUptime · oneuptime | Medium5.3 |
| CVE-2026-80350 | OneUptime before 12.0.7 Server-Side Request Forgery via IPv4-Mapped IPv6 Webhook URLOneUptime · OneUptime | High7.1 |
| CVE-2026-45102 | OneUptime: RCE due to Node.js' vm module escape via error objects and infinite recursionOneUptime · oneuptime | Critical9.9 |
| CVE-2026-35053 | OneUptime: Unauthenticated Workflow Execution via ManualAPIOneUptime · oneuptime | Critical9.2 |
| CVE-2026-34840 | OneUptime SSO: Multi-Assertion Identity Injection via Decoupled Signature VerificationOneUptime · oneuptime | High8.1 |
| CVE-2026-34759 | OneUptime: Unauthenticated notification API endpoints - financial abuse via phone number purchase, service disruption, and SMTP credential exposureOneUptime · oneuptime | Critical9.2 |
| CVE-2026-34758 | OneUptime: Missing Authentication on Notification EndpointsOneUptime · oneuptime | Critical9.1 |
| CVE-2026-33396 | OneUptime has sandbox escape in Synthetic Monitor Playwright runtime allows project members to execute arbitrary commands on ProbeOneUptime · oneuptime | Critical10.0 |
| CVE-2026-33142 | OneUptime: ClickHouse SQL Injection via unvalidated column identifiers in sort, select, and groupBy parametersOneUptime · oneuptime | High8.1 |
| CVE-2026-33143 | OneUptime: WhatsApp Webhook Missing Signature VerificationOneUptime · oneuptime | High8.7 |
| CVE-2026-32598 | OneUptime: Password Reset Token Logged at INFO LevelOneUptime · oneuptime | Medium6.9 |
| CVE-2026-32308 | OneUptime: Stored XSS via Mermaid Diagram Rendering (securityLevel: "loose")OneUptime · oneuptime | High7.6 |
| CVE-2026-32306 | OneUptime ClickHouse SQL Injection via Aggregate Query ParametersOneUptime · oneuptime | Critical10.0 |
| CVE-2026-30959 | OneUptime has WhatsApp Resend Verification Authorization BypassOneUptime · oneuptime | Medium5.3 |
| CVE-2026-30958 | OneUptime: Path Traversal — Arbitrary File Read (No Auth)OneUptime · oneuptime | High7.2 |
| CVE-2026-30957 | OneUptime Synthetic Monitor RCE via exposed Playwright browser objectOneUptime · oneuptime | Critical10.0 |
| CVE-2026-30956 | OneUptime has authorization bypass via client‑controlled is-multi-tenant-query headerOneUptime · oneuptime | Critical10.0 |
| CVE-2026-30921 | OneUptime Synthetic Monitor RCE via exposed Playwright browser objectOneUptime · oneuptime | Critical10.0 |
| CVE-2026-30920 | OneUptime has broken access control in GitHub App installation flow that allows unauthorized project bindingOneUptime · oneuptime | High8.6 |
| CVE-2026-30887 | OneUptime Affected by Unsandboxed Code Execution in Probe Allows Any Project Member to Achieve RCEOneUptime · oneuptime | Critical10.0 |
| CVE-2026-28787 | OneUptime has WebAuthn 2FA bypass: server accepts client-supplied challenge instead of server-stored value, allowing credential replayOneUptime · oneuptime | High8.2 |
| CVE-2026-27728 | OneUptime: OS Command Injection in Probe NetworkPathMonitor via unsanitized destination in traceroute exec()OneUptime · oneuptime | Critical10.0 |
| CVE-2026-27574 | OneUptime: node:vm sandbox escape in probe allows any project member to achieve RCEOneUptime · oneuptime | Critical10.0 |
| CVE-2025-66028 | OneUptime is Vulnerable to Privilege Escalation via Login Response ManipulationOneUptime · oneuptime | Medium6.9 |
| CVE-2025-65966 | OneUptime Unauthorized User Creation via APIOneUptime · oneuptime | High8.8 |
| CVE-2024-29194 | OneUptime Vulnerable to a Privilege Escalation via Local Storage Key ManipulationOneUptime · oneuptime | High8.3 |