Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 9 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,058All CVEsplus 19,119 rejected
- 491Last 24 hours2,911 in the last 7 days
- 16,876Last 30 days1,544 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 0 | 5 | 7 | 1 | 0 | 13 | 42 |
| 2025 | 0 | 3 | 0 | 0 | 0 | 3 | 29 |
| 2024 | 2 | 0 | 1 | 1 | 0 | 4 | 26 |
| 2023 | 0 | 0 | 4 | 1 | 0 | 5 | 22 |
| 2022 | 0 | 2 | 13 | 2 | 0 | 17 | 17 |
| Title | ||
|---|---|---|
| CVE-2026-55489 | BigBlueButton: IDOR on BBB through /api/graphql via POST parameter "presentationId" leads to Authentication Bypassbigbluebutton · bigbluebutton | Medium4.9 |
| CVE-2026-55491 | BigBlueButton: Stored XSS in Screenshare Recording Playback via Unescaped Meeting Namebigbluebutton · bigbluebutton | Medium5.4 |
| CVE-2026-46355 | BigBlueButton: Unauthenticated Session Hijack via Exposed /bigbluebutton/api/handleJoinExistingUserbigbluebutton · bigbluebutton | High7.1 |
| CVE-2026-46682 | BigBlueButton: Blind SQL Injection AUTH (Moderator)bigbluebutton · bigbluebutton | High8.5 |
| CVE-2026-46353 | BigBlueButton API checksum bypass via presentationUploadExternalUrlbigbluebutton · bigbluebutton | High8.1 |
| CVE-2026-46404 | BigBlueButton: Presentation URL Security Hardeningbigbluebutton · bigbluebutton | Medium6.8 |
| CVE-2026-46351 | BigBlueButton: Insecure Randomness allows to guess user's conference session token and impersonate thembigbluebutton · bigbluebutton | High8.1 |
| CVE-2026-27737 | BigBlueButton has Stored XSS in bbb-playback replaybigbluebutton · bigbluebutton | Medium6.5 |
| CVE-2026-41127 | BigBlueButton's missing authorization allows viewer to inject/overwrite captionsbigbluebutton · bigbluebutton | Medium6.5 |
| CVE-2026-41126 | BigBlueButton has Open Redirect through bigbluebutton/api/join via get-parameter "logoutURL"bigbluebutton · bigbluebutton | Medium4.3 |
| CVE-2026-27736 | BigBlueButton has Open Redirect vulnerability in ApiControllerbigbluebutton · bigbluebutton | Medium6.1 |
| CVE-2026-27467 | BigBlueButton: Audio from participants to the server initially unmutedbigbluebutton · bigbluebutton | Low2.0 |
| CVE-2026-27466 | BigBlueButton: Exposed ClamAV port enables Denial of Servicebigbluebutton · bigbluebutton | High7.2 |
| CVE-2025-61602 | BigBlueButton vulnerable to Chat DoS via invalid reactionEmojiIdbigbluebutton · bigbluebutton | High7.5 |
| CVE-2025-61601 | BigBlueButton vulnerable to DoS via PollSubmitVote GraphQL mutationbigbluebutton · bigbluebutton | High7.5 |
| CVE-2025-55200 | BigBlueButton vulnerable to Stored XSS via name of user at Shared Notesbigbluebutton · bigbluebutton | High7.1 |
| CVE-2024-39302 | Some bbb-record-core files installed with wrong file permissionbigbluebutton · bigbluebutton | Low3.7 |
| CVE-2024-38518 | bbb-web API additional parameters consideredbigbluebutton · bigbluebutton | Medium4.6 |
| CVE-2022-36029 | BigBlueButton Greenlight Open Redirect vulnerabilitybigbluebutton · greenlight | Critical9.1 |
| CVE-2022-36028 | BigBlueButton Greenlight Open Redirect vulnerabilitybigbluebutton · greenlight | Critical9.1 |
| CVE-2023-43798 | BigBlueButton Blind SSRF When Uploading Presentation (mitigation bypass)bigbluebutton · bigbluebutton | Medium5.6 |
| CVE-2023-43797 | BigBlueButton Stored Cross-site Scripting vulnerability at Guest Lobbybigbluebutton · bigbluebutton | Medium6.3 |
| CVE-2023-42804 | BigBlueButton Path Traversal – Reading Certain File Extensionsbigbluebutton · bigbluebutton | Low3.1 |
| CVE-2023-42803 | BigBlueButton Unrestricted File Upload vulnerabilitybigbluebutton · bigbluebutton | Medium5.3 |
| CVE-2023-33176 | Blind SSRF When Uploading Presentation in BigBlueButtonbigbluebutton · bigbluebutton | Medium4.8 |
| CVE-2022-23488 | BigBlueButton vulnerable to Insertion of Sensitive Information Into Sent Databigbluebutton · bigbluebutton | Medium6.5 |
| CVE-2022-23490 | Improper access control to polling votesbigbluebutton · bigbluebutton | Medium4.3 |
| CVE-2022-41964 | BigBlueButton contains Response leaks in anonymous pollsbigbluebutton · bigbluebutton | Medium5.7 |
| CVE-2022-41963 | BigBlueButton contains Improper Preservation of Permissions for whiteboardbigbluebutton · bigbluebutton | Low2.7 |
| CVE-2022-41962 | BigBlueButton contains Incorrect Authorization for setting emoji statusbigbluebutton · bigbluebutton | Low2.7 |
| CVE-2022-41961 | BigBlueButton subject to Ineffective user bansbigbluebutton · bigbluebutton | Medium4.3 |
| CVE-2022-41960 | BigBlueButton contains DoS via failed authToken validationbigbluebutton · bigbluebutton | Medium4.3 |
| CVE-2022-31064 | Cross site scripting in username that will trigger by sending chatbigbluebutton · bigbluebutton | Medium6.5 |
| CVE-2022-31065 | Cross site scripting vulnerability for private chat in bigbluebuttonbigbluebutton · bigbluebutton | Medium6.5 |
| CVE-2022-31039 | Improper privilege management - Anyone can view room settings in GreenLightbigbluebutton · greenlight | Medium4.3 |
| CVE-2022-29235 | Limited data exposure for shared external videos in BigBlueButtonbigbluebutton · bigbluebutton | Medium5.3 |
| CVE-2022-29236 | Improper access control for pencil annotations in BigBlueButtonbigbluebutton · bigbluebutton | Medium4.3 |
| CVE-2022-29234 | Grace period for lock settings in public/private chats in BigBlueButtonbigbluebutton · bigbluebutton | Medium4.3 |
| CVE-2022-29233 | Improper access control for breakout rooms in BigBlue Buttonbigbluebutton · bigbluebutton | Medium4.3 |
| CVE-2022-29232 | Exposure of messages in BigBlueButton public chatsbigbluebutton · bigbluebutton | Medium6.5 |
| CVE-2022-29169 | ReDoS on endpoint html5client/useragent in BigBlueButtonbigbluebutton · bigbluebutton | High7.5 |
| CVE-2021-4143 | Cross-site Scripting (XSS) - Generic in bigbluebutton/bigbluebuttonbigbluebutton · bigbluebutton/bigbluebutton | High8.1 |