Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 8 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,334All CVEsplus 19,141 rejected
- 442Last 24 hours2,720 in the last 7 days
- 16,914Last 30 days1,562 of them critical
- 1,769Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 0 | 0 | 0 | 0 | 0 | 0 | 23 |
| 2025 | 0 | 3 | 1 | 2 | 0 | 6 | 23 |
| 2024 | 1 | 2 | 0 | 2 | 0 | 5 | 17 |
| 2023 | 2 | 2 | 2 | 0 | 0 | 6 | 12 |
| 2022 | 0 | 2 | 1 | 0 | 0 | 3 | 6 |
| 2021 | 0 | 1 | 0 | 0 | 0 | 1 | 3 |
| 2020 | 1 | 0 | 1 | 0 | 0 | 2 | 2 |
| Title | ||
|---|---|---|
| CVE-2025-48384 | Git allows arbitrary code execution through broken config quotingExploitedgit · git | High8.1 |
| CVE-2025-48385 | Git alllows arbitrary file writes via bundle-uri parameter injectiongit · git | High8.6 |
| CVE-2025-48386 | Git allows a buffer overflow in 'wincred' credential helpergit · git | Medium6.3 |
| CVE-2024-52005 | The sideband payload is passed unfiltered to the terminal in gitgit · git | High7.5 |
| CVE-2024-50349 | Git does not sanitize URLs when asking for credentials interactivelygit · git | Low2.1 |
| CVE-2024-52006 | Newline confusion in credential helpers can lead to credential exfiltration in gitgit · git | Low2.1 |
| CVE-2024-32465 | Git's protections for cloning untrusted repositories can be bypassedgit · git | High7.4 |
| CVE-2024-32021 | Local Git clone may hardlink arbitrary user-readable files into the new repository's "objects/" directorygit · git | Low3.9 |
| CVE-2024-32020 | Cloning local Git repository by untrusted user allows the untrusted user to modify objects in the cloned repository at willgit · git | Low3.9 |
| CVE-2024-32004 | Git vulnerable to Remote Code Execution while cloning special-crafted local repositoriesgit · git | High8.2 |
| CVE-2024-32002 | Git's recursive clones on case-insensitive filesystems that support symlinks are susceptible to Remote Code Executiongit · git | Critical9.1 |
| CVE-2023-29007 | Arbitrary configuration injection via `git submodule deinit`git · git | High7.0 |
| CVE-2023-25652 | "git apply --reject" partially-controlled arbitrary file writegit · git | High7.5 |
| CVE-2023-23946 | Git's `git apply` overwriting paths outside the working treegit · git | Medium6.2 |
| CVE-2023-22490 | Git vulnerable to local clone-based data exfiltration with non-local transportsgit · git | Medium5.5 |
| CVE-2022-23521 | gitattributes parsing integer overflow in gitgit · git | Critical9.8 |
| CVE-2022-41903 | Integer overflow in `git archive`, `git log --format` leading to RCE in gitgit · git | Critical9.8 |
| CVE-2022-39260 | Git vulnerable to Remote Code Execution via Heap overflow in `git shell`git · git | High8.5 |
| CVE-2022-39253 | Git subject to exposure of sensitive information via local clone of symbolic linksgit · git | Medium5.5 |
| CVE-2022-29187 | Bypass of safe.directory protections in Gitgit · git | High7.8 |
| CVE-2021-21300 | malicious repositories can execute remote code while cloninggit · git | High8.0 |
| CVE-2020-11008 | Malicious URLs can still cause Git to send a stored credential to the wrong servergit · git | Medium4.0 |
| CVE-2020-5260 | malicious URLs may cause Git to present stored credentials to the wrong servergit · git | Critical9.3 |