Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 3 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 400,451All CVEsplus 18,890 rejected
- 365Last 24 hours2,971 in the last 7 days
- 17,371Last 30 days1,592 of them critical
- 1,767Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 4 | 9 | 11 | 2 | 0 | 26 | 30 |
| 2025 | 1 | 2 | 1 | 0 | 0 | 4 | 4 |
| Title | ||
|---|---|---|
| CVE-2026-119284 | joserfc: Compact JWS size guard allocates attacker-controlled segments before rejectionauthlib · joserfc | Medium6.9 |
| CVE-2026-119283 | joserfc: Unbounded JWE General JSON `recipients` Array Leads to CPU Exhaustion (DoS) via Repeated RSA Private-Key Decryptionauthlib · joserfc | High7.5 |
| CVE-2026-116672 | Authlib RFC 7592 examples omit registration-access-token client bindingauthlib · authlib | High8.8 |
| CVE-2026-114620 | Authlib: Unvalidated request_uri fetch in JWT-secured authorization request (JAR) leading to SSRFauthlib · authlib | Medium5.4 |
| CVE-2026-114619 | Authlib: OpenID implicit grant checks raw scope instead of allowed scope before issuing ID tokensauthlib · authlib | Medium4.6 |
| CVE-2026-114618 | Authlib: Default JWT bearer grant accepts assertions for the wrong audienceauthlib · authlib | Medium6.8 |
| CVE-2026-114617 | Authlib: ID token can disable its own nonce validation via the nonce_supported claimauthlib · authlib | Medium4.2 |
| CVE-2026-114616 | Authlib accepts an empty HMAC key, allowing JWS/JWT signature forgery (HS256/HS384/HS512)authlib · authlib | High7.4 |
| CVE-2026-114615 | Authlib incomplete algorithm-confusion fix permits HMAC forgery with prefixed public keysauthlib · authlib | High7.4 |
| CVE-2026-114614 | Authlib: is_secure_transport() loopback exemption can be bypassed with a userinfo component, allowing cleartext-HTTP URLs to non-loopback hostsauthlib · authlib | Low2.6 |
| CVE-2026-102946 | joserfc: JWS signature verification bypass via empty signatures array in jws.deserialize_jsonauthlib · joserfc | Critical9.1 |
| CVE-2026-104056 | CVE-2026-104056Authlib · Authlib | Critical9.8 |
| CVE-2026-96760 | Authlib library contains a signature‑verification bypass vulnerabilityAuthlib · Authlib | Critical9.8 |
| CVE-2026-75509 | joserfc claim-validation bypass via array-typed single-string claims (iss/sub/jti)authlib · joserfc | Medium6.5 |
| CVE-2026-62995 | joserfc accepts JWT with padding, leading to JWT malleabilityauthlib · joserfc | Low2.3 |
| CVE-2026-49852 | joserfc: HS256/HS384/HS512 verify accepts empty/nil HMAC key (cross-language sibling of CVE-2026-45363)authlib · joserfc | High8.7 |
| CVE-2026-41479 | Authlib OAuth 2.0 authorization endpoint open redirects to attacker-controlled redirect_uri on unsupported response_typeauthlib · authlib | Medium5.4 |
| CVE-2026-48990 | joserfc: b64=false RFC7797 JWS payloads bypass JWSRegistry payload-size limits during deserializationauthlib · joserfc | Medium5.3 |
| CVE-2026-44681 | Authlib: Open Redirect in Authlib OIDC Implicit/Hybrid Authorizationauthlib · authlib | Medium6.1 |
| CVE-2026-41425 | Authlib: Cross-site request forging when using cacheauthlib · authlib | Medium5.4 |
| CVE-2026-28498 | Authlib: Fail-Open Cryptographic Verification in OIDC Hash Bindingauthlib · authlib | High8.2 |
| CVE-2026-28490 | Authlib Vulnerable to JWE RSA1_5 Bleichenbacher Padding Oracleauthlib · authlib | High8.3 |
| CVE-2026-27962 | Authlib JWS JWK Header Injection: Signature Verification Bypassauthlib · authlib | Critical9.1 |
| CVE-2026-28802 | Authlib: Setting `alg: none` and a blank signature appears to bypass signature verificationauthlib · authlib | High7.7 |
| CVE-2026-27932 | joserfc PBES2 p2c Unbounded Iteration Count enables Denial of Service (DoS)authlib · joserfc | High7.5 |
| CVE-2025-68158 | Authlib: 1-click Account Takeoverauthlib · authlib | Medium5.7 |
| CVE-2025-65015 | joserfc has Possible Uncontrolled Resource Consumption Vulnerability Triggered by Logging Arbitrarily Large JWT Token Payloadsauthlib · joserfc | Critical9.2 |
| CVE-2025-62706 | Authlib : JWE zip=DEF decompression bomb enables DoSauthlib · authlib | Medium6.5 |
| CVE-2025-61920 | Authlib is vulnerable to Denial of Service via Oversized JOSE Segmentsauthlib · authlib | High7.5 |
| CVE-2025-59420 | Authlib: JWS/JWT accepts unknown crit headers (RFC violation → possible authz bypass)authlib · authlib | High7.5 |