Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 3 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 400,903All CVEsplus 19,118 rejected
- 373Last 24 hours2,796 in the last 7 days
- 16,784Last 30 days1,547 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 0 | 10 | 8 | 1 | 0 | 19 | 22 |
| 2025 | 0 | 1 | 0 | 0 | 0 | 1 | 3 |
| 2024 | 0 | 0 | 0 | 0 | 0 | 0 | 2 |
| 2023 | 0 | 0 | 0 | 0 | 0 | 0 | 2 |
| 2022 | 0 | 0 | 0 | 0 | 0 | 0 | 2 |
| 2021 | 0 | 1 | 0 | 0 | 0 | 1 | 2 |
| 2020 | 0 | 1 | 0 | 0 | 0 | 1 | 1 |
| Title | ||
|---|---|---|
| CVE-2026-104074 | Coturn 4.10.0 Uninitialized Stack Memory Disclosure via ERROR-CODEcoturn · coturn | Medium6.9 |
| CVE-2026-68555 | coturn: Chained mobility resumes allow authenticated remote memory exhaustioncoturn · coturn | Medium6.5 |
| CVE-2026-68552 | Coturn: uint16_t truncation overflow in STUN message length causes TCP stream framing bypasscoturn · coturn | Medium5.3 |
| CVE-2026-68554 | Coturn: STUN attributes after MESSAGE-INTEGRITY are processed, letting on-path attackers modify authenticated TURN requestscoturn · coturn | Low2.3 |
| CVE-2026-68553 | Coturn: Format String Injection via TURN USERNAME/REALM into hiredis Redis Commandcoturn · coturn | High7.1 |
| CVE-2026-73216 | coturn: mobility disconnects bypass allocation quotas and exhaust relay capacitycoturn · coturn | Medium6.5 |
| CVE-2026-73215 | The coturn server can end in a state where it does not accept more requests with "even-port" enabled.coturn · coturn | High7.1 |
| CVE-2026-73214 | coturn allocates a full per-peer SSL/session before verifying the DTLS cookie, enabling source-spoofing/botnet state-exhaustion DoScoturn · coturn | High8.2 |
| CVE-2026-73213 | Coturn: `addr_less_eq()` does a component-wise IPv6 comparison instead of a lexicographic one, letting an authenticated TURN client bypass `denied-peer-ip`/`allowed-peer-ip` IPv6 ranges (TURN-specific SSRF)coturn · coturn | Medium5.8 |
| CVE-2026-73212 | coturn peer-IP ACL canonicalization & scope bypass on the RFC 6062 TCP CONNECT relay path → internal-network SSRF and proven internal root RCEcoturn · coturn | Medium5.8 |
| CVE-2026-65981 | Coturn: MOBILITY-TICKET session-resume authorization bypass allows cross-user TURN allocation takeovercoturn · coturn | High7.1 |
| CVE-2026-62959 | Coturn: Pre-authentication heap memory disclosure in ACME redirect (`try_acme_redirect`)coturn · coturn | High8.2 |
| CVE-2026-53450 | Coturn: IPv4-mapped 127.0.0.1 bypasses default loopback peer protectioncoturn · coturn | High7.4 |
| CVE-2026-53449 | Coturn: Arbitrary File Write via CLI psd Commandcoturn · coturn | Medium6.0 |
| CVE-2026-53448 | Coturn: SQL Injection in HTTPS Admin Panel Delete Operationscoturn · coturn | High7.2 |
| CVE-2026-43994 | Coturn: Stack buffer overflow in decode_oauth_token_gcm()coturn · coturn | High8.1 |
| CVE-2026-43915 | Coturn: Stored Cross-Site Scripting (XSS) in web-admin interface via TURN usernamecoturn · coturn | Medium5.4 |
| CVE-2026-40613 | Coturn: Misaligned Memory Access in coturn STUN Attribute Parser (Remote DoS on ARM64)coturn · coturn | High7.5 |
| CVE-2026-27624 | Coturn: IPv4-mapped IPv6 (::ffff:0:0/96) bypasses denied-peer-ip ACLcoturn · coturn | High7.2 |
| CVE-2025-69217 | Coturn has unsafe nonce and relay port randomization due to weak random number generation.coturn · coturn | High7.7 |
| CVE-2020-26262 | Loopback bypass in Coturncoturn · coturn | High7.2 |
| CVE-2020-4067 | Improper Initialization in coturncoturn · coturn | High7.0 |