Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 8 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,293All CVEsplus 19,140 rejected
- 448Last 24 hours2,721 in the last 7 days
- 16,913Last 30 days1,557 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 1 | 13 | 18 | 2 | 0 | 34 | 38 |
| 2025 | 0 | 3 | 1 | 0 | 0 | 4 | 4 |
| Title | ||
|---|---|---|
| CVE-2026-104109 | FileRise: Authenticated ZIP extraction follows a pre-existing symlink and deletes files outside the storage rooterror311 · FileRise | Medium6.8 |
| CVE-2026-104107 | FileRise: Authenticated path traversal escapes configured storage root through inherited ACLserror311 · FileRise | Medium6.5 |
| CVE-2026-104110 | FileRise: Unauthenticated disclosure of internal folder path, client email, and upload policy for FileRise Pro client portals via /api/pro/portals/get.phperror311 · FileRise | Medium5.3 |
| CVE-2026-104108 | FileRise OIDC login can bind an attacker identity to an existing local accounterror311 · FileRise | High8.1 |
| CVE-2026-103977 | FileRise: Session-scoped TOTP rate limiting permits repeated verification attemptserror311 · FileRise | High8.1 |
| CVE-2026-104105 | FileRise: TOTP codes are not single-use — valid 6-digit code can be replayed within its window (capture-replay)error311 · FileRise | Medium6.4 |
| CVE-2026-104106 | FileRise: 2FA disable and TOTP enrollment lack step-up re-authentication; enrollment activates before verificationerror311 · FileRise | Medium6.5 |
| CVE-2026-103988 | FileRise renameFolder omits destination-parent authorizationerror311 · FileRise | Medium5.4 |
| CVE-2026-69193 | FileRise: Rate Limiting Bypass via Username Rotation Enables Unlimited Password Sprayingerror311 · FileRise | Medium6.5 |
| CVE-2026-69191 | FileRise: Login Method Restriction Bypass via Direct API Accesserror311 · FileRise | Medium5.4 |
| CVE-2026-77427 | FileRise: Insecure default cryptographic key fallback in manual installserror311 · FileRise | Medium5.9 |
| CVE-2026-69194 | FileRise: Unsanitized footerHtml in Public Site Configerror311 · FileRise | Medium4.8 |
| CVE-2026-64856 | FileRise: Missing Authentication Guard on File Snippet Preview Endpointerror311 · FileRise | Low3.7 |
| CVE-2026-62664 | FileRise: Authenticated path traversal in createFolder allows arbitrary directory creation outside the upload rooterror311 · FileRise | Medium5.4 |
| CVE-2026-61844 | FileRise: Folder Metadata Filename Collisions Bypass "read_own" Isolationerror311 · FileRise | High7.1 |
| CVE-2026-61843 | FileRise: Unauthenticated File Overwrite Through Upload-Enabled Folder Shareserror311 · FileRise | High8.2 |
| CVE-2026-57493 | FileRise: Remember-me auto-login uses stale admin role from token instead of current roleerror311 · FileRise | Medium6.8 |
| CVE-2026-57492 | FileRise: Setup mode re-activates when users.txt becomes empty, allowing unauthenticated admin creationerror311 · FileRise | High7.4 |
| CVE-2026-57490 | FileRise: WebDAV authentication bypasses TOTP/MFA entirelyerror311 · FileRise | High8.1 |
| CVE-2026-57491 | FileRise: ZIP extraction writes blocked file extensions to disk, bypassing the upload blocklisterror311 · FileRise | Medium6.5 |
| CVE-2026-57489 | FileRise: AUTH_BYPASS reverse-proxy header trust without source IP validation enables full authentication bypasserror311 · FileRise | High8.1 |
| CVE-2026-55498 | FileRise Shared Folder Symlink Escapeerror311 · FileRise | Medium4.8 |
| CVE-2026-54459 | FileRise: Missing CSRF enforcement for file creation and share-link creationerror311 · FileRise | Medium4.3 |
| CVE-2026-92616 | FileRise < 3.28.0 Privilege Escalation via WebDAV Session Inheritanceerror311 · FileRise | High7.6 |
| CVE-2026-54414 | FileRise shared-folder upload path traversal allows arbitrary file write and admin takeovererror311 · FileRise | Critical9.3 |
| CVE-2026-44460 | FileRise: TOTP Bypass via Setup Endpoint Disclosing Existing Secreterror311 · FileRise | High7.4 |
| CVE-2026-33477 | FileRise has incorrect authorization in /api/file/snippet.php allows read_own users to read other users’ file contenterror311 · FileRise | Medium4.3 |
| CVE-2026-33330 | FileRise ONLYOFFICE integration allows read-only users to overwrite files via forged save callbackerror311 · FileRise | High7.1 |
| CVE-2026-33329 | FileRise: Path Traversal in `resumableIdentifier` Leading to Arbitrary File Write, Recursive Directory Deletion, and Limited Existence Oracleerror311 · FileRise | High8.1 |
| CVE-2026-33072 | FileRise: Default Encryption Key Enables Token Forgery and Config Decryptionerror311 · FileRise | High8.2 |
| CVE-2026-33071 | FileRise: WebDAV upload path bypasses filename validation enforced by regular uploadserror311 · FileRise | Medium4.3 |
| CVE-2026-33070 | FileRise has Unauthenticated Share Link Deletionerror311 · FileRise | Low3.7 |
| CVE-2026-25231 | FileRise affected by an Unauthenticated File Read Due to Insufficient Access Controlerror311 · FileRise | High7.5 |
| CVE-2026-25230 | FileRise affected by HTML Injection using color property in file tagserror311 · FileRise | Medium4.6 |
| CVE-2025-68116 | FileRise vulnerable to Cross-Site Scripting (XSS) in SVG File Handlingerror311 · FileRise | High8.9 |
| CVE-2025-66403 | FileRise Vulnerable to Stored XSS via SVG Uploaderror311 · FileRise | Medium4.6 |
| CVE-2025-62510 | FileRise insecure folder visibility via name-based mapping and incomplete ACL checkserror311 · FileRise | High8.1 |
| CVE-2025-62509 | FileRise improper ownership/permission validation allowed cross-tenant file operationserror311 · FileRise | High8.1 |