Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 9 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,334All CVEsplus 19,141 rejected
- 442Last 24 hours2,720 in the last 7 days
- 16,921Last 30 days1,562 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 2 | 25 | 21 | 0 | 0 | 48 | 165 |
| 2025 | 0 | 9 | 3 | 0 | 0 | 12 | 117 |
| 2024 | 10 | 10 | 19 | 1 | 0 | 40 | 105 |
| 2023 | 1 | 6 | 20 | 5 | 0 | 32 | 65 |
| 2022 | 1 | 10 | 4 | 0 | 0 | 15 | 33 |
| 2021 | 1 | 4 | 8 | 0 | 0 | 13 | 18 |
| 2020 | 1 | 1 | 2 | 0 | 0 | 4 | 5 |
| 2019 | 0 | 1 | 0 | 0 | 0 | 1 | 1 |
| Title | ||
|---|---|---|
| CVE-2026-118237 | Out-of-bounds read vulnerability in GitHub Enterprise Server allowed disclosure of process memory in the Git serviceGitHub · Enterprise Server | Medium5.3 |
| CVE-2026-110288 | Cross-site request forgery vulnerability in GitHub Enterprise Server allowed deletion of stored ChatOps configuration through the Management ConsoleGitHub · Enterprise Server | Medium5.3 |
| CVE-2026-104608 | Use-after-free vulnerability in GitHub Enterprise Server allowed remote code execution in the Git serviceGitHub · Enterprise Server | High7.7 |
| CVE-2026-96890 | Server-Side Request Forgery vulnerability was identified in GitHub Enterprise Server that allowed requests to attacker-controlled internal hostsGitHub · Enterprise Server | High8.7 |
| CVE-2026-103620 | Missing authorization in GitHub Enterprise Server allowed repository writers to replace default branches via GraphQLGitHub · Enterprise Server | Medium6.0 |
| CVE-2026-75101 | Authorization bypass vulnerability in GitHub Enterprise Server allowed reading of private pull request diffs and patches via repository name collisionGitHub · Enterprise Server | Medium6.0 |
| CVE-2026-77912 | Stored cross-site scripting vulnerability in GitHub Enterprise Server allowed HTML attribute injection via the Markdown rendering pipelineGitHub · Enterprise Server | High7.4 |
| CVE-2026-77987 | GitHub Enterprise Server notebook viewer vulnerable to Server-side request forgeryGitHub · Enterprise Server | Critical9.3 |
| CVE-2026-76851 | Server-Side Request Forgery vulnerability in GitHub Enterprise Server allowed remote code execution via network access from pre-receive hooks to internal servicesGitHub · Enterprise Server | High7.7 |
| CVE-2026-19118 | Race condition vulnerability was identified in GitHub Enterprise Server that allowed remote code executionGitHub · Enterprise Server | High7.7 |
| CVE-2026-18730 | Server-side request forgery vulnerability in GitHub Enterprise Server Manage API leaked a replayable gateway-agent bearer tokenGitHub · Enterprise Server | High8.2 |
| CVE-2026-18428 | SQL Query Validation Bypass in OpenSearch Direct QueryAWS · Opensearch | High8.7 |
| CVE-2026-18952 | Missing Input Validation in Threat Intel Feed Parser in OpenSearch Security Analytics PluginAWS · Opensearch | High8.6 |
| CVE-2026-19311 | Missing Authorization in Execute Monitor API in OpenSearch Alerting PluginAWS · OpenSearch | High8.6 |
| CVE-2026-15996 | Denial of service vulnerability in GitHub Enterprise Server allowed unauthenticated service disruption via deeply nested request parametersGitHub · Enterprise Server | Medium6.6 |
| CVE-2026-17556 | Path traversal in GitHub Enterprise Server allowed unauthenticated deletion of instance storage via the X-GitHub-Request-Id headerGitHub · Enterprise Server | High8.8 |
| CVE-2026-47427 | GitHub MCP Server: Nil Pointer Dereference DoS in completion/complete Handlergithub · github-mcp-server | High7.5 |
| CVE-2026-54163 | secure_headers: CSP directive injection via sandbox, plugin_types, and report_to when given untrusted inputgithub · secure_headers | Medium4.7 |
| CVE-2026-15783 | Missing Authorization vulnerability was identified in GitHub Enterprise Server that allowed reading private repository metadata via delegated bypass rule suitesGitHub · Enterprise Server | Medium5.3 |
| CVE-2026-15343 | Path traversal vulnerability in GitHub Enterprise Server allowed writing files to arbitrary repository paths, including GitHub Actions workflow files, via unchecked Dependabot dependency-file pathsGitHub · Enterprise Server | High8.6 |
| CVE-2026-15007 | Denial of service vulnerability in GitHub Enterprise Server allowed service disruption via deeply nested YAML in release notes configurationGitHub · Enterprise Server | Medium5.7 |
| CVE-2026-14340 | An incorrect authorization vulnerability in GitHub Enterprise Server allows issue creation in unrelated public repositoriesGitHub · Enterprise Server | Medium5.3 |
| CVE-2026-10585 | Stored cross-site scripting vulnerability in GitHub Enterprise Server allowed arbitrary JavaScript execution via crafted Discussion titles in the Q&A categoryGitHub · Enterprise Server | Medium6.3 |
| CVE-2026-9132 | Missing authorization vulnerability in GitHub Enterprise Server allowed disclosure of private repository contents via the Copilot pull request diff summary endpointGitHub · Enterprise Server | Medium6.0 |
| CVE-2026-9106 | UI misrepresentation vulnerability in GitHub Enterprise Server allowed unauthorized organization runner management via undisclosed OAuth scope on consent screenGitHub · Enterprise Server | Medium4.8 |
| CVE-2026-48529 | GitHub MCP Server: Lockdown mode singleton in HTTP server causes cross-user GraphQL client confusiongithub · github-mcp-server | Medium6.0 |
| CVE-2026-9312 | Server-Side Request Forgery vulnerability in GitHub Enterprise Server allowed access to internal services via path traversal in upload endpointGitHub · Enterprise Server | Critical9.2 |
| CVE-2026-8606 | Server-Side Request Forgery in GitHub Enterprise Server via Advisory Package URL EndpointGitHub · Enterprise Server | High7.0 |
| CVE-2026-45033 | GitHub Copilot CLI: Nested Bare Repository Can Execute Arbitrary Commands via core.fsmonitorgithub · copilot-cli | High8.5 |
| CVE-2026-8106 | Reflected HTML injection vulnerability in GitHub Enterprise Server Management Console login page allowed credential theftGitHub · Enterprise Server | Medium5.9 |
| CVE-2026-8034 | Server-side request forgery vulnerability in GitHub Enterprise Server notebook viewer via URL parser confusionGitHub · Enterprise Server | High7.9 |
| CVE-2026-7541 | Denial of service vulnerability in GitHub Enterprise Server allowed service disruption via unauthenticated API endpointGitHub · Enterprise Server | Medium6.3 |
| CVE-2026-6736 | Authentication bypass vulnerability in GitHub Enterprise Server allowed creation of local user accounts bypassing the configured external identity providerGitHub · Enterprise Server | Medium6.3 |
| CVE-2026-5845 | Improper authorization fallback allows scoped user-to-server token installation escape in GitHub Enterprise ServerGitHub · Enterprise Server | High7.2 |
| CVE-2026-3307 | Authorization bypass in GitHub Enterprise Server secret scanning push protection allows cross-repository modification of delegated bypass reviewersGitHub · Enterprise Server | Medium5.3 |
| CVE-2026-5512 | Improper authorization vulnerability in GitHub Enterprise Server allowed disclosure of private repository names via mobile upload policy APIGitHub · Enterprise Server | Medium5.3 |
| CVE-2026-4296 | Incorrect Regular Expression vulnerability in GitHub Enterprise Server allowed unauthorized access to user accounts via OAuth callback URL validation bypassGitHub · Enterprise Server | High7.5 |
| CVE-2026-5921 | Server-Side Request Forgery in GitHub Enterprise Server allowed extraction of sensitive environment variables via timing side-channel attackGitHub · Enterprise Server | High8.9 |
| CVE-2026-3582 | Incorrect Authorization in GitHub Enterprise Server allows access to issue and commit search results without repo scopeGitHub · Enterprise Server | Medium5.3 |
| CVE-2026-2266 | Improper neutralization of input vulnerability was identified in GitHub Enterprise Server that allowed cross-site scripting via task list content and enabled arbitrary HTML injectionGitHub · Enterprise Server | High7.4 |
| CVE-2026-3306 | Improper authorization in GitHub Projects allows modification of issue and pull request metadata without repository write accessGitHub · Enterprise Server | Medium5.3 |
| CVE-2026-3854 | Remote code execution via git push option injection in GitHub Enterprise ServerGitHub · Enterprise Server | High8.7 |
| CVE-2026-29783 | GitHub Copilot CLI allows for dangerous shell expansion patterns that enable arbitrary command executiongithub · copilot-cli | High7.5 |
| CVE-2018-25188 | Webiness Inventory 2.3 SQL Injection via WsModelGrid.phpGithub · Webiness Inventory | High8.8 |
| CVE-2026-1999 | Incorrect Authorization vulnerability was identified in GitHub Enterprise Server that allowed unauthorized merging of pull requestsGitHub · Enterprise Server | High7.1 |
| CVE-2026-1355 | Missing Authorization Check in GitHub Enterprise Server Allows Unauthorized Uploads to Repository Migration ExportsGitHub · Enterprise Server | Medium6.0 |
| CVE-2026-0573 | Improper Handling of HTTP Redirects vulnerability was identified in GitHub Enterprise Server that allowed leaking of authorization token and enabled remote code executionGitHub · Enterprise Server | High7.6 |
| CVE-2025-13744 | Improper Neutralization of Input During Web Page Generation vulnerability was identified in GitHub Enterprise Server that allowed rendering of malicious HTMLGitHub · Enterprise Server | High8.4 |
| CVE-2025-14046 | Insufficient HTML Sanitization Allows User-Controlled DOM Elements to Overwrite Server-Initialized Data Islands and Trigger Unintended Server-Side POST RequestsGitHub · Enterprise Server | High8.6 |
| CVE-2025-11578 | Pre-Receive Hook Path Collision Vulnerability in GitHub Enterprise Server Allowing Privilege EscalationGitHub · Enterprise Server | High7.5 |