Skip to content
CVE Tracker
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API documentationPage
  • MCP serverPage
  • Data sourcesPage
  • ChangelogPage
  • AboutPage
  • How it's builtPage

Every public CVE, as it is published

The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 2 min ago.

At a glance

Published CVEs; rejected ones are not counted.

  • 401,624All CVEsplus 19,141 rejected
  • 686Last 24 hours2,964 in the last 7 days
  • 17,122Last 30 days1,607 of them critical
  • 1,769Known exploitedin the CISA KEV catalog

CVEs published per year

All time, by publication date in UTC; follows the filter above.

  • Critical
  • High
  • Medium
  • Low
  • Not scored
The numbers of every bucket are in the table under the chart.
Show the numbers as a table
Matching CVEs per period and severity, newest first
PeriodCriticalHighMediumLowNot scoredTotalCumulative
2026026201026
202510030416
202400010112
202300200211
20221260099

Latest CVEs

26 CVEs, newest first

CVEs, newest first
Title
CVE-2026-55632
GoCD is vulnerable to authorization bypass via pipeline structure APIgocd · gocd
Medium4.3
CVE-2026-52744
GoCD is vulnerable to authorization bypass via fetch artifact autosuggestion APIgocd · gocd
Medium5.3
CVE-2026-52742
GoCD is vulnerable to historical server configuration API authorization bypassgocd · gocd
Medium5.1
CVE-2026-55870
GoCD is vulnerable to credential exposure when admins insecurely configure material URLsgocd · gocd
Low2.3
CVE-2026-55625
GoCD is vulnerable to authorization bypass via material connection test APIsgocd · gocd
Medium4.9
CVE-2026-52740
GoCD is vulnerable to pipeline template view API authorization bypassgocd · gocd
Medium5.3
CVE-2026-55060
GoCD is vulnerable to authorization bypass via support process list APIgocd · gocd
Low3.7
CVE-2026-52741
GoCD has stored XSS possible via tracking tool link highlighting on Compare Pipeline pagesgocd · gocd
High7.5
CVE-2026-68919
GoCD has stored XSS possible via forged package material comments on Stage/Job/VSM pagesgocd · gocd
High7.0
CVE-2026-52743
GoCD before 26.1.0 is vulnerable to authorization bypass via job status APIgocd · gocd
Medium4.3
CVE-2024-56324
GoCD vulnerable to XXE injection via abuse of pipeline XML "snippet" editing by group adminsgocd · gocd
Low2.1
CVE-2024-56322
GoCD vulnerable to XXE injection via abuse of unused XML configuration repository functionalitygocd · gocd
Low2.1
CVE-2024-56321
GoCD can allow malicious GoCD admins to abuse backup configuration to gain additional host accessgocd · gocd
Low3.8
CVE-2024-56320
GoCD vulnerable to admin privilege escalation by a malicious internal/existing authenticated usergocd · gocd
Critical9.4
CVE-2024-28866
GoCD vulnerable to reflected Cross-site Scripting possible on server loading page during start-upgocd · gocd
Low3.1
CVE-2023-28629
Stored XSS possible on VSM and Job Details pages via malicious pipeline label configuration in gocdgocd · gocd
Medium5.4
CVE-2023-28630
Sensitive information disclosure possible on misconfigured failed backups of non-H2 databases in gocdgocd · gocd
Medium4.2
CVE-2022-39311
Compromised agents may be able to execute remote code on GoCD Servergocd · gocd
Critical9.1
CVE-2022-39310
Malicious agent may be able to impersonate another agent in GoCDgocd · gocd
Medium4.9
CVE-2022-39309
GoCD server secret encryption/decryption key leaked to agents during material serializationgocd · gocd
Medium4.9
CVE-2022-39308
GoCD API authentication of user access tokens subject to timing attack during comparisongocd · gocd
Medium6.5
CVE-2022-36088
GoCD Windows installations outside default location inadequately restrict installation file permissionsgocd · gocd
Medium5.0
CVE-2022-29184
Command Injection/Argument Injection in GoCDgocd · gocd
High8.8
CVE-2022-29183
Reflected XSS in GoCDgocd · gocd
Medium4.3
CVE-2022-29182
DOM-based XSS in GoCDgocd · gocd
Medium4.3
CVE-2022-24832
Bundled ldap-authentication-plugin fails to neutralise LDAP special elements in usernamesgocd · gocd
High8.2