Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 10 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,298All CVEsplus 19,140 rejected
- 452Last 24 hours2,722 in the last 7 days
- 16,914Last 30 days1,557 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 6 | 25 | 13 | 6 | 0 | 50 | 61 |
| 2025 | 0 | 7 | 3 | 1 | 0 | 11 | 11 |
| Title | ||
|---|---|---|
| CVE-2026-90930 | File Browser through 2.63.23 Path Traversal via Symlink Aliasfilebrowser · filebrowser | High7.6 |
| CVE-2026-90929 | File Browser 2.5.0 Directory Deletion via Upload Failure Cleanupfilebrowser · filebrowser | High7.2 |
| CVE-2026-90928 | File Browser through 2.63.23 Memory Exhaustion via subtitle endpointfilebrowser · filebrowser | High7.1 |
| CVE-2026-90927 | filebrowser through 2.63.23 Denial of Service via unbounded WebSocket messagefilebrowser · filebrowser | High7.1 |
| CVE-2026-82238 | filebrowser 2.24.0 Race Condition via TUS concurrent PATCH uploadsfilebrowser · filebrowser | Low2.3 |
| CVE-2026-82237 | filebrowser through 2.63.23 Stale Share Link via File Renamefilebrowser · filebrowser | Low2.3 |
| CVE-2026-82236 | File Browser 2.63.6 through 2.63.23 Share Link Exposure via File Deletionfilebrowser · filebrowser | Low2.3 |
| CVE-2026-82235 | filebrowser through 2.63.23 Denial of Service via named pipesfilebrowser · filebrowser | High8.2 |
| CVE-2026-62684 | File Browser: Share API exposes the password hash and bypass tokenfilebrowser · filebrowser | Low2.7 |
| CVE-2026-72838 | FileBrowser before 2.63.19 Disk Exhaustion via TUS Uploadfilebrowser · filebrowser | High7.1 |
| CVE-2026-72837 | File Browser before 2.63.20 Privilege Escalation via Proxy Authenticationfilebrowser · filebrowser | High8.7 |
| CVE-2026-72836 | FileBrowser before 2.63.19 Case Sensitivity Authentication Bypassfilebrowser · filebrowser | Critical9.2 |
| CVE-2026-72835 | filebrowser before v2.63.21 Access Rule Bypass via Path Canonicalizationfilebrowser · filebrowser | High7.6 |
| CVE-2026-72834 | filebrowser before 2.63.19 Permission Bypass via checksumfilebrowser · filebrowser | Medium5.3 |
| CVE-2026-72839 | filebrowser through 2.63.16 Privilege Escalation via Signupfilebrowser · filebrowser | Critical9.3 |
| CVE-2026-73613 | filebrowser before 2.63.19 Out-of-Scope File Deletion via Symlinkfilebrowser · filebrowser | High7.2 |
| CVE-2026-73612 | File Browser before v2.63.22 Authorization Bypass via Recursive Operationsfilebrowser · filebrowser | High8.6 |
| CVE-2026-73611 | File Browser 2.50.0 through 2.63.21 JWT Expiration Bypassfilebrowser · filebrowser | High7.6 |
| CVE-2026-62685 | File Browser: Colliding username normalization gives two users the same home directoryfilebrowser · filebrowser | High8.1 |
| CVE-2026-62843 | File Browser: Archive builder turns backslash filenames into path traversal (zip-slip)filebrowser · filebrowser | Medium6.8 |
| CVE-2026-62683 | File Browser: Trailing-slash delete leaves a stale public share behindfilebrowser · filebrowser | Low3.1 |
| CVE-2026-61874 | filebrowser before 2.63.17 Stale Public Share via Trailing-Slash Deletefilebrowser · filebrowser | Low2.3 |
| CVE-2026-55668 | File Browser: ScopedFs follows a dangling symlink on write, letting a scoped user create files outside their scopefilebrowser · filebrowser | Medium6.3 |
| CVE-2026-54090 | File Browser: Command Allowlist Bypass via Shell Metacharacter Injectionfilebrowser · filebrowser | High8.7 |
| CVE-2026-54088 | File Browser: Command Injection via Authentication Hook Shell Substitution (Pre-Authentication RCE)filebrowser · filebrowser | Critical9.3 |
| CVE-2026-54089 | File Browser: Authentication Bypass via Proxy Auth Header Forgeryfilebrowser · filebrowser | Critical9.1 |
| CVE-2026-54091 | File Browser: Incorrect access control in public directory shares via rule path rebasingfilebrowser · filebrowser | High7.5 |
| CVE-2026-54092 | File Browser: DoS Vulnerability on Public Login APIfilebrowser · filebrowser | Medium6.5 |
| CVE-2026-54097 | File Browser: Cross-user unauthorized share-link deletion via unbounded prefix match in DeleteWithPathPrefixfilebrowser · filebrowser | High7.2 |
| CVE-2026-54093 | File Browser: Path traversal in download-as-zip/tar via Windows-style backslash separators in stored filenamesfilebrowser · filebrowser | Medium6.8 |
| CVE-2026-54094 | File Browser: Symlink following lets scoped users read, overwrite, and share files outside their filebrowser scopefilebrowser · filebrowser | High7.5 |
| CVE-2026-54096 | File Browser: Improper Access Control Occurs via Pre-Created Public Share for a Non-existent Pathfilebrowser · filebrowser | High8.4 |
| CVE-2026-55667 | File Browser: Out-of-scope file deletion by a Create-only scoped user via symlink-following RemoveAll in upload failure-cleanupfilebrowser · filebrowser | High8.2 |
| CVE-2026-35607 | File Browser: Proxy auth auto-provisioned users inherit Execute permission and Commandsfilebrowser · filebrowser | High8.1 |
| CVE-2026-35606 | File Browser discloses text file content via /api/resources endpoint bypassing Perm.Download checkfilebrowser · filebrowser | Medium5.3 |
| CVE-2026-35605 | File Browser has an access rule bypass via HasPrefix without trailing separator in path matchingfilebrowser · filebrowser | Medium6.3 |
| CVE-2026-35604 | File Browser share links remain accessible after Share/Download permissions are revokedfilebrowser · filebrowser | High8.2 |
| CVE-2026-35585 | File Browser has a Command Injection via Hook Runnerfilebrowser · filebrowser | High7.5 |
| CVE-2026-34530 | File Browser is vulnerable to Stored Cross-Site Scripting via text/template branding injectionfilebrowser · filebrowser | Medium6.9 |
| CVE-2026-34528 | File Browser's Signup Grants Execution Permissions When Default Permissions Includes Executionfilebrowser · filebrowser | High8.1 |
| CVE-2026-34529 | File Browser is vulnerable to Stored Cross-site Scripting via crafted EPUB filefilebrowser · filebrowser | High7.6 |
| CVE-2026-32761 | File Browser has an Authorization Policy Bypass in its Public Share Download Flowfilebrowser · filebrowser | Medium6.5 |
| CVE-2026-32760 | File Browser Self Registration Grants Any User Admin Access When Default Permissions Include Adminfilebrowser · filebrowser | Critical10.0 |
| CVE-2026-32759 | File Browser TUS Negative Upload-Length Fires Post-Upload Hooks Prematurelyfilebrowser · filebrowser | Medium5.3 |
| CVE-2026-32758 | File Browser has an Access Rule Bypass via Path Traversal in Copy/Rename Destination Parameterfilebrowser · filebrowser | Medium6.5 |
| CVE-2026-28492 | File Browser: Path Traversal in Public Share Links Exposes Files Outside Shared Directoryfilebrowser · filebrowser | High7.1 |
| CVE-2026-29188 | File Browser: TUS Delete Endpoint Bypasses Delete Permission Checkfilebrowser · filebrowser | Critical9.1 |
| CVE-2026-25890 | File Browser has a Path-Based Access Control Bypass via Multiple Leading Slashes in URLfilebrowser · filebrowser | High8.1 |
| CVE-2026-25889 | File Browser has an Authentication Bypass in User Password Updatefilebrowser · filebrowser | Medium5.4 |
| CVE-2026-23849 | File Browser vulnerable to Username Enumeration via Timing Attack in /api/loginfilebrowser · filebrowser | Medium5.3 |