Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 7 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,074All CVEsplus 19,119 rejected
- 507Last 24 hours2,869 in the last 7 days
- 16,887Last 30 days1,546 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 2 | 9 | 20 | 5 | 0 | 36 | 41 |
| 2025 | 1 | 0 | 0 | 0 | 0 | 1 | 5 |
| 2024 | 0 | 0 | 0 | 0 | 0 | 0 | 4 |
| 2023 | 0 | 0 | 0 | 0 | 0 | 0 | 4 |
| 2022 | 0 | 0 | 2 | 0 | 0 | 2 | 4 |
| 2021 | 0 | 0 | 0 | 1 | 0 | 1 | 2 |
| 2020 | 1 | 0 | 0 | 0 | 0 | 1 | 1 |
| Title | ||
|---|---|---|
| CVE-2026-111924 | Fleet before 4.83.0 Denial of Service via Unbounded Gzip Decompressionfleetdm · fleet | High8.7 |
| CVE-2026-111923 | Fleet before 4.89.0 Unauthenticated DoS via Apple MDM Enrollment Plist Parsingfleetdm · fleet | High8.7 |
| CVE-2026-103265 | Fleet before 4.89.0 Information Disclosure via MDM Command Resultsfleetdm · fleet | Medium5.3 |
| CVE-2026-103264 | Fleet before 4.87.0 Authentication Bypass via Device Identifiersfleetdm · fleet | Critical9.3 |
| CVE-2026-101047 | Fleet before 4.87.0 Unauthenticated iOS App Download via Predictable URLsfleetdm · fleet | Medium6.9 |
| CVE-2026-101046 | Fleet before 4.89.0 SQL Injection via ORDER BY Activity Endpointsfleetdm · fleet | Low2.3 |
| CVE-2026-101045 | Fleet Homebrew Cask OS Command Injection via Metadatafleetdm · fleet | High8.9 |
| CVE-2026-54245 | Fleet: SQL injection in Okta conditional access endpoint allows host-controlled compromise of the Fleet databasefleetdm · fleet | High7.6 |
| CVE-2026-46371 | Fleet: Observer-level enrollment secret extraction via ORDER BY oracle on Apple MDM commands endpointfleetdm · fleet | Medium6.5 |
| CVE-2026-46370 | Fleet has observer-level enrollment secret extraction via ORDER BY oracle on labels host-listing endpointfleetdm · fleet | Medium6.5 |
| CVE-2026-41262 | Fleet: Cross-Team Policy Data Exposure via Global Policy Read Endpointfleetdm · fleet | Medium4.3 |
| CVE-2026-48786 | Fleet: Observer-class users can view team enroll secrets and credential-bearing configuration via target search endpointfleetdm · fleet | Medium6.5 |
| CVE-2026-46356 | Fleet: IP spoofing allows bypassing API rate limitingfleetdm · fleet | Medium6.9 |
| CVE-2026-26191 | Fleet vulnerable to OS command injection in software packagesfleetdm · fleet | Medium6.0 |
| CVE-2026-26062 | Fleet server may terminate unexpectedly when handling certain gRPC requestsfleetdm · fleet | High8.7 |
| CVE-2026-24899 | Fleet Windows MDM Azure AD JWT Authentication Bypassfleetdm · fleet | High8.2 |
| CVE-2026-24000 | Fleet has a rate limiting bypass via untrusted client IP headersfleetdm · fleet | Medium6.9 |
| CVE-2026-23998 | Fleet has a Windows MDM management endpoint authentication bypassfleetdm · fleet | High8.2 |
| CVE-2026-27806 | Fleet Affected by Local Privilege Escalation via Tcl Command Injection in Orbitfleetdm · fleet | High7.8 |
| CVE-2026-34391 | Fleet Vulnerable to Windows MDM cross-device command disclosurefleetdm · fleet | Medium6.6 |
| CVE-2026-34389 | Fleet's user account creation via invite does not enforce invited email addressfleetdm · fleet | Medium4.9 |
| CVE-2026-34388 | Fleet vulnerable to Denial of Service via unhandled gRPC log type in launcher endpointfleetdm · fleet | Medium6.6 |
| CVE-2026-34387 | Fleet vulnerable to OS command injection via crafted software package metadata in uninstall scriptsfleetdm · fleet | Medium5.7 |
| CVE-2026-34386 | Fleet vulnerable to SQL injection in MDM bootstrap package by authenticated team or global adminfleetdm · fleet | Medium6.3 |
| CVE-2026-34385 | Fleet's Apple MDM profile delivery has second-order SQL injection that can compromise the databasefleetdm · fleet | Medium6.2 |
| CVE-2026-29180 | Fleet's team maintainer can transfer hosts from any team via missing source team authorizationfleetdm · fleet | Medium4.9 |
| CVE-2026-26061 | Fleet's unbounded request body read allows remote Denial of Servicefleetdm · fleet | High8.7 |
| CVE-2026-26060 | Fleet: Password reset tokens remain valid after password change for 24 hoursfleetdm · fleet | Medium6.0 |
| CVE-2026-27465 | Fleet: Sensitive Google Calendar credentials disclosed to low-privileged usersfleetdm · fleet | Low1.3 |
| CVE-2026-25963 | Fleet: Authorization Bypass in certificate template batch deletion for team administratorsfleetdm · fleet | Low1.2 |
| CVE-2026-23999 | Fleet: Device lock PIN can be predicted if lock time is knownfleetdm · fleet | Low0.6 |
| CVE-2026-24004 | Fleet: Unauthenticated Android device disenrollment vulnerability via Pub/Sub endpointfleetdm · fleet | Low1.7 |
| CVE-2026-26186 | Fleet has a SQL injection via backtick escape in ORDER BY parameterfleetdm · fleet | Medium5.1 |
| CVE-2026-23518 | Fleet has a JWT signature bypass vulnerability in Azure AD MDM enrollmentfleetdm · fleet | Critical9.3 |
| CVE-2026-23517 | Fleet has an Access Control vulnerability in debug/pprof endpointsfleetdm · fleet | Medium6.3 |
| CVE-2026-22808 | Fleet Windows MDM endpoint has a Cross-site Scripting vulnerabilityfleetdm · fleet | Medium5.5 |
| CVE-2025-27509 | SAML authentication vulnerability due to improper SAML response validationfleetdm · fleet | Critical9.3 |
| CVE-2022-24841 | Improper Authorization in github.com/fleetdm/fleetfleetdm · fleet | Medium6.5 |
| CVE-2022-23600 | Limited ability to spoof SAML authentication with missing audience verificationfleetdm · fleet | Medium5.3 |
| CVE-2021-21296 | Denial-of-service in Fleetfleetdm · fleet | Low2.7 |
| CVE-2020-26276 | SAML authentication vulnerability in Fleetfleetdm · fleet | Critical10.0 |