Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 3 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,293All CVEsplus 19,140 rejected
- 449Last 24 hours2,722 in the last 7 days
- 16,914Last 30 days1,557 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 5 | 39 | 15 | 0 | 0 | 59 | 108 |
| 2025 | 1 | 22 | 3 | 0 | 0 | 26 | 49 |
| 2024 | 5 | 4 | 1 | 0 | 0 | 10 | 23 |
| 2023 | 2 | 6 | 4 | 0 | 0 | 12 | 13 |
| 2022 | 1 | 0 | 0 | 0 | 0 | 1 | 1 |
| Title | ||
|---|---|---|
| CVE-2026-121453 | SQLBot through 1.10.3 Path Traversal via datasource importToDb Endpointdataease · SQLBot | Medium5.1 |
| CVE-2026-102755 | DataEase Datasource/Dataset Folder Name Stored Cross-Site Scriptingdataease · dataease | Medium5.1 |
| CVE-2026-102756 | DataEase bar-horizontal Axis Label Tooltip Stored Cross-Site Scriptingdataease · dataease | Medium5.1 |
| CVE-2026-104143 | DataEase: Stored SQL Injection via dateFormat field templatesdataease · dataease | High8.7 |
| CVE-2026-104142 | DataEase: Stored SQL Injection in group-field binning boundsdataease · dataease | High8.7 |
| CVE-2026-104141 | DataEase: SQL Injection in datasource metadata identifiersdataease · dataease | High8.7 |
| CVE-2026-93660 | SQLBot through 1.10.1 Improper Access Control via Dashboard Updatedataease · SQLBot | High7.1 |
| CVE-2026-53557 | SQLBot: Second-Order SQL Injection via Excel Datasource Leading to Remote Command Executiondataease · SQLBot | High7.7 |
| CVE-2026-53555 | Stored XSS via SVG Uploaddataease · SQLBot | Medium5.1 |
| CVE-2026-53556 | SQLBot: Authenticated SQL Injection in previewData Resulting in Arbitrary File Readdataease · SQLBot | Medium6.0 |
| CVE-2026-53554 | SQLBot: Arbitrary File Write via parseExcel Leading to Code Execution Through Alembic Import Processingdataease · SQLBot | High7.3 |
| CVE-2023-40772 | A directory Traversal vulnerability in DataEase before 1.18.10 allows a remote attacker to obtain sensitive information via a a crafted request to the…DataEase · DataEase | Medium4.3 |
| CVE-2026-82879 | DataEase before 2.10.26 Access Control Bypass via Share Ticketsdataease · dataease | Medium5.3 |
| CVE-2026-82878 | DataEase before 2.10.26 Missing Object-Level Authorization on Geographic, Linkage and Chart Endpointsdataease · dataease | Medium5.3 |
| CVE-2026-45532 | DataEase has a Path Traversal Vulnerabilitydataease · dataease | High8.7 |
| CVE-2026-72743 | SQLBot 1.10.0 SQText Dashboard Component Stored XSS via v-htmldataease · SQLBot | Medium5.1 |
| CVE-2026-49867 | DataEase: Authenticated Stored XSS in DataEase Template Static Resourcesdataease · dataease | Medium6.3 |
| CVE-2026-46684 | DataEase: Unauthorized Command Execution Vulnerabilitydataease · dataease | Critical9.5 |
| CVE-2026-45320 | DataEase Data Dashboard SqlVariable transFilter Unfiltered SQL Injectiondataease · dataease | High8.7 |
| CVE-2026-45535 | DataEase: Stored SQL Injection Vulnerabilitydataease · dataease | High8.7 |
| CVE-2026-45533 | DataEase: Path Traversal Vulnerabilitydataease · dataease | High8.3 |
| CVE-2026-50124 | DataEase: Remote Code Execution (RCE) via Zip Protocol & File Dropperdataease · dataease | High7.1 |
| CVE-2026-50030 | DataEase: Arbitrary SQL execution in preview path (direct data disclosure)dataease · dataease | High7.1 |
| CVE-2026-45419 | DataEase: Arbitrary File Write Vulnerabilitydataease · dataease | High8.5 |
| CVE-2026-45417 | DataEase: SQL injection vulnerabilitydataease · dataease | High8.7 |
| CVE-2026-45534 | DataEase: RCE Vulnerabilitydataease · dataease | Critical9.0 |
| CVE-2026-50530 | DataEase: Token with Overly Broad Privileges in Share Mode: Access to Unshared Datasetsdataease · dataease | High7.1 |
| CVE-2026-50529 | DataEase: Link Token Leakage Prior to Share Password/Ticket Validationdataease · dataease | High8.7 |
| CVE-2026-55647 | DataEase: authenticated stored XSS in the dashboard text componentsdataease · dataease | Medium5.1 |
| CVE-2026-55635 | DataEase: Authenticated SQL Injection in Chart Quota Filtersdataease · dataease | High8.7 |
| CVE-2026-57172 | DataEase: Hardcoded JWT Signing Secret in ShareLinkdataease · dataease | High8.3 |
| CVE-2026-53751 | DataEase: H2 JDBC URL Filter Bypass Leads to Remote Code Execution (RCE)dataease · dataease | High8.7 |
| CVE-2026-53730 | DataEase: Unauthorized Access to Engine Database via previewSql Endpointdataease · dataease | High8.7 |
| CVE-2026-55633 | DataEase H2 RCE via Zip Protocol & File Dropper Fix bypassdataease · dataease | High8.7 |
| CVE-2026-55631 | DataEase: Path Traversal Leading to Arbitrary File Deletion via Font Managementdataease · dataease | High7.2 |
| CVE-2026-53729 | DataEase ExportCenter IDOR allows cross-user export task accessdataease · dataease | High8.7 |
| CVE-2026-42463 | SQLBot: Unauthorized Access Vulnerabilitydataease · SQLBot | High8.6 |
| CVE-2026-33324 | SQLBot prompt injection allows arbitrary SQL execution and remote code executiondataease · SQLBot | Critical9.4 |
| CVE-2026-40901 | DataEase: Quartz Deserialization → Remote Code Executiondataease · dataease | High7.5 |
| CVE-2026-40900 | DataEase has SQL Injection via Stacked Queriesdataease · dataease | High8.7 |
| CVE-2026-40899 | DataEase has an Arbitrary File Read Vulnerabilitydataease · dataease | High8.3 |
| CVE-2026-33207 | DataEase SQL Injection Vulnerabilitydataease · dataease | High8.6 |
| CVE-2026-33122 | DataEase has SQL Injection via Datasource Managementdataease · dataease | High8.6 |
| CVE-2026-33121 | DataEase has SQL Injection via Datasource Save Flowdataease · dataease | High8.7 |
| CVE-2026-33084 | DataEase has SQL Injection through its getFieldEnumObj Endpointdataease · dataease | High8.7 |
| CVE-2026-33083 | DataEase has SQL Injection in Order By Clausedataease · dataease | High8.7 |
| CVE-2026-33082 | DataEase: SQL Injection in v2 Dataset Exportdataease · dataease | High8.7 |
| CVE-2026-5417 | Dataease SQLbot Elasticsearch es_engine.py get_es_data_by_http server-side request forgeryDataease · SQLbot | Medium5.1 |
| CVE-2026-32950 | SQLBot: RCE via SQL Injection in Excel Upload Endpointdataease · SQLBot | High8.6 |
| CVE-2026-32949 | SQLBot: SSRF to Arbitrary File Read (AFR) via Rogue MySQLdataease · SQLBot | High8.7 |