Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 9 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 400,905All CVEsplus 19,118 rejected
- 348Last 24 hours2,786 in the last 7 days
- 16,766Last 30 days1,547 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 2 | 6 | 4 | 0 | 0 | 12 | 20 |
| 2025 | 1 | 1 | 2 | 0 | 0 | 4 | 8 |
| 2024 | 0 | 2 | 2 | 0 | 0 | 4 | 4 |
| Title | ||
|---|---|---|
| CVE-2026-76820 | OpenCTI: Synchronizer SSRF: stream fetch has no URL validationOpenCTI-Platform · opencti | High7.7 |
| CVE-2026-76821 | OpenCTI: User-Controlled ReDoS in JSON Ingestion MapperOpenCTI-Platform · opencti | High7.1 |
| CVE-2026-35211 | OpenCTI: Elasticsearch Painless Script Injection via GraphQL `script` filter operator allows authenticated user to exfiltrate data and cause DoSOpenCTI-Platform · opencti | Medium6.5 |
| CVE-2026-35210 | OpenCTI: Authorization Bypass via `synchronized-upsert` HTTP Header InjectionOpenCTI-Platform · opencti | High7.1 |
| CVE-2026-35212 | OpenCTI has XSS in the rendering of email-message observable body dataOpenCTI-Platform · opencti | Medium5.3 |
| CVE-2026-44730 | OpenCTI: Privilege escalation via graphQL API abusable by organization admins, due to incorrect ACL on userEdit relationAddOpenCTI-Platform · opencti | High7.2 |
| CVE-2026-27960 | OpenCTI privilege escalation and unauthenticated access via default admin accountOpenCTI-Platform · opencti | Critical9.8 |
| CVE-2026-39980 | OpenCTI affected by RCE via notifier templateOpenCTI-Platform · opencti | Critical9.1 |
| CVE-2026-21886 | OpenCTI's GraphQL Mutations Allow Deletion of Unrelated EntitiesOpenCTI-Platform · opencti | Medium6.5 |
| CVE-2026-21887 | OpenCTI has a Semi-Blind SSRF via Unvalidated External URL in Data Ingestion FeatureOpenCTI-Platform · opencti | High7.7 |
| CVE-2025-61782 | Open Redirect in OpenCTI's SAML Authentication FlowOpenCTI-Platform · opencti | Medium5.4 |
| CVE-2025-61781 | GraphQL IDOR allows authenticated user to delete workspace content of other usersOpenCTI-Platform · opencti | High7.1 |
| CVE-2025-46732 | OpenCTI's GraphQL IDOR enables authenticated users to modify or delete notifications of other usersOpenCTI-Platform · opencti | Medium5.4 |
| CVE-2025-26621 | OpenCTI vulnerable to Denial of Service through web hookOpenCTI-Platform · opencti | High7.6 |
| CVE-2025-24977 | OpenCTI has remote code execution and sensitive secrets exposed through web hookOpenCTI-Platform · opencti | Critical9.1 |
| CVE-2025-24887 | OpenCTI bypass of protected attribute updateOpenCTI-Platform · opencti | Medium6.3 |
| CVE-2024-45805 | OpenCTI leaks support information due to inadequate access controlOpenCTI-Platform · opencti | Medium4.3 |
| CVE-2024-45404 | OpenCTI's lack of Rate Limit lead to OTP brute forcingOpenCTI-Platform · opencti | High8.1 |
| CVE-2024-37155 | OpenCTI May Bypass Introspection RestrictionOpenCTI-Platform · opencti | Medium6.5 |
| CVE-2024-26139 | OpenCTI Authenticated Privilege EscalationOpenCTI-Platform · opencti | High8.3 |