Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 7 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,806All CVEsplus 19,141 rejected
- 491Last 24 hours3,085 in the last 7 days
- 17,001Last 30 days1,590 of them critical
- 1,769Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 0 | 7 | 16 | 3 | 0 | 26 | 100 |
| 2025 | 0 | 5 | 7 | 4 | 0 | 16 | 74 |
| 2024 | 5 | 4 | 5 | 10 | 0 | 24 | 58 |
| 2023 | 4 | 3 | 10 | 1 | 0 | 18 | 34 |
| 2022 | 1 | 0 | 6 | 7 | 0 | 14 | 16 |
| 2021 | 0 | 0 | 0 | 0 | 0 | 0 | 2 |
| 2020 | 0 | 1 | 0 | 0 | 0 | 1 | 2 |
| 2019 | 0 | 0 | 0 | 0 | 0 | 0 | 1 |
| 2018 | 0 | 0 | 0 | 0 | 0 | 0 | 1 |
| 2017 | 0 | 1 | 0 | 0 | 0 | 1 | 1 |
| Title | ||
|---|---|---|
| CVE-2026-59788 | Stored XSS vulnerability in OAuth configuration formZabbix · Zabbix | Medium5.6 |
| CVE-2026-59787 | SNMP trap injection in zabbix_trap_receiver.plZabbix · Zabbix | Medium5.3 |
| CVE-2026-59786 | Active agent heartbeat missing TLS checkZabbix · Zabbix | Medium6.9 |
| CVE-2026-59785 | Hidden host credentials inferable via multiselect.get filteringZabbix · Zabbix | Medium5.1 |
| CVE-2026-59783 | Server DoS via binary itemsZabbix · Zabbix | Low2.3 |
| CVE-2026-59782 | JavaScript preprocessing memory disclosureZabbix · Zabbix | Medium6.9 |
| CVE-2026-59781 | Improper validation of custom installation directories on Windows could allow installation into locations with unsafe permissions, increasing the risk of DLL sideloading.Zabbix · Zabbix | Medium5.4 |
| CVE-2026-23938 | Server DoS via JavaScript preprocessing or script itemsZabbix · Zabbix | Low2.1 |
| CVE-2026-23937 | Host PSK extraction in Zabbix APIZabbix · Zabbix | Medium6.0 |
| CVE-2026-23935 | Use-after-free read in script item/preprocessing HttpRequest bodyZabbix · Zabbix | Medium6.8 |
| CVE-2026-23934 | Frontend DoS via the validate.api.exists actionZabbix · Zabbix | Medium5.1 |
| CVE-2026-23933 | Hardcoded session key in Zabbix 7.4Zabbix · Zabbix | High7.7 |
| CVE-2026-23931 | Frontend plaintext macro value enumeration via the validatate.api.exists actionZabbix · Zabbix | Medium5.3 |
| CVE-2026-23930 | Frontend DoS via the popup.testtriggerexpr actionZabbix · Zabbix | Medium5.3 |
| CVE-2026-23929 | Prototype pollution leading to stored XSSZabbix · Zabbix | High8.5 |
| CVE-2026-1199 | API and Frontend login lockout race conditionZabbix · Zabbix | Medium6.9 |
| CVE-2026-23922 | Email media OAuth secret leak to Super AdminZabbix · Zabbix | Low2.1 |
| CVE-2026-23928 | Stored XSS vulnerability in the Item history/Plain text widgetZabbix · Zabbix | High7.3 |
| CVE-2026-23927 | Agent 2 Oracle plugin TNS connection string injection via the 'service' parameterZabbix · Zabbix | Medium5.1 |
| CVE-2026-23926 | Stored XSS vulnerability in Host navigator widget maintenance tooltipZabbix · Zabbix | High7.3 |
| CVE-2026-23924 | Agent 2 Docker plugin arbitrary file read via Docker API injectionZabbix · Zabbix | Medium6.1 |
| CVE-2026-23923 | Unauthenticated arbitrary PHP class instantiationZabbix · Zabbix | Medium6.9 |
| CVE-2026-23921 | Blind, read-only SQL injection in Zabbix API via sortfield parameterZabbix · Zabbix | High8.7 |
| CVE-2026-23920 | Host and event action script regex validation can be bypassed in certain situations, leading to potential command injectionZabbix · Zabbix | High7.7 |
| CVE-2026-23919 | Insufficient isolation of JavaScript (Duktape) execution context on Zabbix ServerZabbix · Zabbix | High7.1 |
| CVE-2026-23925 | Unauthorized host creation via configuration.import API by low-privilege user with write permissionsZabbix · Zabbix | Medium5.1 |
| CVE-2025-49643 | Frontend DoS vulnerability due to asymmetric resource consumptionZabbix · Zabbix | Medium6.0 |
| CVE-2025-49642 | Agent builds for AIX vulnerable to library loading hijackingZabbix · Zabbix | Medium5.8 |
| CVE-2025-27232 | Frontend arbitrary file read in oauth.authorize actionZabbix · Zabbix | Medium6.8 |
| CVE-2025-49641 | Insufficient permission check for the problem.view.refresh actionZabbix · Zabbix | Medium5.1 |
| CVE-2025-27237 | DLL injection in Zabbix Agent and Agent 2 via OpenSSL configurationZabbix · Zabbix | High7.3 |
| CVE-2025-27236 | User information disclosure via api_jsonrpc.php on method user.get with param searchZabbix · Zabbix | Low2.1 |
| CVE-2025-27231 | LDAP 'Bind password' field value can be leaked by a Zabbix Super AdminZabbix · Zabbix | Medium4.3 |
| CVE-2025-27240 | Secondary-order SQL injection in Zabbix Server when deleting an autoregistered hostZabbix · Zabbix | High7.5 |
| CVE-2025-27238 | API hostprototype.get lists data to users with insufficient authorization.Zabbix · Zabbix | Low2.1 |
| CVE-2025-27233 | Zabbix Agent 2 smartctl plugin argument injection in Zabbix 6.0 and later.Zabbix · Zabbix | Medium5.7 |
| CVE-2025-27234 | Zabbix Agent 2 smartctl plugin RCE vulnerability in Zabbix 5.0.Zabbix · Zabbix | High7.3 |
| CVE-2024-45700 | DoS vulnerability due to uncontrolled resource exhaustionZabbix · Zabbix | Medium6.0 |
| CVE-2024-45699 | Reflected XSS vulnerability in /zabbix.php?action=export.valuemapsZabbix · Zabbix | High7.5 |
| CVE-2024-42325 | Excessive information returned by user.getZabbix · Zabbix | Low2.1 |
| CVE-2024-36469 | User enumeration via timing attack in Zabbix web interfaceZabbix · Zabbix | Low2.3 |
| CVE-2024-36465 | SQL injection in Zabbix APIZabbix · Zabbix | High8.6 |
| CVE-2024-36466 | Unauthenticated Zabbix frontend takeover when SSO is being usedZabbix · Zabbix | High8.8 |
| CVE-2024-36464 | Media Types: Office365, SMTP passwords are unencrypted and visible in plaintext when exportedZabbix · Zabbix | Low2.7 |
| CVE-2024-42333 | Heap buffer over-readZabbix · Zabbix | Low2.7 |
| CVE-2024-42332 | New line injection in Zabbix SNMP trapsZabbix · Zabbix | Low3.7 |
| CVE-2024-42331 | Use after free in browser_push_errorZabbix · Zabbix | Low3.3 |
| CVE-2024-42330 | JS - Internal strings in HTTP headersZabbix · Zabbix | Critical9.1 |
| CVE-2024-42329 | JS - Crash on unexpected HTTP server responseZabbix · Zabbix | Low3.3 |
| CVE-2024-42328 | JS - Crash on empty HTTP server responseZabbix · Zabbix | Low3.3 |