Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 8 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,167All CVEsplus 19,120 rejected
- 474Last 24 hours2,785 in the last 7 days
- 16,854Last 30 days1,538 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 0 | 5 | 3 | 0 | 0 | 8 | 17 |
| 2025 | 0 | 0 | 0 | 1 | 0 | 1 | 9 |
| 2024 | 0 | 3 | 0 | 0 | 0 | 3 | 8 |
| 2023 | 0 | 0 | 1 | 0 | 0 | 1 | 5 |
| 2022 | 0 | 1 | 0 | 0 | 0 | 1 | 4 |
| 2021 | 0 | 2 | 0 | 0 | 0 | 2 | 3 |
| 2020 | 0 | 0 | 1 | 0 | 0 | 1 | 1 |
| Title | ||
|---|---|---|
| CVE-2026-59944 | Composer: CVE-2026-59946 fix bypass via symlinked package bin pathcomposer · composer | Medium6.1 |
| CVE-2026-84361 | Composer: Perforce source URL permits P4PORT `rsh:` command executioncomposer · composer | High7.7 |
| CVE-2026-45793 | Composer: Github Actions issued GITHUB_TOKEN disclosure in GitHub Actions logscomposer · composer | High7.5 |
| CVE-2026-59947 | Composer: URL-embedded HTTP-Basic username leaks to verbose logs (GitHub PAT exposure)composer · composer | Medium4.7 |
| CVE-2026-59948 | Composer: Arbitrary file write outside vendor via malicious transitive package namecomposer · composer | High7.0 |
| CVE-2026-59946 | Composer: Path traversal in package bin field lets dependencies chmod arbitrary host filescomposer · composer | Medium6.1 |
| CVE-2026-40261 | Composer has Command Injection via Malicious Perforce Referencecomposer · composer | High8.8 |
| CVE-2026-40176 | Composer is vulnerable to Command Injection via Malicious Perforce Repositorycomposer · composer | High7.8 |
| CVE-2025-67746 | Composer vulnerable to ANSI sequence injectioncomposer · composer | Low1.3 |
| CVE-2024-35242 | Composer vulnerable to command injection via malicious git/hg branch namescomposer · composer | High8.8 |
| CVE-2024-35241 | Composer vulnerable to command injection via malicious git branch namecomposer · composer | High8.8 |
| CVE-2024-24821 | Code execution and possible privilege escalation via compromised InstalledVersions.php or installed.php in Composercomposer · composer | High8.8 |
| CVE-2023-43655 | Remote Code Execution via web-accessible composer.pharcomposer · composer | Medium6.4 |
| CVE-2022-24828 | Missing input validation can lead to command execution in composercomposer · composer | High8.3 |
| CVE-2021-41116 | Command injection in composer on Windowscomposer · composer | High8.2 |
| CVE-2021-29472 | Missing argument delimiter can lead to code execution via VCS repository URLs or source download URLs on systems with Mercurial in composercomposer · composer | High8.8 |
| CVE-2020-15145 | Local privilege elevation in Composer-Setup for Windowscomposer · windows-setup | Medium6.7 |