Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 6 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,625All CVEsplus 19,141 rejected
- 672Last 24 hours2,950 in the last 7 days
- 17,121Last 30 days1,607 of them critical
- 1,769Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 0 | 20 | 26 | 2 | 0 | 48 | 53 |
| 2025 | 0 | 2 | 0 | 0 | 1 | 3 | 5 |
| 2024 | 0 | 0 | 0 | 0 | 0 | 0 | 2 |
| 2023 | 0 | 0 | 0 | 0 | 0 | 0 | 2 |
| 2022 | 0 | 0 | 0 | 0 | 0 | 0 | 2 |
| 2021 | 0 | 1 | 0 | 0 | 0 | 1 | 2 |
| 2020 | 0 | 0 | 0 | 0 | 0 | 0 | 1 |
| 2019 | 0 | 1 | 0 | 0 | 0 | 1 | 1 |
| Title | ||
|---|---|---|
| CVE-2026-101899 | Axios: CIDR-form NO_PROXY entries are ignored, causing proxy exclusion bypass for internal IP rangesaxios · axios | Medium6.9 |
| CVE-2026-101909 | Axios: Prototype Pollution Gadget in axios toFormData Optionsaxios · axios | High8.3 |
| CVE-2026-101908 | Axios: Prototype pollution gadget in fetch adapter can alter outbound requestsaxios · axios | Medium6.9 |
| CVE-2026-101907 | Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRFaxios · axios | High7.0 |
| CVE-2026-101906 | Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Locationaxios · axios | High8.2 |
| CVE-2026-101905 | Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnectionaxios · axios | High7.6 |
| CVE-2026-101904 | Axios: Header Injection via Inherited headers After Minimal Interceptoraxios · axios | Medium6.9 |
| CVE-2026-101903 | Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS)axios · axios | High8.2 |
| CVE-2026-101902 | Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Methodaxios · axios | Medium6.9 |
| CVE-2026-101901 | Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initializationaxios · axios | High8.2 |
| CVE-2026-101900 | Axios: Fetch Adapter Header Injection via Inherited FormData getHeadersaxios · axios | Medium6.9 |
| CVE-2026-101898 | Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controlsaxios · axios | High7.0 |
| CVE-2026-67321 | axios 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 Denial of Service via maxDepth bypassaxios · axios | Medium6.9 |
| CVE-2026-67319 | axios before 0.33.0 Prototype Pollution via nested option objectsaxios · axios | Medium6.3 |
| CVE-2026-67318 | axios 1.13.0 before 1.18.0 maxBodyLength Bypass via HTTP/2axios · axios | Medium6.3 |
| CVE-2026-67316 | axios before 1.18.0 Prototype Pollution via bodyless methodsaxios · axios | Medium6.3 |
| CVE-2026-67315 | axios 0.31.0 before 0.33.0 and 1.15.0 before 1.18.0 NO_PROXY Bypass via 0.0.0.0axios · axios | Medium6.9 |
| CVE-2026-67312 | axios 0.28.0 before 0.33.0 and 1.0.0 before 1.18.0 Denial of Service via formToJSONaxios · axios | Medium6.3 |
| CVE-2026-67320 | axios before 0.33.0 Prototype Pollution via Node HTTP adapteraxios · axios | High8.3 |
| CVE-2026-67317 | axios 1.7.0 before 1.18.0 maxBodyLength Bypass via ReadableStreamaxios · axios | Medium6.3 |
| CVE-2026-67314 | axios before 1.18.0 Prototype Pollution via auth subfieldsaxios · axios | Medium6.3 |
| CVE-2026-67313 | axios 0.28.0 before 1.18.0 Denial of Service via formDataToJSONaxios · axios | Medium6.3 |
| CVE-2026-44486 | Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connectionaxios · axios | High7.5 |
| CVE-2026-44487 | Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapteraxios · axios | High8.2 |
| CVE-2026-44488 | Axios: Allocation of Resources Without Limits or Throttling in axiosaxios · axios | High7.5 |
| CVE-2026-44490 | Axios: DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functionsaxios · axios | Medium4.8 |
| CVE-2026-44496 | Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injectionaxios · axios | High7.5 |
| CVE-2026-44495 | Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Mergeaxios · axios | High7.0 |
| CVE-2026-44494 | Axios: Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`axios · axios | High8.7 |
| CVE-2026-44489 | Axios: Proxy-Authorization Header Injection via Prototype Pollution — Incomplete Null-Prototype Fixaxios · axios | Low3.7 |
| CVE-2026-44492 | Axios: shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)axios · axios | High8.6 |
| CVE-2026-42264 | Axios: Prototype pollution read-side gadgets in HTTP adapter allow credential injection and request hijackingaxios · axios | High7.4 |
| CVE-2026-42042 | Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXSRFToken` Boolean Coercionaxios · axios | Medium5.4 |
| CVE-2026-42039 | Axios: unbounded recursion in toFormData causes DoS via deeply nested request dataaxios · axios | Medium6.9 |
| CVE-2026-42036 | Axios: HTTP adapter streamed responses bypass maxContentLengthaxios · axios | Medium5.3 |
| CVE-2026-42034 | Axios: HTTP adapter streamed uploads bypass maxBodyLength when maxRedirects: 0axios · axios | Medium5.3 |
| CVE-2026-42037 | Axios: CRLF Injection in multipart/form-data body via unsanitized blob.type in formDataToStreamaxios · axios | Medium5.3 |
| CVE-2026-42038 | Axios: no_proxy bypass via IP alias allows SSRFaxios · axios | Medium6.8 |
| CVE-2026-42041 | Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategyaxios · axios | Medium4.8 |
| CVE-2026-42043 | Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0axios · axios | High7.2 |
| CVE-2026-42044 | Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`axios · axios | Medium6.5 |
| CVE-2026-42040 | Axios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParamsaxios · axios | Low3.7 |
| CVE-2026-42035 | Axios: Header Injection via Prototype Pollutionaxios · axios | High7.4 |
| CVE-2026-42033 | Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijackingaxios · axios | High7.4 |
| CVE-2026-40175 | Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chainaxios · axios | Medium4.8 |
| CVE-2025-62718 | Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRFaxios · axios | Medium6.3 |
| CVE-2026-39865 | Axios HTTP/2 Session Cleanup State Corruption Vulnerabilityaxios · axios | Medium5.9 |
| CVE-2026-25639 | Axios affected by Denial of Service via __proto__ Key in mergeConfigaxios · axios | High7.5 |
| CVE-2025-58754 | Axios is vulnerable to DoS attack through lack of data size checkaxios · axios | High7.5 |
| CVE-2025-27152 | Possible SSRF and Credential Leakage via Absolute URL in axios Requestsaxios · axios | High7.7 |