Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 7 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,074All CVEsplus 19,119 rejected
- 507Last 24 hours2,869 in the last 7 days
- 16,887Last 30 days1,546 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 0 | 8 | 10 | 0 | 0 | 18 | 21 |
| 2025 | 0 | 1 | 1 | 0 | 0 | 2 | 3 |
| 2024 | 0 | 1 | 0 | 0 | 0 | 1 | 1 |
| Title | ||
|---|---|---|
| CVE-2026-105768 | apko /etc/passwd and /etc/group UID/GID truncation writes package-supplied entries as rootchainguard-dev · apko | Medium6.3 |
| CVE-2026-54174 | melange: Incomplete package integrity verification allows data section substitutionchainguard-dev · melange | High8.3 |
| CVE-2026-42576 | apko `DiscoverKeys` has a panic on non-rsa jwks key that causes crash during key discoverychainguard-dev · apko | Medium6.5 |
| CVE-2026-42575 | apko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible)chainguard-dev · apko | High7.5 |
| CVE-2026-42574 | apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build rootchainguard-dev · apko | High7.5 |
| CVE-2026-29051 | melange has Path Traversal via .PKGINFO in --persist-lint-resultschainguard-dev · melange | Medium4.4 |
| CVE-2026-29050 | melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].useschainguard-dev · melange | Medium6.1 |
| CVE-2026-29049 | melange: unbounded HTTP download in `melange update-cache` can exhaust disk in CIchainguard-dev · melange | Medium4.3 |
| CVE-2026-28407 | malcontent's nested archive extraction failure can drop content from scan inputschainguard-dev · malcontent | Medium6.9 |
| CVE-2026-25145 | melange has a path traversal in license-path which allows reading files outside workspacechainguard-dev · melange | Medium5.5 |
| CVE-2026-25143 | melange affected by potential host command execution via license-check YAML mode patch pipelinechainguard-dev · melange | High7.8 |
| CVE-2026-24844 | melange pipeline working-directory could allow command injectionchainguard-dev · melange | High7.8 |
| CVE-2026-24843 | melange QEMU runner could write files outside workspace directorychainguard-dev · melange | High8.2 |
| CVE-2026-25140 | apko affected by potential unbounded resource consumption in expandapk.ExpandApk on attacker-controlled .apk streamschainguard-dev · apko | High7.5 |
| CVE-2026-25121 | apko is vulnerable to path traversal in apko dirFS which allows filesystem writes outside basechainguard-dev · apko | High7.5 |
| CVE-2026-25122 | apko is vulnerable to unbounded resource consumption in expandapk.Split on attacker-controlled .apk streamschainguard-dev · apko | Medium5.5 |
| CVE-2026-24846 | malcontent's archive extraction could write outside extraction directorychainguard-dev · malcontent | Medium5.5 |
| CVE-2026-24845 | malcontent's OCI image scanning could expose registry credentialschainguard-dev · malcontent | Medium6.5 |
| CVE-2025-54059 | melange creates SBOM files in APKs with world-writable permissionschainguard-dev · melange | Medium4.4 |
| CVE-2025-53945 | apko has incorrect permission (0666) in /etc/ld.so.cache and other fileschainguard-dev · apko | High7.0 |
| CVE-2024-36127 | apko Exposure of HTTP basic auth credentials in log outputchainguard-dev · apko | High7.5 |