Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 5 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,605All CVEsplus 19,141 rejected
- 674Last 24 hours2,972 in the last 7 days
- 17,115Last 30 days1,608 of them critical
- 1,769Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 0 | 4 | 23 | 13 | 0 | 40 | 58 |
| 2025 | 0 | 2 | 0 | 1 | 0 | 3 | 18 |
| 2024 | 0 | 2 | 7 | 0 | 0 | 9 | 15 |
| 2023 | 0 | 1 | 3 | 1 | 0 | 5 | 6 |
| 2022 | 0 | 0 | 0 | 0 | 0 | 0 | 1 |
| 2021 | 0 | 0 | 0 | 1 | 0 | 1 | 1 |
| Title | ||
|---|---|---|
| CVE-2026-111750 | AIOHTTP: Pure-Python parser request smugglingaio-libs · aiohttp | Medium6.3 |
| CVE-2026-111749 | AIOHTTP: Cookie from subdomain can remove Host-Only Scope from existing cookiesaio-libs · aiohttp | Low2.3 |
| CVE-2026-111748 | AIOHTTP: Absolute-form request targets can spoof Request.schemeaio-libs · aiohttp | Medium6.3 |
| CVE-2026-111066 | AIOHTTP: File descriptor exhaustion in multipart requestsaio-libs · aiohttp | High8.2 |
| CVE-2026-111065 | AIOHTTP: Connector pool exhaustion via Max-Age overflowaio-libs · aiohttp | Medium6.9 |
| CVE-2026-111064 | aiohttp server lacks an initial request/header timeoutaio-libs · aiohttp | High8.2 |
| CVE-2026-111063 | AIOHTTP: Secure attribute not enforced for shared cookieaio-libs · aiohttp | Medium6.3 |
| CVE-2026-104874 | Multidict: Reference leak in CIMultiDict/MultiDict items-view union and subtractionaio-libs · multidict | Medium5.3 |
| CVE-2026-69244 | AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)aio-libs · aiohttp | High7.1 |
| CVE-2026-69243 | AIOHTTP: HTTP request smuggling via WebSocket upgradeaio-libs · aiohttp | Medium6.3 |
| CVE-2026-59881 | AIOHTTP: WebSocket client accepts compressed frames without negotiated permessage-deflateaio-libs · aiohttp | Medium6.9 |
| CVE-2026-54273 | AIOHTTP: HTTP/1 Pipelined Requests Queue Without Limitaio-libs · aiohttp | Medium6.6 |
| CVE-2026-54280 | AIOHTTP: Payload Response Resources Are Not Closed After Mid-Body Disconnectaio-libs · aiohttp | Low1.7 |
| CVE-2026-54278 | AIOHTTP: Unread Compressed Request Bodies Bypass client_max_size During Cleanupaio-libs · aiohttp | Medium6.6 |
| CVE-2026-54277 | AIOHTTP: C HTTP Parser Bypasses max_line_size for Fragmented Linesaio-libs · aiohttp | Medium6.6 |
| CVE-2026-54276 | AIOHTTP: DigestAuthMiddleware Applies Credentials to Cross-Origin Redirect Challengesaio-libs · aiohttp | Medium6.3 |
| CVE-2026-54275 | AIOHTTP: TLS Server Hostname Override Is Ignored When Reusing HTTPS Connectionsaio-libs · aiohttp | Low2.7 |
| CVE-2026-54274 | AIOHTTP: Incomplete websocket frame payloads bypass memory limitsaio-libs · aiohttp | Medium6.6 |
| CVE-2026-54279 | AIOHTTP: Host-Only Cookies Become Domain Cookies After CookieJar Persistenceaio-libs · aiohttp | Low1.3 |
| CVE-2026-50269 | AIOHTTP: CRLF injection in multipart headersaio-libs · aiohttp | Low2.7 |
| CVE-2026-47265 | AIOHTTP vulnerable to cross-origin redirect with per-request cookiesaio-libs · aiohttp | Medium6.6 |
| CVE-2026-34993 | AIOHTTP Vulnerable to Deserialization of Untrusted Dataaio-libs · aiohttp | Medium6.4 |
| CVE-2026-34525 | AIOHTTP: Duplicate Host header acceptedaio-libs · aiohttp | Medium6.3 |
| CVE-2026-34520 | AIOHTTP: C parser (llhttp) accepts null bytes and control characters in response header values - header injection / security bypassaio-libs · aiohttp | Low2.7 |
| CVE-2026-34519 | AIOHTTP: HTTP response splitting via \r in reason phraseaio-libs · aiohttp | Low2.7 |
| CVE-2026-34518 | AIOHTTP: Cookie and Proxy-Authorization headers leaked on cross-origin redirectaio-libs · aiohttp | Low2.7 |
| CVE-2026-34517 | AIOHTTP: Late size enforcement for non-file multipart fields causes memory DoSaio-libs · aiohttp | Low2.7 |
| CVE-2026-34516 | AIOHTTP: Multipart Header Size Bypassaio-libs · aiohttp | Medium6.6 |
| CVE-2026-34515 | AIOHTTP: UNC SSRF/NTLMv2 Credential Theft/Local File Read in static resource handler on Windowsaio-libs · aiohttp | Medium6.6 |
| CVE-2026-34514 | AIOHTTP: CRLF injection in multipart part content type header constructionaio-libs · aiohttp | Low2.7 |
| CVE-2026-22815 | AIOHTTP: Uncapped memory usage possible through aiohttp allowing unlimited trailer headersaio-libs · aiohttp | Medium6.9 |
| CVE-2026-34513 | AIOHTTP: Denial of Service (DoS) via Unbounded DNS Cache in TCPConnectoraio-libs · aiohttp | Low2.7 |
| CVE-2025-69230 | AIOHTTP Vulnerable to Cookie Parser Warning Stormaio-libs · aiohttp | Low2.7 |
| CVE-2025-69229 | AIOHTTP vulnerable to DoS through chunked messagesaio-libs · aiohttp | Medium6.6 |
| CVE-2025-69228 | AIOHTTP vulnerable to denial of service through large payloadsaio-libs · aiohttp | Medium6.6 |
| CVE-2025-69227 | AIOHTTP vulnerable to DoS when bypassing assertsaio-libs · aiohttp | Medium6.6 |
| CVE-2025-69225 | AIOHTTP Regex Mismatch Allows Unicode in ASCII-Only Protocol Fieldsaio-libs · aiohttp | Low2.7 |
| CVE-2025-69226 | AIOHTTP allows for a brute-force leak of internal static filepath componentsaio-libs · aiohttp | Medium6.3 |
| CVE-2025-69224 | AIOHTTP's Unicode processing of header values could cause parsing discrepanciesaio-libs · aiohttp | Medium6.3 |
| CVE-2025-69223 | AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bombaio-libs · aiohttp | High7.5 |
| CVE-2025-62611 | aiomysql allows arbitrary access to client files through vulnerability of a malicious MySQL serveraio-libs · aiomysql | High8.2 |
| CVE-2025-53643 | AIOHTTP is vulnerable to HTTP Request/Response Smuggling through incorrect parsing of chunked trailer sectionsaio-libs · aiohttp | Low1.7 |
| CVE-2025-48945 | pycares has a Use-After-Free Vulnerabilityaio-libs · aiodns | High8.2 |
| CVE-2024-52304 | aiohttp vulnerable to request smuggling due to incorrect parsing of chunk extensionsaio-libs · aiohttp | Medium6.3 |
| CVE-2024-52303 | aiohttp memory leak when middleware is enabled when requesting a resource with a non-allowed methodaio-libs · aiohttp | High8.7 |
| CVE-2024-42367 | In aiohttp, compressed files as symlinks are not protected from path traversalaio-libs · aiohttp | Medium4.8 |
| CVE-2024-34083 | STARTTLS unencrypted commands injectionaio-libs · aiosmtpd | Medium5.4 |
| CVE-2024-30251 | Denial of service when trying to parse malformed POST requests in aiohttpaio-libs · aiohttp | High7.5 |
| CVE-2024-27306 | aiohttp vulnerable to XSS on index pages for static file handlingaio-libs · aiohttp | Medium6.1 |
| CVE-2024-27305 | SMTP smuggling in aiosmtpdaio-libs · aiosmtpd | Medium5.3 |