Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 10 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 400,561All CVEsplus 18,890 rejected
- 402Last 24 hours3,029 in the last 7 days
- 17,425Last 30 days1,598 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 1 | 3 | 8 | 0 | 0 | 12 | 40 |
| 2025 | 3 | 3 | 4 | 1 | 0 | 11 | 28 |
| 2024 | 0 | 0 | 1 | 0 | 0 | 1 | 17 |
| 2023 | 0 | 0 | 0 | 0 | 0 | 0 | 16 |
| 2022 | 0 | 1 | 5 | 0 | 0 | 6 | 16 |
| 2021 | 0 | 2 | 2 | 0 | 0 | 4 | 10 |
| 2020 | 0 | 4 | 2 | 0 | 0 | 6 | 6 |
| Title | ||
|---|---|---|
| CVE-2026-85473 | Out-of-Range Timestamp Claim Handling in auth0/java-jwtAuth0 · java-jwt | Medium5.3 |
| CVE-2026-107371 | Missing Verification of auth_time Claim in auth0.jsAuth0 · auth0.js | Medium5.4 |
| CVE-2026-107370 | Improper Request Handling for Active Directory Logins in auth0-lockAuth0 · auth0-lock | Medium5.3 |
| CVE-2026-107369 | Improper Validation of Post-Login Redirect URL in nextjs-auth0Auth0 · nextjs-auth0 | Medium6.1 |
| CVE-2026-50157 | Auth0 Symfony: Bearer Token Accepted via URL Query Parameter in Auth0 Symfony SDKauth0 · symfony | Medium6.5 |
| CVE-2026-84685 | Improper Cache Isolation in auth0/react-native-auth0 SDK Web Platform Credential ManagementAuth0 · react-native-auth0 | Medium6.5 |
| CVE-2026-85983 | Local Privilege Escalation in Auth0 AD/LDAP ConnectorAuth0 · Auth0 AD/LDAP Connector | High7.8 |
| CVE-2026-85982 | Stored Cross-Site Scripting (XSS) in Auth0 AD/LDAP ConnectorAuth0 · Auth0 AD/LDAP Connector | Critical9.0 |
| CVE-2026-85981 | Unauthenticated Localhost Admin Panel in Auth0 AD/LDAP ConnectorAuth0 · Auth0 AD/LDAP Connector | Medium6.7 |
| CVE-2026-42280 | Improper Permission Checking in Auth.js SDKauth0 · auth0.js | High7.1 |
| CVE-2026-40155 | Auth0 Next.js SDK has Improper Proxy Cache Lookupauth0 · nextjs-auth0 | Medium5.4 |
| CVE-2026-34236 | Auth0 PHP SDK Insufficient Entropy in Cookie Encryptionauth0 · auth0-PHP | High8.2 |
| CVE-2025-68129 | Auth0-PHP SDK has Improper Audience Validationauth0 · auth0-PHP | Medium6.8 |
| CVE-2025-67716 | Auth0 Next.js SDK has Improper Validation of Query Parametersauth0 · nextjs-auth0 | Medium5.7 |
| CVE-2025-67490 | Auth0 Next.js SDK has Improper Request Caching Lookupauth0 · nextjs-auth0 | Medium5.4 |
| CVE-2025-65945 | auth0/node-jws improper HMAC signature verification vulnerabilityauth0 · node-jws | High7.5 |
| CVE-2025-58769 | auth0-PHP: Improper File Type Handling in Bulk User Importauth0 · laravel-auth0 | Low3.3 |
| CVE-2025-48947 | NextJS-Auth0 SDK Vulnerable to CDN Caching of Session Cookiesauth0 · nextjs-auth0 | High7.7 |
| CVE-2025-48951 | Auth0-PHP SDK Deserialization of Untrusted Data vulnerabilityauth0 · auth0-PHP | Critical9.3 |
| CVE-2025-47275 | Brute Force Authentication Tags of CookieStore Sessions in Auth0-PHP SDKauth0 · auth0-PHP | Critical9.1 |
| CVE-2025-46573 | passport-wsfed-saml2 Has SAML Authentication Bypass via Attribute Smugglingauth0 · passport-wsfed-saml2 | High8.6 |
| CVE-2025-46572 | passport-wsfed-saml2 Has SAML Authentication Bypass via Signature Wrappingauth0 · passport-wsfed-saml2 | Critical9.3 |
| CVE-2025-46344 | Auth0 NextJS SDK v4 Missing Session Invalidationauth0 · nextjs-auth0 | Medium4.9 |
| CVE-2023-6813 | Login by Auth0 <= 4.6.0 - Reflected Cross-Site Scripting via wleauth0 · Login by Auth0 | Medium6.1 |
| CVE-2022-23539 | jsonwebtoken unrestricted key type could lead to legacy keys usageauth0 · node-jsonwebtoken | Medium5.9 |
| CVE-2022-23540 | jsonwebtoken vulnerable to signature validation bypass due to insecure default algorithm in jwt.verify()auth0 · node-jsonwebtoken | Medium6.4 |
| CVE-2022-23541 | jsonwebtoken's insecure implementation of key retrieval function could lead to Forgeable Public/Private Tokens from RSA to HMACauth0 · node-jsonwebtoken | Medium5.0 |
| CVE-2022-23505 | Passport-wsfed-saml2 vulnerable to Authentication Bypass for WSFed authenticationauth0 · passport-wsfed-saml2 | Medium5.3 |
| CVE-2022-29172 | HTML injection with additional signup fieldsauth0 · lock | Medium6.1 |
| CVE-2022-24794 | Open Redirect in express-openid-connectauth0 · express-openid-connect | High7.5 |
| CVE-2021-43812 | Open redirect in nextjs-auth0auth0 · nextjs-auth0 | Medium6.4 |
| CVE-2021-41246 | Session fixation in express-openid-connectauth0 · express-openid-connect | Medium4.6 |
| CVE-2021-32702 | Reflected XSS from the callback handler's error query parameterauth0 · nextjs-auth0 | High8.0 |
| CVE-2021-32641 | Reflected XSS when using flashMessagesauth0 · lock | High8.1 |
| CVE-2020-15259 | CSRF in Auth0 ad-ldap-connectorauth0 · ad-ldap-connector | High8.1 |
| CVE-2020-15240 | Regression in JWT Signature Validationauth0 · omniauth-auth0 | High7.4 |
| CVE-2020-15119 | DOM-based XSS in auth0-lockauth0 · lock | Medium6.4 |
| CVE-2020-15125 | Authorization header is not sanitized in an error object in auth0auth0 · node-auth0 | High7.7 |
| CVE-2020-15084 | Authorization bypass in express-jwtauth0 · express-jwt | High7.7 |
| CVE-2020-5263 | Information disclosure through error objectauth0 · auth0.js | Medium5.5 |