Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 4 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,074All CVEsplus 19,119 rejected
- 507Last 24 hours2,869 in the last 7 days
- 16,887Last 30 days1,546 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 5 | 5 | 40 | 10 | 0 | 60 | 92 |
| 2025 | 0 | 1 | 3 | 5 | 0 | 9 | 32 |
| 2024 | 0 | 0 | 2 | 4 | 0 | 6 | 23 |
| 2023 | 1 | 0 | 0 | 3 | 0 | 4 | 17 |
| 2022 | 0 | 2 | 5 | 1 | 0 | 8 | 13 |
| 2021 | 0 | 2 | 3 | 0 | 0 | 5 | 5 |
| Title | ||
|---|---|---|
| CVE-2026-54912 | WAMR fast interpreter loader heap buffer overflow via constant deduplication mismatchbytecodealliance · wasm-micro-runtime | High8.8 |
| CVE-2026-54913 | WebAssembly Micro Runtime: Missing `ref.null` heap-type validation in `load_init_expr` leaks host stack memory to the WebAssembly guestbytecodealliance · wasm-micro-runtime | Medium6.9 |
| CVE-2026-54914 | WebAssembly Micro Runtime: Heap Buffer Overflow in WAMR WASI poll_oneoff Output Bufferbytecodealliance · wasm-micro-runtime | High8.3 |
| CVE-2026-121441 | Wasmtime before 36.0.19, 37.0.0 before 48.0.7, and 49.0.0 before 49.0.4 wasi-http Request Smugglingbytecodealliance · wasmtime | Medium6.3 |
| CVE-2026-121440 | Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 Forwarded Trailers Header Filter Bypassbytecodealliance · wasmtime | Medium6.3 |
| CVE-2026-121439 | Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 HTTP Response Splitting via wasi-httpbytecodealliance · wasmtime | Medium6.9 |
| CVE-2026-119143 | Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Panic via Zero-Length Stream Writesbytecodealliance · wasmtime | Medium5.9 |
| CVE-2026-119142 | Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via call_async Dropbytecodealliance · wasmtime | Medium5.9 |
| CVE-2026-119141 | Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via reallocbytecodealliance · wasmtime | Medium6.9 |
| CVE-2026-119140 | Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via thread.yieldbytecodealliance · wasmtime | Medium5.9 |
| CVE-2026-119139 | Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via Func::callbytecodealliance · wasmtime | Medium5.9 |
| CVE-2026-119138 | Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Panic After Trapbytecodealliance · wasmtime | Medium5.9 |
| CVE-2026-119137 | Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Stack Overflow via Type Registrybytecodealliance · wasmtime | Medium6.9 |
| CVE-2026-119136 | Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Async-Entrypoint Enforcement Bypassbytecodealliance · wasmtime | Medium5.9 |
| CVE-2026-119135 | Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Panic via StreamReader Type Mismatchbytecodealliance · wasmtime | Medium5.9 |
| CVE-2026-119134 | Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 Unbounded Memory Growth via Component-Model Resource Handlesbytecodealliance · wasmtime | Medium6.9 |
| CVE-2026-119133 | Wasmtime 47.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Misaligned VMContext via Exception Tagsbytecodealliance · wasmtime | Low2.1 |
| CVE-2026-119132 | Wasmtime 49.0.0 before 49.0.3 Host Panic via Overlapping String Transcode in Fused Adapterbytecodealliance · wasmtime | Medium5.9 |
| CVE-2026-119131 | Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via wasi-httpbytecodealliance · wasmtime | Medium6.9 |
| CVE-2026-119130 | Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 HTTP Request Target Smugglingbytecodealliance · wasmtime | Low2.1 |
| CVE-2026-118688 | Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 Sandbox Escape via Symlink Renamebytecodealliance · wasmtime | High8.8 |
| CVE-2026-115893 | Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instructionbytecodealliance · wasmtime | Critical9.9 |
| CVE-2026-115892 | Wasmtime: Panic lowering a host-created component model stream into a guest that expects a different payload typebytecodealliance · wasmtime | Medium5.7 |
| CVE-2026-115889 | Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilationbytecodealliance · wasmtime | Critical9.9 |
| CVE-2026-115393 | Wasmtime before 24.0.12, 25.0.0 before 36.0.13, 37.0.0 before 46.0.2, and 47.0.0 before 47.0.3 Cross-Engine Type Confusionbytecodealliance · wasmtime | Low1.0 |
| CVE-2026-115392 | Wasmtime before 24.0.13, 25.0.0 before 36.0.14, 37.0.0 before 46.0.3, and 47.0.0 before 47.0.4 Sandbox Escape via Trailing Slashesbytecodealliance · wasmtime | High8.8 |
| CVE-2026-115391 | Wasmtime 46.0.0 before 46.0.3 and 47.0.0 before 47.0.4 Unbounded Heap Allocation via WASIp3 Streamsbytecodealliance · wasmtime | Medium6.9 |
| CVE-2026-115390 | Wasmtime 47.0.0 before 48.0.3 and 49.0.0 before 49.0.1 Fuel Accounting Bypass DoSbytecodealliance · wasmtime | Medium6.9 |
| CVE-2026-115389 | Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 Denial of Service via Val APIbytecodealliance · wasmtime | Low1.0 |
| CVE-2026-115388 | Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 Memory Exhaustion DoS via wasmtime-wasi-http Outgoing Body Writebytecodealliance · wasmtime | Medium6.9 |
| CVE-2026-115387 | Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 Host Panic via WASI Filesystem Timestamp Overflowbytecodealliance · wasmtime | Medium6.9 |
| CVE-2026-115386 | Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Memory Disclosure via fd_readdirbytecodealliance · wasmtime | Low2.1 |
| CVE-2026-115385 | Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 Host Panic via WASIp3 Timestampsbytecodealliance · wasmtime | Medium6.9 |
| CVE-2026-115384 | Wasmtime 39.0.0 before 48.0.4 and 49.0.0 before 49.0.2 Stack Buffer Overflowbytecodealliance · wasmtime | Critical9.4 |
| CVE-2026-115383 | Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 GC Heap Corruption via Tag Importsbytecodealliance · wasmtime | Medium5.9 |
| CVE-2026-115382 | Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 wasi:http Zero Timeout Panic DoSbytecodealliance · wasmtime | Medium5.9 |
| CVE-2026-115381 | Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Unbounded Host Memory Allocation via SinkOutputStream write-zeroesbytecodealliance · wasmtime | Medium5.9 |
| CVE-2026-115380 | Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Fuel Limit Bypass DoS via WASI Preview 0 poll_oneoffbytecodealliance · wasmtime | Medium5.1 |
| CVE-2026-115379 | Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 GC Heap Corruption via try_callbytecodealliance · wasmtime | Medium6.9 |
| CVE-2026-104855 | Wasmtime: Preemption and traps during bulk operations enable breaking internal VM statebytecodealliance · wasmtime | Low2.0 |
| CVE-2026-58494 | Wasmtime: WASI hard links bypass wasmtime-wasi's FilePerms for destinationbytecodealliance · wasmtime | Medium6.5 |
| CVE-2026-54786 | Wasmtime: Leak in WASIp1 `fd_renumber` implementationbytecodealliance · wasmtime | Low2.3 |
| CVE-2026-47261 | Wasmtime: WASI path_open(TRUNCATE) bypasses `FilePerms::WRITE` host restrictionbytecodealliance · wasmtime | High7.5 |
| CVE-2026-44216 | Wasmtime: Panic when allocating a table exceeding the size of the host's address spacebytecodealliance · wasmtime | Medium5.9 |
| CVE-2026-35195 | Wasmtime has an out-of-bounds write or crash when transcoding component model stringsbytecodealliance · wasmtime | Medium6.1 |
| CVE-2026-35186 | Wasmtime has an improperly masked return value from `table.grow` with Winch compiler backendbytecodealliance · wasmtime | Medium6.1 |
| CVE-2026-34988 | Wasmtime leaks data between pooling allocator instancesbytecodealliance · wasmtime | Low2.3 |
| CVE-2026-34987 | Wasmtime with Winch compiler backend on aarch64 may allow a sandbox-escaping memory accessbytecodealliance · wasmtime | Critical9.0 |
| CVE-2026-34983 | Wasmtime has a use-after-free bug after cloning `wasmtime::Linker`bytecodealliance · wasmtime | Low1.0 |
| CVE-2026-34971 | Wasmtime miscompiled guest heap access enables sandbox escape on aarch64 Craneliftbytecodealliance · wasmtime | Critical9.0 |