Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 7 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,113All CVEsplus 19,119 rejected
- 470Last 24 hours2,797 in the last 7 days
- 16,882Last 30 days1,550 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 0 | 7 | 21 | 6 | 0 | 34 | 48 |
| 2025 | 1 | 1 | 4 | 6 | 0 | 12 | 14 |
| 2024 | 0 | 0 | 1 | 0 | 0 | 1 | 2 |
| 2023 | 0 | 0 | 0 | 0 | 0 | 0 | 1 |
| 2022 | 0 | 0 | 1 | 0 | 0 | 1 | 1 |
| Title | ||
|---|---|---|
| CVE-2026-86035 | Weblate: Mercurial argument injection via repository filenames allows authenticated command executionWeblateOrg · weblate | High8.5 |
| CVE-2026-62364 | wlc may disclose API tokens to project-configured URLsWeblateOrg · wlc | Low2.3 |
| CVE-2026-77573 | Weblate: DNS rebinding in VCS operations allows server-side request forgeryWeblateOrg · weblate | Low3.5 |
| CVE-2026-77507 | Weblate: Object-scoped RSS feeds disclose private change history to unauthorized usersWeblateOrg · weblate | Medium5.3 |
| CVE-2026-62326 | Weblate Has Uncontrolled Resource Consumption viaWeblateOrg · weblate | Medium6.5 |
| CVE-2026-62249 | Weblate: Restricted-component change history leaked to non-member project users through the nested `GET /api/projects/{slug}/changes/` endpointWeblateOrg · weblate | Medium4.3 |
| CVE-2026-61792 | Weblate path traversal allows a project administrator to read arbitrary files via App store metadata download (Incomplete Fix of CVE-2026-34242)WeblateOrg · weblate | High7.7 |
| CVE-2026-61790 | Weblate: Team-enforced 2FA is bypassed for global permissionsWeblateOrg · weblate | Medium4.4 |
| CVE-2026-55228 | Weblate:: WebIDOR in GroupViewSet allows authenticated project manager to gain unauthorized read access to any private projectWeblateOrg · weblate | High8.1 |
| CVE-2026-55227 | Observable object existence disclosure in private Weblate projects via globally scoped object lookupsWeblateOrg · weblate | Medium4.3 |
| CVE-2026-77508 | Weblate: Unverified REST API email changesWeblateOrg · weblate | Low3.5 |
| CVE-2026-45106 | Weblate: Stored HTML injection in editor search previewWeblateOrg · weblate | Medium4.6 |
| CVE-2026-50127 | Weblate SSRF: outbound URL guard misses the NAT64 well-known prefix (64:ff9b::/96)WeblateOrg · weblate | Medium5.9 |
| CVE-2026-42150 | wlc: print_html outputs API data without HTML escaping, enabling stored XSSWeblateOrg · wlc | Medium5.1 |
| CVE-2026-44264 | Weblate is vulnerable to XSS via crafted MarkdownWeblateOrg · weblate | Medium4.3 |
| CVE-2026-44263 | Weblate: Private Translation Enumeration via Screenshot APIWeblateOrg · weblate | Medium4.3 |
| CVE-2026-41519 | Weblate's API Token Not Invalidated on Password ChangeWeblateOrg · weblate | Medium4.2 |
| CVE-2026-41654 | Weblate is Vulnerable to Authenticated SSRF via Project Backup Import bypassing validate_repo_urlWeblateOrg · weblate | Medium5.3 |
| CVE-2026-40256 | Weblate: Prefix-Based Repository Boundary Check Bypass via Symlink/Junction Path Prefix CollisionWeblateOrg · weblate | Medium5.0 |
| CVE-2026-39845 | Weblate: SSRF via the webhook add-on using unprotected fetch_url()WeblateOrg · weblate | Medium4.1 |
| CVE-2026-34393 | Weblate: Privilege escalation in the user API endpointWeblateOrg · weblate | High8.8 |
| CVE-2026-34244 | Weblate: SSRF via Project-Level Machinery ConfigurationWeblateOrg · weblate | Medium5.0 |
| CVE-2026-34242 | Weblate: Arbitrary File Read via SymlinkWeblateOrg · weblate | High7.7 |
| CVE-2026-33440 | Weblate: Authenticated SSRF via redirect bypass of ALLOWED_ASSET_DOMAINS in screenshot URL uploadsWeblateOrg · weblate | Medium5.0 |
| CVE-2026-33435 | Weblate: Remote code execution during backup restorationWeblateOrg · weblate | High8.1 |
| CVE-2026-33220 | Weblate: JavaScript localization CDN add-on allows arbitrary local file read outside the repositoryWeblateOrg · weblate | Medium6.8 |
| CVE-2026-33214 | Weblate has improper access control for the translation memory APIWeblateOrg · weblate | Medium4.3 |
| CVE-2026-33212 | Weblate: Improper access control for pending tasks in APIWeblateOrg · weblate | Low3.1 |
| CVE-2026-27457 | Weblate: Missing access control for the AddonViewSet API exposes all addon configurationsWeblateOrg · weblate | Medium4.3 |
| CVE-2026-24126 | Weblate has an argument injection in management consoleWeblateOrg · weblate | Medium6.6 |
| CVE-2026-23535 | wlc Path traversal: Unsanitized API slugs in download commandWeblateOrg · wlc | High8.1 |
| CVE-2026-21889 | Weblate leaks information via screenshotsWeblateOrg · weblate | Low2.3 |
| CVE-2026-22251 | wlc may leak API keys due to an insecure API key configurationWeblateOrg · wlc | Medium5.3 |
| CVE-2026-22250 | wlc can skip SSL verificationWeblateOrg · wlc | Low2.5 |
| CVE-2025-68398 | Weblate has git config file overwrite vulnerability that leads to remote code executionWeblateOrg · weblate | Critical9.1 |
| CVE-2025-68279 | Weblate has an arbitrary file read via symbolic linksWeblateOrg · weblate | High7.7 |
| CVE-2025-67715 | Weblate has Systematic User and Project Enumeration via Broken Authorization in REST API (IDOR)WeblateOrg · weblate | Medium4.3 |
| CVE-2025-67492 | Weblate's over‑permissive webhook endpoint enables mass repository updates and component enumerationWeblateOrg · weblate | Medium5.3 |
| CVE-2025-66407 | Weblate has Server-Side Request Forgery vulnerabilityWeblateOrg · weblate | Medium5.0 |
| CVE-2025-64725 | Weblate has improper validation upon invitation acceptanceWeblateOrg · weblate | Low1.0 |
| CVE-2025-64326 | Weblate leaks the IP of project members inviting users to assume reviewer roles in Audit logWeblateOrg · weblate | Low2.6 |
| CVE-2025-61587 | Weblate integration with Anubis can lead to Open Redirect via redir parameterWeblateOrg · weblate | Low2.1 |
| CVE-2025-58352 | Weblate has long session expiry times during second factor verificationWeblateOrg · weblate | Low2.1 |
| CVE-2025-49134 | Weblate exposes personal IP address via e-mailWeblateOrg · weblate | Low2.1 |
| CVE-2025-47951 | Weblate lacks rate limiting when verifying second factorWeblateOrg · weblate | Medium4.9 |
| CVE-2025-32021 | Weblate VCS credentials included in URL parameters are potentially logged and saved into browser history as plaintextWeblateOrg · weblate | Low2.2 |
| CVE-2024-39303 | Weblate vulnerabler to improper sanitization of project backupsWeblateOrg · weblate | Medium4.4 |
| CVE-2022-24710 | Cross-site Scripting in WeblateWeblateOrg · weblate | Medium5.4 |