Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 6 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,234All CVEsplus 19,120 rejected
- 500Last 24 hours2,798 in the last 7 days
- 16,901Last 30 days1,543 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 5 | 6 | 6 | 2 | 0 | 19 | 20 |
| 2025 | 0 | 0 | 0 | 0 | 0 | 0 | 1 |
| 2024 | 0 | 0 | 0 | 0 | 0 | 0 | 1 |
| 2023 | 0 | 0 | 0 | 0 | 0 | 0 | 1 |
| 2022 | 0 | 0 | 0 | 0 | 0 | 0 | 1 |
| 2021 | 0 | 0 | 1 | 0 | 0 | 1 | 1 |
| Title | ||
|---|---|---|
| CVE-2026-75575 | Rocket.Chat Missing DDP Rate Limit on the sendForgotPasswordEmail Meteor MethodRocketChat · Rocket.Chat | Medium6.9 |
| CVE-2026-72919 | Rocket.Chat: Broken Access Control in channels.convertToTeam Allows Unauthorized Conversion of Public Channels into TeamsRocketChat · Rocket.Chat | Medium4.3 |
| CVE-2026-72918 | Rocket.Chat: Insecure implementation of websocket notificationsRocketChat · Rocket.Chat | Medium5.4 |
| CVE-2026-55762 | Rocket.Chat: Any Authenticated User Can Permanently Deregister Workspace from Rocket.Chat Cloud via Unprotected `/api/v1/fingerprint` EndpointRocketChat · Rocket.Chat | High8.1 |
| CVE-2026-55759 | Rocket.Chat: Apple Sign-In skips JWT claims validation, allowing expired and cross-audience token replayRocketChat · Rocket.Chat | High7.4 |
| CVE-2026-55666 | Rocket.Chat: Email Parameter Fallback Leads To Account Takeover Within Apple OAuthRocketChat · Rocket.Chat | Critical9.3 |
| CVE-2026-49278 | Rocket.Chat: Livechat Visitor Profile Disclosure Leaks Bearer Token and Enables Visitor ImpersonationRocketChat · Rocket.Chat | Medium6.7 |
| CVE-2026-49277 | Rocket.Chat: OAuth access and refresh tokens remain valid after account deactivationRocketChat · Rocket.Chat | Low2.3 |
| CVE-2026-45757 | Rocket.Chat: users.deactivateIdle` deactivates accounts without revoking existing login tokensRocketChat · Rocket.Chat | Low2.3 |
| CVE-2026-46423 | Rocket.Chat: SAML signature validation skipped when IdP certificate field is emptyRocketChat · Rocket.Chat | Critical9.3 |
| CVE-2026-45689 | Rocket.Chat: Pre-Auth NoSQL Injection in OAuth2 Token Endpoint leading to Arbitrary User ATORocketChat · Rocket.Chat | Critical9.1 |
| CVE-2026-45688 | Rocket.Chat: Pre-Auth NoSQL Injection in CAS Login Handler leading to Arbitrary CAS/SAML User Session HijackRocketChat · Rocket.Chat | Critical9.1 |
| CVE-2026-45687 | Rocket.Chat: Authenticated Arbitrary Data Export Theft via Mass Assignment in sendFileMessageRocketChat · Rocket.Chat | High8.5 |
| CVE-2026-45677 | Rocket.Chat: Lack of SAML Signature Check During Logout Could Lead To DoSRocketChat · Rocket.Chat | High8.7 |
| CVE-2026-47733 | Rocket.Chat: Missing URL protocol sanitization in ImageElement allows javascript: URLs in markdown imagesRocketChat · Rocket.Chat | Medium4.4 |
| CVE-2026-30833 | Rocket.Chat: NoSQL injection in the EE ddp-streamer-serviceRocketChat · Rocket.Chat | Medium6.9 |
| CVE-2026-30831 | Rocket.Chat: 2FA bypass and login of deactivated users via EE ddp-streamerRocketChat · Rocket.Chat | High8.0 |
| CVE-2026-28514 | Rocket.Chat: Users can login with any password via the EE ddp-streamer-serviceRocketChat · Rocket.Chat | Critical9.3 |
| CVE-2026-23477 | Rocket.Chat Unauthorized Access to OAuth App DetailsRocketChat · Rocket.Chat | High7.7 |
| CVE-2021-32832 | ReDOS in Rocket.ChatRocketChat · Rocket.Chat | Medium4.3 |