Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 5 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 400,313All CVEsplus 18,889 rejected
- 585Last 24 hours2,951 in the last 7 days
- 17,316Last 30 days1,581 of them critical
- 1,767Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 1 | 16 | 24 | 0 | 0 | 41 | 108 |
| 2025 | 0 | 2 | 8 | 1 | 0 | 11 | 67 |
| 2024 | 0 | 11 | 13 | 0 | 0 | 24 | 56 |
| 2023 | 0 | 5 | 6 | 0 | 0 | 11 | 32 |
| 2022 | 1 | 8 | 4 | 0 | 0 | 13 | 21 |
| 2021 | 0 | 6 | 1 | 0 | 0 | 7 | 8 |
| 2020 | 0 | 0 | 1 | 0 | 0 | 1 | 1 |
| Title | ||
|---|---|---|
| CVE-2026-73511 | Envoy: Potential path-matching/authentication bypass when using Envoy in combination with a backend stripping per-segment path (matrix) parameters (e.g. Apache Tomcat)envoyproxy · envoy | Medium5.3 |
| CVE-2026-73553 | Envoy: RBAC Authorization Bypass via Path Parametersenvoyproxy · envoy | High7.5 |
| CVE-2026-73551 | Envoy: Path normalization does not handle dot and dotdot segments with parametersenvoyproxy · envoy | Medium5.3 |
| CVE-2026-73546 | Envoy: Stored XSS in Admin Stats Interface (/stats?format=html)envoyproxy · envoy | High7.4 |
| CVE-2026-73512 | Envoy: use-after-free in QUIC on internal redirectsenvoyproxy · envoy | High7.5 |
| CVE-2026-73550 | Envoy: HTTP/2 Discarded Host Header 200 GB Header-Copy OOM in Envoyenvoyproxy · envoy | High7.5 |
| CVE-2026-73547 | Envoy ext_authz: request `:path` pseudoheader dereferenced w/o null checkenvoyproxy · envoy | High7.5 |
| CVE-2026-48521 | Envoy: HTTP/3 connection pool selection null-derefs in ProdClusterManagerFactory::allocateConnPool when transport_socket_options is nullenvoyproxy · envoy | Medium5.9 |
| CVE-2026-73549 | Envoy - Incomplete fix for CVE-2026-26310: copyInternetAddressAndPort crashes on scoped IPv6 addresses in ORIGINAL_DST clustersenvoyproxy · envoy | Medium5.3 |
| CVE-2026-73513 | Envoy: oghttp2 upstream trailers incorrect handlingenvoyproxy · envoy | High7.5 |
| CVE-2026-73552 | Envoy: HTTP RBAC safe_regex can fail open on RFC-valid obs-text header valuesenvoyproxy · envoy | High7.5 |
| CVE-2026-73548 | Envoy: Cross-user response poisoning via a generic (non-WebSocket) HTTP upgrade on Envoy's shared backend poolenvoyproxy · envoy | High7.5 |
| CVE-2026-50572 | Envoy: ext_authz - RawHttpClientImpl onSuccess 0x0 segfaultenvoyproxy · envoy | Medium5.9 |
| CVE-2026-53714 | Envoy Gateway: xDS Control Plane Information Disclosure when Envoy Gateway operates in GatewayNamespaceModeenvoyproxy · gateway | High7.4 |
| CVE-2026-53716 | Envoy Gateway: Wasm HTTP fetch decompresses gzip without output-size limitenvoyproxy · gateway | Medium6.5 |
| CVE-2026-53715 | Envoy Gateway: Wasm cache ServeHTTP reads mappingPath2Cache without lockenvoyproxy · gateway | Medium5.3 |
| CVE-2026-53719 | Envoy Gateway: Nil-dereference when SecurityPolicy targets TCPRoute without spec.authorizationenvoyproxy · gateway | Medium6.5 |
| CVE-2026-53718 | Envoy Gateway custom backendRef cross-namespace ReferenceGrant bypassenvoyproxy · gateway | Medium6.4 |
| CVE-2026-53713 | Envoy Gateway: Authentication Bypass via Improper Input Validation in EnvoyExtensionPolicy Lua Allows Secret Disclosureenvoyproxy · gateway | Critical9.1 |
| CVE-2026-53717 | Envoy Gateway: OCI layer extraction allocates make([]byte, h.Size) from untrusted tar headerenvoyproxy · gateway | Medium6.5 |
| CVE-2026-48090 | Envoy HTTP: OAuth2 filter late async token completion after stream teardown (UAF / crash risk)envoyproxy · envoy | Medium5.9 |
| CVE-2026-47220 | Envoy: Segmentation fault when using %REQUESTED_SERVER_NAME% in log formatenvoyproxy · envoy | High7.5 |
| CVE-2026-47205 | Envoy: ext_authz Use-After-Free during Stream Teardown with Per-Route Overridesenvoyproxy · envoy | Medium5.9 |
| CVE-2026-47692 | Envoy: PROXY Protocol v2 header generator emits "skipped" TLVs, causing 65 KB attacker-controlled spillover into the upstream application streamenvoyproxy · envoy | Medium4.8 |
| CVE-2026-47207 | Envoy crashes if multiple unexpected ext_proc responses are packed into one gRPC messageenvoyproxy · envoy | Medium6.5 |
| CVE-2026-48706 | Envoy Heap Buffer Overflow in TcpStatsdSinkenvoyproxy · envoy | Medium5.9 |
| CVE-2026-47204 | Envoy: grpc_stats filter segfault on Connect protocol requests to direct_response routesenvoyproxy · envoy | Medium6.5 |
| CVE-2026-47221 | Envoy: Null pointer deref in internal redirectsenvoyproxy · envoy | Medium5.9 |
| CVE-2026-48743 | Envoy: HTTP/3 to HTTP/1 request smuggling via headers-only request with nonzero Content-Lengthenvoyproxy · envoy | High7.5 |
| CVE-2026-48497 | Envoy: Abnormal process termination in DNS UDP filterenvoyproxy · envoy | Medium5.9 |
| CVE-2026-48044 | Envoy Zstd Decompressor: Ratio Check at Wrong Loop Depth lead to memory explosionenvoyproxy · envoy | High7.5 |
| CVE-2026-48042 | Envoy: Stack overflow in destructor of highly nested JSONenvoyproxy · envoy | High7.5 |
| CVE-2026-47778 | Envoy: Embedded NUL in TLS DNS SAN Truncation in the Default TLS Certificate Validator. (Auth Bypass)envoyproxy · envoy | Medium4.4 |
| CVE-2026-47775 | Envoy OAuth2 Filter: Padding Oracle via AES-256-CBC Cookie Decryptionenvoyproxy · envoy | Medium6.8 |
| CVE-2026-47774 | Envoy vulnerable to HTTP/2 memory exhaustion via cookie header size bypass and HPACK amplificationenvoyproxy · envoy | High7.5 |
| CVE-2026-26330 | Envoy global rate limit may crash when the response phase limit is enabled and the response phase request is failed directlyenvoyproxy · envoy | Medium5.3 |
| CVE-2026-26311 | Envoy HTTP: filter chain execution on reset streams causing UAF crashenvoyproxy · envoy | Medium5.9 |
| CVE-2026-26310 | Crash for scoped ip address in Envoy during DNSenvoyproxy · envoy | Medium5.9 |
| CVE-2026-26309 | Envoy has an off-by-one write in JsonEscaper::escapeString()envoyproxy · envoy | Medium5.3 |
| CVE-2026-26308 | Envoy has an RBAC Header Validation Bypass via Multi-Value Header Concatenationenvoyproxy · envoy | High7.5 |
| CVE-2026-22771 | Envoy Extension Policy lua scripts injection causes arbitrary command executionenvoyproxy · gateway | High8.8 |
| CVE-2025-66220 | Envoy’s TLS certificate matcher for `match_typed_subject_alt_names` may incorrectly treat certificates containing an embedded null byteenvoyproxy · envoy | Medium5.0 |
| CVE-2025-64763 | Envoy forwards early CONNECT data in TCP proxy modeenvoyproxy · envoy | Low3.7 |
| CVE-2025-64527 | Envoy crashes when JWT authentication is configured with the remote JWKS fetchingenvoyproxy · envoy | Medium6.5 |
| CVE-2025-62504 | Envoy Lua filter use-after-free when oversized rewritten response body causes crashenvoyproxy · envoy | Medium6.5 |
| CVE-2025-62409 | Envoy allows large requests and responses to cause TCP connection pool crashenvoyproxy · envoy | Medium6.6 |
| CVE-2025-55162 | Envoy: oAuth2 Filter Signout route will not clear cookies because of missing "secure;" flagenvoyproxy · envoy | Medium6.3 |
| CVE-2025-54588 | Envoy: Race condition in Dynamic Forward Proxy leads to use-after-free and segmentation faultsenvoyproxy · envoy | High7.5 |
| CVE-2025-46821 | Envoy vulnerable to bypass of RBAC uri_template permissionenvoyproxy · envoy | Medium5.3 |
| CVE-2025-30157 | Envoy crashes when HTTP ext_proc processes local repliesenvoyproxy · envoy | Medium6.5 |