Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 1 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 400,855All CVEsplus 19,116 rejected
- 453Last 24 hours2,911 in the last 7 days
- 16,801Last 30 days1,551 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 1 | 4 | 10 | 1 | 0 | 16 | 37 |
| 2025 | 0 | 7 | 6 | 0 | 0 | 13 | 21 |
| 2024 | 0 | 1 | 4 | 0 | 0 | 5 | 8 |
| 2023 | 0 | 0 | 0 | 0 | 0 | 0 | 3 |
| 2022 | 0 | 0 | 0 | 0 | 0 | 0 | 3 |
| 2021 | 0 | 0 | 0 | 0 | 0 | 0 | 3 |
| 2020 | 0 | 0 | 0 | 0 | 0 | 0 | 3 |
| 2019 | 0 | 0 | 1 | 0 | 0 | 1 | 3 |
| 2018 | 0 | 1 | 1 | 0 | 0 | 2 | 2 |
| Title | ||
|---|---|---|
| CVE-2026-39324 | Rack::Session::Cookie secrets: decrypt failure fallback enables secretless session forgery and Marshal deserializationrack · rack-session | Critical9.3 |
| CVE-2026-26962 | Rack: Header injection in multipart requestsrack · rack | Medium4.8 |
| CVE-2026-34835 | Rack: `Rack::Request` accepts invalid Host characters, enabling host allowlist bypass.rack · rack | Medium4.8 |
| CVE-2026-34827 | Rack: Algorithmic-Complexity DoS in Rack::Multipart::Parserrack · rack | High7.5 |
| CVE-2026-32762 | Rack: Forwarded Header semicolon injection enables Host and Scheme spoofingrack · rack | Medium4.8 |
| CVE-2026-34830 | Rack: Rack::Sendfile regex injection via HTTP_X_ACCEL_MAPPING header allows arbitrary file reads through nginxrack · rack | Medium5.9 |
| CVE-2026-34829 | Rack: Denial of Service via Unbounded Multipart File Upload Without Content-Lengthrack · rack | High7.5 |
| CVE-2026-34826 | Rack: Unbounded Range Count in get_byte_ranges Enables DoSrack · rack | Medium5.3 |
| CVE-2026-34786 | Rack: Rack::Static header_rules bypass via URL-encoded pathsrack · rack | Medium5.3 |
| CVE-2026-34785 | Rack: Local file inclusion in `Rack::Static` via URL Prefix Matchingrack · rack | High7.5 |
| CVE-2026-34763 | Rack: Rack::Directory info disclosure and DoS via unescaped regex interpolationrack · rack | Medium5.3 |
| CVE-2026-34831 | Rack: Content-Length mismatch in Rack::Files error responsesrack · rack | Medium4.8 |
| CVE-2026-26961 | Rack: Multipart Boundary Parsing Ambiguity allowing WAF Bypassrack · rack | Low3.7 |
| CVE-2026-34230 | Rack: Quadratic complexity in Rack::Utils.select_best_encoding via wildcard Accept-Encoding headerrack · rack | Medium5.3 |
| CVE-2026-25500 | Rack's Stored XSS in Rack::Directory via javascript: filenames rendered into anchor hrefrack · rack | Medium5.4 |
| CVE-2026-22860 | Rack has a Directory Traversal via Rack:Directoryrack · rack | High7.5 |
| CVE-2025-61919 | Rack is vulnerable to a memory-exhaustion DoS through unbounded URL-encoded body parsingrack · rack | High7.5 |
| CVE-2025-61780 | Rack has Possible Information Disclosure Vulnerabilityrack · rack | Medium5.8 |
| CVE-2025-61772 | Rack's multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion)rack · rack | High7.5 |
| CVE-2025-61771 | Rack's multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion)rack · rack | High7.5 |
| CVE-2025-61770 | Rack's unbounded multipart preamble buffering enables DoS (memory exhaustion)rack · rack | High7.5 |
| CVE-2025-59830 | Rack QueryParser has an unsafe default allowing params_limit bypass via semicolon-separated parametersrack · rack | High7.5 |
| CVE-2025-49007 | ReDoS Vulnerability in Rack::Multipart handle_mime_headrack · rack | Medium6.6 |
| CVE-2025-46336 | Rack session gets restored after deletionrack · rack-session | Medium4.2 |
| CVE-2025-46727 | Unbounded-Parameter DoS in Rack::QueryParserrack · rack | High7.5 |
| CVE-2025-32441 | Rack session gets restored after deletionrack · rack | Medium4.2 |
| CVE-2025-27610 | Local File Inclusion in Rack::Staticrack · rack | High7.5 |
| CVE-2025-27111 | Escape Sequence Injection vulnerability in Rack lead to Possible Log Injectionrack · rack | Medium6.9 |
| CVE-2025-25184 | Possible Log Injection in Rack::CommonLoggerrack · rack | Medium5.7 |
| CVE-2024-39316 | Rack ReDoS Vulnerability in HTTP Accept Headers Parsingrack · rack | Medium6.5 |
| CVE-2024-35231 | rack-contrib vulnerable to Denial of Service due to the unconstrained value of the incoming "profiler_runs" parameterrack · rack-contrib | High8.6 |
| CVE-2024-26141 | Possible DoS Vulnerability with Range Header in Rackrack · rack | Medium5.8 |
| CVE-2024-25126 | Rack ReDos in content type parsing (2nd degree polynomial)rack · rack | Medium5.3 |
| CVE-2024-26146 | Possible Denial of Service Vulnerability in Rack Header Parsingrack · rack | Medium5.3 |
| CVE-2019-16782 | Possible Information Leak / Session Hijack Vulnerability in Rackrack · rack | Medium6.3 |
| CVE-2018-16471 | There is a possible XSS vulnerability in Rack before 2.0.6 and 1.6.11. Carefully crafted requests can impact the data returned by the `scheme` method on…Rack · Rack | Medium6.1 |
| CVE-2018-16470 | There is a possible DoS vulnerability in the multipart parser in Rack before 2.0.6. Specially crafted requests can cause the multipart parser to enter a…Rack · Rack | High7.5 |