Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 7 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 400,558All CVEsplus 18,890 rejected
- 408Last 24 hours3,027 in the last 7 days
- 17,424Last 30 days1,597 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 1 | 7 | 2 | 1 | 0 | 11 | 20 |
| 2025 | 0 | 0 | 0 | 0 | 0 | 0 | 9 |
| 2024 | 1 | 1 | 0 | 0 | 0 | 2 | 9 |
| 2023 | 1 | 0 | 1 | 0 | 0 | 2 | 7 |
| 2022 | 0 | 2 | 0 | 0 | 0 | 2 | 5 |
| 2021 | 0 | 3 | 0 | 0 | 0 | 3 | 3 |
| Title | ||
|---|---|---|
| CVE-2026-55888 | XDG Desktop Portal: Arbitrary file access via SaveFiles "files" option path traversalflatpak · xdg-desktop-portal | High8.8 |
| CVE-2026-55889 | XDG Desktop Portal: Drag-and-drop and copy-paste theft via predictable FileTransfer keyflatpak · xdg-desktop-portal | High8.3 |
| CVE-2026-92162 | Flatpak vulnerable to path traversal via unvalidated "arch" parameter in DeployAppstreamflatpak · flatpak | High7.2 |
| CVE-2026-96808 | In Flatpak before 1.18.1, the revokefs writer, used by the flatpak-system-helper to receive repository data from unprivileged callers, validated file paths by…Flatpak · Flatpak | High7.4 |
| CVE-2026-96807 | In Flatpak before 1.18.1, a malicious sandboxed app can replace ~/.var/app/$appid/.ld.so with a symlink, causing regenerate_ld_cache to write files at an…Flatpak · Flatpak | Medium4.0 |
| CVE-2026-90616 | In Flatpak before 1.18.1, a malicious sandboxed app can obtain arbitrary read and write access to files on the host, which can be escalated to arbitrary code…Flatpak · Flatpak | High7.4 |
| CVE-2026-40354 | Flatpak xdg-desktop-portal before 1.20.4 and 1.21.x before 1.21.1 allows any Flatpak app to trash any file in the host context via a symlink attack on…Flatpak · xdg-desktop-portal | Low2.9 |
| CVE-2026-39977 | flatpak-builder has a path traversal leading to arbitrary file read on host when installing licence filesflatpak · flatpak-builder | High7.1 |
| CVE-2026-34079 | Flatpak affected by arbitrary file deletion on the host filesystemflatpak · flatpak | High8.7 |
| CVE-2026-34078 | Flatpak has a complete sandbox escape leading to host file access and code execution in the host contextflatpak · flatpak | Critical9.3 |
| CVE-2026-34080 | xdg-dbus-proxy has an eavesdrop filter bypass allowing message interceptionflatpak · xdg-dbus-proxy | Medium6.8 |
| CVE-2024-42472 | Flatpak may allow access to files outside sandbox for certain appsflatpak · flatpak | Critical10.0 |
| CVE-2024-32462 | Flatpak vulnerable to a sandbox escape via RequestBackground portal due to bad argument parsingflatpak · flatpak | High8.4 |
| CVE-2023-28101 | Flatpak metadata with ANSI control codes can cause misleading terminal outputflatpak · flatpak | Medium5.0 |
| CVE-2023-28100 | TIOCLINUX can send commands outside sandbox if running on a virtual consoleflatpak · flatpak | Critical10.0 |
| CVE-2022-21682 | flatpak-builder can access files outside the build directory.flatpak · flatpak | High7.7 |
| CVE-2021-43860 | Permissions granted to applications can be hidden from the user at install timeflatpak · flatpak | High8.2 |
| CVE-2021-41133 | Sandbox bypass via recent VFS-manipulating syscallsflatpak · flatpak | High8.8 |
| CVE-2021-21381 | Sandbox escape via special tokens in .desktop fileflatpak · flatpak | High7.1 |
| CVE-2021-21261 | Flatpak sandbox escape via spawn portalflatpak · flatpak | High7.3 |