Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 6 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,367All CVEsplus 19,141 rejected
- 471Last 24 hours2,753 in the last 7 days
- 16,910Last 30 days1,565 of them critical
- 1,769Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 54 | 486 | 694 | 95 | 1 | 1,330 | 2,454 |
| 2025 | 11 | 100 | 160 | 24 | 0 | 295 | 1,124 |
| 2024 | 6 | 112 | 162 | 18 | 0 | 298 | 829 |
| 2023 | 5 | 85 | 149 | 10 | 0 | 249 | 531 |
| 2022 | 0 | 1 | 2 | 0 | 0 | 3 | 282 |
| 2021 | 0 | 0 | 0 | 1 | 0 | 1 | 279 |
| 2020 | 4 | 30 | 66 | 6 | 0 | 106 | 278 |
| 2019 | 1 | 23 | 41 | 5 | 0 | 70 | 172 |
| 2018 | 0 | 27 | 42 | 10 | 0 | 79 | 102 |
| 2017 | 0 | 0 | 0 | 0 | 0 | 0 | 23 |
| 2016 | 0 | 0 | 0 | 0 | 0 | 0 | 23 |
| 2015 | 0 | 0 | 0 | 0 | 0 | 0 | 23 |
| 2014 | 0 | 0 | 6 | 0 | 0 | 6 | 23 |
| 2013 | 0 | 3 | 7 | 1 | 0 | 11 | 17 |
| 2012 | 0 | 0 | 2 | 0 | 0 | 2 | 6 |
| 2011 | 0 | 0 | 2 | 0 | 0 | 2 | 4 |
| 2010 | 0 | 1 | 0 | 0 | 0 | 1 | 2 |
| 2009 | 0 | 0 | 0 | 0 | 0 | 0 | 1 |
| 2008 | 0 | 0 | 0 | 0 | 0 | 0 | 1 |
| 2007 | 0 | 0 | 0 | 0 | 0 | 0 | 1 |
| 2006 | 1 | 0 | 0 | 0 | 0 | 1 | 1 |
| Title | ||
|---|---|---|
| CVE-2026-50240 | Pipelines-as-code: openshift-pipelines-operator-rh: pipelines-as-code: repository users can trigger namespace edit-equivalent execution via auto-provisioned pipeline serviceaccountRed Hat · Builds for Red Hat OpenShift | High8.8 |
| CVE-2026-123876 | Podman: containers-common: containers-common: default seccomp af_vsock/netlink_audit deny rules bypassable via 32-bit truncationRed Hat · Red Hat Enterprise Linux 10 | Medium4.4 |
| CVE-2026-120749 | Dbus: dbus-daemon: dbus-daemon aborts (reply_serial != 0) when a broadcast from the driver cannot be delivered to a monitored busRed Hat · Red Hat Enterprise Linux 10 | Medium6.2 |
| CVE-2026-83494 | Training-operator: pytorchjob validateupdate casts oldjob from newobj, bypassing managedby immutability (asvs v5.1.3; upstream bug)Red Hat · Red Hat OpenShift AI (RHOAI) | Not scored |
| CVE-2026-83493 | Distributed-workloads: github actions pinned by mutable tag/branch, including third-party snyk/actions/setup@masterRed Hat · Red Hat OpenShift AI (RHOAI) | Critical9.1 |
| CVE-2026-9797 | Keycloak: keycloak: privilege escalation via client authentication manipulation by an authenticated administratorRed Hat · Red Hat Build of Keycloak | Medium6.5 |
| CVE-2026-97848 | Keycloak-services: keycloak-services: protocol mapper with jsontype=json bypasses token sanitizationRed Hat · Red Hat build of Keycloak 26.4 | Medium6.5 |
| CVE-2026-97367 | Keycloak-services: keycloak-services: dcr azp and sid claim substitution allows account rest session takeoverRed Hat · Red Hat build of Keycloak 26.4 | Medium6.4 |
| CVE-2026-96547 | Keycloak-services: keycloak-services: dcr registration-time claim-path gap allows forging realm_access.rolesRed Hat · Red Hat build of Keycloak 26.4 | Medium6.5 |
| CVE-2026-96460 | Keycloak-services: keycloak-services: indefinite access token renewal via standard token exchange v2Red Hat · Red Hat build of Keycloak 26.6 | Medium5.4 |
| CVE-2026-92856 | Keycloak-services: keycloak-services: saml broker ignores proxyrestriction delegation constraintsRed Hat · Red Hat build of Keycloak 26.6 | Medium4.9 |
| CVE-2026-19688 | Keycloak-services: keycloak-services: admin api missing audience checkRed Hat · Red Hat build of Keycloak 26.6 | Medium6.8 |
| CVE-2026-96447 | Keycloak-services: keycloak-services: stateless token preferred_username fallback enables identity rebindingRed Hat · Red Hat build of Keycloak 26.6 | Medium4.2 |
| CVE-2026-109081 | Keycloak-services: keycloak-services: injection of roles into realm default-roles via dcr endpointRed Hat · Red Hat build of Keycloak 26.6 | Medium6.8 |
| CVE-2026-107124 | Keycloak-services: keycloak-services: oidc logout endpoint session fixation via id_token_hint leading to account takeoverRed Hat · Red Hat build of Keycloak 26.6 | Medium6.4 |
| CVE-2026-121837 | Quarkus-rest-data-panache: quarkus-rest-data-panache: getter-level @securefield ignored for filter and sortRed Hat · Exploit Intelligence | Medium4.3 |
| CVE-2026-123037 | Ansible-core: user module generate_ssh_key follows a symlinked ~/.ssh enabling local privilege escalation (incomplete fix of cve-2024-9902)Red Hat · Migration Toolkit for Applications 8 | Medium6.7 |
| CVE-2026-97847 | Keycloak-services: keycloak-services: client manager can substitute sessionless token principal via hardcoded-claim mappers to obtain realm administrator authorityRed Hat · Red Hat build of Keycloak 26.4 | High7.1 |
| CVE-2026-97175 | Keycloak-services: keycloak-services: unverified idp email auto-linking enables account takeoverRed Hat · Red Hat build of Keycloak 26.4.17 | High8.8 |
| CVE-2026-97174 | Keycloak-services: keycloak-services: ciba sub parameter injection causes attacker authentication to issue victim tokensRed Hat · Red Hat build of Keycloak 26.6 | Medium6.8 |
| CVE-2026-96453 | Org.keycloak/keycloak-admin-cli: keycloak-admin-cli: kcadm custom truststore accepts arbitrary self-signed certificatesRed Hat · Red Hat build of Keycloak 26.4 | High8.0 |
| CVE-2026-93998 | Keycloak-core: keycloak-core: saml adapter does not bind signed assertions to the configured identity provider issuerRed Hat · Red Hat build of Keycloak 26.4 | High7.4 |
| CVE-2026-92857 | Keycloak-services: keycloak-services: dcr protocol mapper config not validated, allowing iat holders to forge sub and aud claims in signed tokensRed Hat · Red Hat build of Keycloak 26.4 | High8.1 |
| CVE-2026-92855 | Keycloak-services: keycloak-services: saml broker accepts holder-of-key assertions without proof of key possessionRed Hat · Red Hat build of Keycloak 26.4 | High7.4 |
| CVE-2026-82965 | Keycloak-services: keycloak-services: unauthenticated denial of service via saml soap endpoint unbounded xml parsingRed Hat · Red Hat build of Keycloak 26.4 | High7.5 |
| CVE-2026-111253 | Dnf5daemon-server: dnf5: dnf5daemon-server: missing session-owner check allows foreign d-bus callers to replace another client's resolved transactionRed Hat · Red Hat Hardened Images | Medium6.6 |
| CVE-2026-123151 | Gdb: gdb: stack buffer overflow in parse_tsv_definition via stale rs->buf tailRed Hat · Red Hat Enterprise Linux 10 | High7.5 |
| CVE-2026-121997 | Gdb: gdbserver: heap buffer overflow in cmd_qtdpsrc via qtdpsrc declared/actual length mismatchRed Hat · Red Hat Enterprise Linux 10 | High8.1 |
| CVE-2026-121996 | Gdb: gdbserver: heap disclosure and wild pointer in gdb_parse_agent_expr via untrusted agent-expression lengthRed Hat · Red Hat Enterprise Linux 10 | High8.2 |
| CVE-2026-121995 | Gdb: gdb: stack buffer overflow in parse_tracepoint_definition via stale rs->buf tailRed Hat · Red Hat Enterprise Linux 10 | High7.5 |
| CVE-2026-121994 | Gdb: gdb: stack buffer overflow in fetch_register_using_p via unchecked p-reply lengthRed Hat · Red Hat Enterprise Linux 10 | High8.8 |
| CVE-2026-114232 | Keycloak-services: keycloak-services: uma protection api resourcetype field not validated — cross-owner resource accessRed Hat · Red Hat build of Keycloak 26.4 | High8.1 |
| CVE-2026-112208 | Keycloak-services: keycloak-services: account takeover via stale sso_auth note in organization identity-first loginRed Hat · Red Hat build of Keycloak 26.6 | High8.1 |
| CVE-2026-110932 | Keycloak-services: keycloak-services: unauthenticated persistent disk exhaustion via theme gzip cacheRed Hat · Red Hat build of Keycloak 26.6 | High7.5 |
| CVE-2026-110931 | Keycloak-services: keycloak-services: unauthenticated jvm termination via saml 1.1 authoritybinding parsing loopRed Hat · Red Hat build of Keycloak 26.4 | High7.5 |
| CVE-2026-107602 | Keycloak-services: keycloak-services: unauthenticated cpu exhaustion via saml 1.1 keyinfo infinite loopRed Hat · Red Hat build of Keycloak 26.4 | High7.5 |
| CVE-2026-103112 | Keycloak-services: keycloak-services: account takeover via authentication race using reset-credentials pathRed Hat · Red Hat build of Keycloak 26.4 | High7.5 |
| CVE-2026-107123 | Keycloak-services: keycloak-services: unauthenticated cpu denial of service via saml xml datetime and duration parsingRed Hat · Red Hat build of Keycloak 26.6 | High7.5 |
| CVE-2026-117691 | Keycloak-services: keycloak-services: saml redirect binding signature bypass via percent-encoded parameter namesRed Hat · Red Hat Build of Keycloak | Critical9.1 |
| CVE-2026-107912 | Io.quarkus/quarkus-vertx-http: quarkus-vertx-http: authorization bypass in management interface via path concatenation flawRed Hat · Exploit Intelligence | High7.7 |
| CVE-2026-123036 | A flaw was found in ansible-core. When a task marked `no_log: true` fails, the task result is censored before being emitted, but the `exception` field is…Red Hat · ansible-core | Medium5.5 |
| CVE-2026-121621 | Github.com/argoproj-labs/argocd-image-updater: argocd-image-updater: arbitrary command execution via crafted ssh repository proxy configurationargocd-image-updater | High8.8 |
| CVE-2026-82976 | Image-customization-controller: unauthenticated plaintext image server with directory listing exposes ignition images containing cluster pull secretRed Hat · Red Hat OpenShift Container Platform 4 | High7.1 |
| CVE-2026-121259 | Gst-plugins-bad: gst-plugins-bad: integer overflows and division by zero in jpeg 2000 decimatorRed Hat · Red Hat Enterprise Linux 10 | Medium6.5 |
| CVE-2026-119843 | Gst-plugins-good: assertion failures in FLV demuxer when parsing malformed enhanced audio/video tagsRed Hat · Red Hat Enterprise Linux 10 | Medium6.5 |
| CVE-2026-120971 | Org.jboss.resteasy/resteasy-core: resteasy: information disclosure through default exception mapper responsesRed Hat · Red Hat build of Apache Camel 4 for Quarkus 3 | Medium5.3 |
| CVE-2026-120831 | Libslirp: libslirp: queue pointer corruption in if_output() leading to denial of serviceRed Hat · Red Hat Enterprise Linux 10 | Medium6.5 |
| CVE-2026-120830 | Libslirp: libslirp: out-of-bounds heap read in icmp_forward_error() leading to information disclosureRed Hat · Red Hat Enterprise Linux 10 | High7.4 |
| CVE-2026-120740 | Hivex: hivex: denial of service via out-of-bounds read in big-data block processingRed Hat · Red Hat Enterprise Linux 10 | Low2.0 |
| CVE-2026-120194 | Json-glib: json-glib: infinite loop in json_path_query() with negative jsonpath slice stepRed Hat · Red Hat Enterprise Linux 10 | High7.5 |