Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 9 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 400,976All CVEsplus 19,118 rejected
- 408Last 24 hours2,835 in the last 7 days
- 16,798Last 30 days1,543 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 0 | 15 | 11 | 1 | 0 | 27 | 27 |
| Title | ||
|---|---|---|
| CVE-2026-77353 | Wallos: iCalendar Injection via CRLF in Subscription Name/Notes Exportellite · Wallos | Medium4.6 |
| CVE-2026-77352 | Wallos: Authenticated SSRF via per-user SMTP notification host (low-privilege user)ellite · Wallos | Medium4.3 |
| CVE-2026-77348 | Wallos incomplete fix for CVE-2026-33407: unauthenticated httpoxy SSRF still reachable via `endpoints/payments/search.php`ellite · Wallos | High8.2 |
| CVE-2026-77351 | Wallos: SSRF via Unvalidated User-Level SMTP Host in Email Notification Settingsellite · Wallos | Low3.5 |
| CVE-2026-61641 | Wallos: OIDC account takeover via email-based account linking without `email_verified` checkellite · Wallos | High8.1 |
| CVE-2026-61640 | Wallos: SSRF via OIDC Token/UserInfo URL Configurationellite · Wallos | High8.5 |
| CVE-2026-61639 | Wallos: Zip Slip path traversal in database restore writes files to webrootellite · Wallos | High8.5 |
| CVE-2026-61638 | Wallos: SSRF via Test Email Notification - unvalidated SMTP host/portellite · Wallos | High8.2 |
| CVE-2026-54600 | Wallos: Unauthenticated database replacement via import endpoint on fresh installellite · Wallos | High8.2 |
| CVE-2026-54599 | Wallos: OIDC state parameter never validated — login CSRF / account takeoverellite · Wallos | High7.5 |
| CVE-2026-54598 | Missing Authentication for Critical Function in wallosellite · Wallos | High7.5 |
| CVE-2026-50199 | Wallos: Cross-user Fixer/API Layer credential consumption in exchange-rate refreshellite · Wallos | Medium4.3 |
| CVE-2026-50198 | Wallos: Cross-user subscription cost inference via replacement_subscription_idellite · Wallos | Medium4.3 |
| CVE-2026-41689 | Wallos: Shared local webhook allowlist lets low-privilege users send arbitrary requests to allowlisted internal servicesellite · Wallos | Medium6.0 |
| CVE-2026-41688 | Incomplete fix for CVE-2026-33399: SSRF in Wallosellite · Wallos | High7.7 |
| CVE-2026-41687 | Wallos: SSRF CGNAT Bypass in subscription/payments Logo URL — is_cgnat_ip() Not Used in Inline Checksellite · Wallos | Medium4.3 |
| CVE-2026-33417 | Wallos: Password Reset Tokens Never Expireellite · Wallos | Medium6.5 |
| CVE-2026-33401 | Wallos: Incomplete fix for CVE-2026-30840 - SSRF in AI and notification endpoints bypass ssrf_helper.phpellite · Wallos | High7.1 |
| CVE-2026-33400 | Wallos: Stored cross-site scripting (XSS) vulnerability in the payment method rename endpointellite · Wallos | Medium5.4 |
| CVE-2026-33399 | Wallos: SSRF Bypass - Incomplete Fix for CVE-2026-30839/30840ellite · Wallos | High7.7 |
| CVE-2026-33407 | Wallos: SSRF via HTTP Proxy Environment Variableellite · Wallos | High8.3 |
| CVE-2026-30842 | Wallos: Authenticated Missing Authorization Allows Deletion of Other Users’ Uploaded Avatarsellite · Wallos | Medium4.3 |
| CVE-2026-30841 | Wallos: Reflected XSS via unescaped token and email parameters in passwordreset.phpellite · Wallos | Medium6.9 |
| CVE-2026-30840 | Wallos: Server-Side Request Forgery (SSRF) in Notification Testersellite · Wallos | High8.8 |
| CVE-2026-30839 | Wallos: SSRF via webhook test endpointellite · Wallos | Medium5.3 |
| CVE-2026-30828 | Wallos: SSRF via url parameter leading to File Traversalellite · Wallos | High8.7 |
| CVE-2026-27479 | Wallos: SSRF via Redirect Bypass in Logo/Icon URL Fetchellite · Wallos | High7.7 |