Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 7 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,293All CVEsplus 19,140 rejected
- 448Last 24 hours2,721 in the last 7 days
- 16,913Last 30 days1,557 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 2 | 16 | 13 | 1 | 0 | 32 | 32 |
| Title | ||
|---|---|---|
| CVE-2026-116819 | OpenPanel before 3.0.0 Credential Disclosure via notification.rules QueryOpenpanel-dev · openpanel | High8.4 |
| CVE-2026-116818 | OpenPanel before 3.0.0 Unauthenticated ClickHouse SQL Injection via /live/visitors WebSocketOpenpanel-dev · openpanel | High8.8 |
| CVE-2026-116817 | OpenPanel before 3.0.0 Missing Authentication on Worker Bull BoardOpenpanel-dev · openpanel | Medium6.9 |
| CVE-2026-116815 | OpenPanel before 3.0.0 Improper ClickHouse Escaping in sankey.service.tsOpenpanel-dev · openpanel | Medium5.3 |
| CVE-2026-116814 | OpenPanel before 3.0.0 Sensitive Information Exposure via Application LogsOpenpanel-dev · openpanel | High7.1 |
| CVE-2026-116813 | OpenPanel before 3.0.0 ClickHouse SQL Injection via conversion.service.tsOpenpanel-dev · openpanel | High7.1 |
| CVE-2026-116812 | OpenPanel before 3.0.0 ClickHouse SQL Injection via cohort.preview profile filterOpenpanel-dev · openpanel | High7.1 |
| CVE-2026-116811 | OpenPanel before 3.0.0 Sandbox Escape RCE via Webhook JavaScript TemplateOpenpanel-dev · openpanel | High8.7 |
| CVE-2026-116810 | OpenPanel before 3.0.0 Missing Authorization via reference.getChartReferencesOpenpanel-dev · openpanel | Medium6.9 |
| CVE-2026-116809 | OpenPanel before 3.0.0 Missing Authorization in event.bots tRPC ProcedureOpenpanel-dev · openpanel | Medium6.9 |
| CVE-2026-116808 | OpenPanel before 3.0.0 ClickHouse SQL Injection via profile.valuesOpenpanel-dev · openpanel | High8.6 |
| CVE-2026-116807 | OpenPanel before 3.0.0 ClickHouse SQL Injection via event.events tRPC QueryOpenpanel-dev · openpanel | High7.0 |
| CVE-2026-116806 | OpenPanel before 3.0.0 Privilege Escalation via onboarding.project tRPC MutationOpenpanel-dev · openpanel | Medium5.3 |
| CVE-2026-116805 | OpenPanel before 3.0.0 Information Disclosure of Ingestion Secret Hashes via client.listOpenpanel-dev · openpanel | Medium5.3 |
| CVE-2026-108579 | OpenPanel through 2.3.0 CSV Formula Injection via Cohort Member ExportOpenpanel-dev · openpanel | Low2.3 |
| CVE-2026-93985 | OpenPanel js-runtime through 2.3.0 JavaScript Template Sandbox Escape RCEOpenpanel-dev · openpanel | Critical9.4 |
| CVE-2026-93984 | OpenPanel API through 2.3.0 Authentication Bypass via Unverified Client SecretOpenpanel-dev · openpanel | Medium6.9 |
| CVE-2026-93983 | OpenPanel through 2.3.0 SQL Injection via ClickHouse Property Key FilterOpenpanel-dev · openpanel | Medium5.3 |
| CVE-2026-93982 | OpenPanel through 2.3.0 MCP Authentication Token in Query Parameter Logged PlaintextOpenpanel-dev · openpanel | Medium4.8 |
| CVE-2026-88893 | OpenPanel through 2.3.0 Unauthenticated Share Lookup Information DisclosureOpenpanel-dev · openpanel | High8.7 |
| CVE-2026-88892 | OpenPanel through 2.3.0 SSRF via Unguarded Importer File URL FetchOpenpanel-dev · openpanel | Medium5.3 |
| CVE-2026-88891 | OpenPanel through 2.3.0 Read-Only Access Level Enforcement Bypass via MutationsOpenpanel-dev · openpanel | High7.2 |
| CVE-2026-88890 | OpenPanel through 2.3.0 SQL Injection via unvalidated profile filter column identifierOpenpanel-dev · openpanel | High8.4 |
| CVE-2026-85615 | Openpanel before 2.3.0 Cross-Tenant IDOR via report.getLayoutsOpenpanel-dev · openpanel | Medium5.3 |
| CVE-2026-85614 | OpenPanel API before 2.3.0 Unauthenticated SSRF via site-checkerOpenpanel-dev · openpanel | Critical9.2 |
| CVE-2026-85613 | OpenPanel before 2.3.0 Unauthenticated XSS via SVG Favicon ProxyOpenpanel-dev · openpanel | High8.4 |
| CVE-2026-85612 | OpenPanel before 2.3.0 SSRF via favicon and og endpointsOpenpanel-dev · openpanel | High8.7 |
| CVE-2026-85611 | OpenPanel before 2.3.0 Cross-Tenant BOLA via report proceduresOpenpanel-dev · openpanel | Medium5.3 |
| CVE-2026-85610 | OpenPanel before 2.3.0 Remote Code Execution via chart formulasOpenpanel-dev · openpanel | High8.7 |
| CVE-2026-85609 | Openpanel before 2.3.0 SSRF via Site Checker EndpointOpenpanel-dev · openpanel | Medium6.9 |
| CVE-2026-77769 | OpenPanel report.list Queries Reports by an Unverified dashboardId, Crossing Organization BoundariesOpenpanel-dev · openpanel | High7.1 |
| CVE-2026-77768 | OpenPanel report.get Returns Any Report by Identifier Without Checking Project AccessOpenpanel-dev · openpanel | High7.1 |