Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 6 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 400,903All CVEsplus 19,118 rejected
- 375Last 24 hours2,802 in the last 7 days
- 16,790Last 30 days1,548 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 1 | 14 | 25 | 9 | 0 | 49 | 69 |
| 2025 | 0 | 1 | 2 | 0 | 0 | 3 | 20 |
| 2024 | 0 | 1 | 0 | 0 | 0 | 1 | 17 |
| 2023 | 0 | 1 | 3 | 0 | 0 | 4 | 16 |
| 2022 | 0 | 1 | 1 | 2 | 0 | 4 | 12 |
| 2021 | 0 | 0 | 2 | 0 | 0 | 2 | 8 |
| 2020 | 0 | 3 | 3 | 0 | 0 | 6 | 6 |
| Title | ||
|---|---|---|
| CVE-2026-115570 | Electron: Mitigation for compromised eMudhra intermediate certificateselectron · electron | High7.4 |
| CVE-2026-114124 | Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometryelectron · electron | Low3.9 |
| CVE-2026-114122 | Electron: Frame subscription trusts GPU-supplied frame geometryelectron · electron | Low3.9 |
| CVE-2026-114121 | Electron: openExternal permission requests can be attributed to the wrong originelectron · electron | Medium5.4 |
| CVE-2026-113800 | Electron: HID and USB permission checks can be attributed to the wrong originelectron · electron | Medium5.4 |
| CVE-2026-113798 | Electron: Pointer lock permission requests can be attributed to the wrong frameelectron · electron | Medium5.4 |
| CVE-2026-113797 | Electron: Extension tabs.query returns tab URLs and titles without the tabs permissionelectron · electron | Low3.1 |
| CVE-2026-113796 | Electron: SameSite cookie restrictions are not applied to windows opened from linkselectron · electron | Medium4.2 |
| CVE-2026-102672 | Electron: Local race condition in Squirrel.Mac update installation on macOSelectron · electron | Medium6.7 |
| CVE-2026-102677 | Electron: Sandboxed preload code cache can be poisoned by a compromised rendererelectron · electron | High7.8 |
| CVE-2026-102676 | Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictionselectron · electron | High8.3 |
| CVE-2026-102675 | Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabledelectron · electron | High7.4 |
| CVE-2026-102674 | Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictionselectron · electron | High8.2 |
| CVE-2026-102673 | Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTabelectron · electron | High8.2 |
| CVE-2026-70612 | Electron: Sandboxed iframes can launch external protocol handlerselectron · electron | Medium5.4 |
| CVE-2026-70611 | Electron: DevTools embedder handler executes arbitrary files via shell openelectron · electron | Medium6.9 |
| CVE-2026-70610 | Electron: contextBridge object copy honors prototype setterselectron · electron | Medium5.4 |
| CVE-2026-70609 | Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameterelectron · electron | Medium5.7 |
| CVE-2026-70608 | Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation pathelectron · electron | High7.2 |
| CVE-2026-70607 | Electron: window.open features string controls some window options considered privilegedelectron · electron | Medium5.3 |
| CVE-2026-70606 | Electron: ProtocolResponse.url reuses the default session cache instead of the registering sessionelectron · electron | Medium5.9 |
| CVE-2026-70605 | Electron: HTTP redirect followed into local file loaderelectron · electron | Medium5.9 |
| CVE-2026-70604 | Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin readselectron · electron | High7.4 |
| CVE-2026-70603 | Electron: shell.openPath path validation bypass via embedded null byteelectron · electron | Medium6.0 |
| CVE-2026-70602 | Electron: Extension tab APIs operate across session boundarieselectron · electron | Medium6.6 |
| CVE-2026-70601 | Electron: Context isolation bypass via Function.prototype.bind hijackelectron · electron | High7.5 |
| CVE-2026-70600 | Electron: Cross-origin iframe can position native autofill popupelectron · electron | Low3.1 |
| CVE-2026-70599 | Electron: Permission Check Handler Receives Main Frame Origin Instead of Requesting Iframe Originelectron · electron | Medium5.9 |
| CVE-2026-70598 | Electron: Off-screen rendering trusts GPU-supplied geometry over shared-memory sizeelectron · electron | Low3.9 |
| CVE-2026-70597 | Electron: Parent process code-sign check is spoofableelectron · electron | Medium6.3 |
| CVE-2026-54257 | Electron: Buffer performs incorrect byte length calculations resulting in heap buffer under/overflowelectron · electron | Critical9.3 |
| CVE-2026-34781 | Electron crashes in clipboard.readImage() on malformed clipboard image dataelectron · electron | Low2.8 |
| CVE-2026-34765 | Electron named window.open targets not scoped to the opener's browsing contextelectron · electron | Medium6.0 |
| CVE-2026-34764 | Electron has a use-after-free in offscreen shared texture release() callbackelectron · electron | Low2.3 |
| CVE-2026-34780 | Electron: Context Isolation bypass via contextBridge VideoFrame transferelectron · electron | High8.4 |
| CVE-2026-34779 | Electron: AppleScript injection in app.moveToApplicationsFolder on macOSelectron · electron | Medium6.5 |
| CVE-2026-34778 | Electron: Service worker can spoof executeJavaScript IPC replieselectron · electron | Medium5.9 |
| CVE-2026-34777 | Electron: Incorrect origin passed to permission request handler for iframe requestselectron · electron | Medium5.4 |
| CVE-2026-34776 | Electron: Out-of-bounds read in second-instance IPC on macOS and Linuxelectron · electron | Medium5.3 |
| CVE-2026-34775 | Electron: nodeIntegrationInWorker not correctly scoped in shared renderer processeselectron · electron | Medium6.8 |
| CVE-2026-34774 | Electron: Use-after-free in offscreen child window paint callbackelectron · electron | High8.1 |
| CVE-2026-34773 | Electron: Registry key path injection in app.setAsDefaultProtocolClient on Windowselectron · electron | Medium4.7 |
| CVE-2026-34772 | Electron: Use-after-free in download save dialog callbackelectron · electron | Medium5.8 |
| CVE-2026-34771 | Electron: Use-after-free in WebContents fullscreen, pointer-lock, and keyboard-lock permission callbackselectron · electron | High7.5 |
| CVE-2026-34770 | Electron: Use-after-free in PowerMonitor on Windows and macOSelectron · electron | High7.0 |
| CVE-2026-34768 | Electron: Unquoted executable path in app.setLoginItemSettings on Windowselectron · electron | Low3.9 |
| CVE-2026-34767 | Electron: HTTP Response Header Injection in custom protocol handlers and webRequestelectron · electron | Medium5.9 |
| CVE-2026-34766 | Electron: USB device selection not validated against filtered device listelectron · electron | Low3.3 |
| CVE-2026-34769 | Electron: Renderer command-line switch injection via undocumented commandLineSwitches webPreferenceelectron · electron | High7.8 |
| CVE-2025-55305 | Electron is vulnerable to Code Injection via resource modificationelectron · electron | Medium6.1 |