Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 4 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,764All CVEsplus 19,141 rejected
- 679Last 24 hours3,064 in the last 7 days
- 17,180Last 30 days1,610 of them critical
- 1,769Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 1 | 2 | 7 | 0 | 0 | 10 | 20 |
| 2025 | 1 | 2 | 0 | 0 | 0 | 3 | 10 |
| 2024 | 3 | 0 | 0 | 0 | 0 | 3 | 7 |
| 2023 | 1 | 1 | 1 | 0 | 0 | 3 | 4 |
| 2022 | 0 | 0 | 0 | 0 | 0 | 0 | 1 |
| 2021 | 0 | 0 | 0 | 0 | 0 | 0 | 1 |
| 2020 | 0 | 0 | 1 | 0 | 0 | 1 | 1 |
| Title | ||
|---|---|---|
| CVE-2026-119285 | Fiber: CORS wildcard origins matched without a dot boundary, allowing credentialed cross-origin readsgofiber · fiber | Medium5.9 |
| CVE-2026-44332 | Fiber: Username Enumeration via Timing Oracle in BasicAuth Default Authorizergofiber · fiber | Medium5.3 |
| CVE-2026-53624 | Fiber: HSTS header never set in helmet middleware due to incorrect protocol checkgofiber · fiber | Medium4.8 |
| CVE-2026-45045 | Fiber: X-Real-IP Spoofing via Header.Add() in BalancerForwardgofiber · fiber | Medium5.3 |
| CVE-2026-42554 | Fiber: XSS in AutoFormat Content Negotiationgofiber · fiber | Medium5.3 |
| CVE-2026-30246 | github.com/gofiber/fiber/v3 cache middleware can mix responses across query parametersgofiber · fiber | Medium6.5 |
| CVE-2026-25899 | Fiber is Vulnerable to Denial of Service via Flash Cookie Unbounded Allocationgofiber · fiber | High7.5 |
| CVE-2026-25891 | Fiber has an Arbitrary File Read in Static Middleware on Windowsgofiber · fiber | High7.7 |
| CVE-2026-25882 | Fiber has a Denial of Service Vulnerability via Route Parameter Overflowgofiber · fiber | Medium5.5 |
| CVE-2025-66630 | Fiber insecurely fallsback in utils.UUIDv4() / utils.UUID() — predictable / zero‑UUID on crypto/rand failuregofiber · fiber | Critical9.2 |
| CVE-2025-66565 | Fiber Utils UUIDv4 and UUID Silent Fallback to Predictable Valuesgofiber · utils | Critical9.3 |
| CVE-2025-54801 | Fiber Susceptible to Crash via `BodyParser` Due to Unvalidated Large Slice Index in Decodergofiber · fiber | High8.7 |
| CVE-2025-48075 | Fiber panics when fiber.Ctx.BodyParser parses invalid range indexgofiber · fiber | High7.7 |
| CVE-2024-38513 | Fiber Session Middleware Token Injection Vulnerabilitygofiber · fiber | Critical10.0 |
| CVE-2024-25124 | Fiber has Insecure CORS Configuration, Allowing Wildcard Origin with Credentialsgofiber · fiber | Critical9.4 |
| CVE-2024-22199 | Django Template Engine Vulnerable to XSSgofiber · template | Critical9.3 |
| CVE-2023-45141 | CSRF Token Validation Vulnerability in fibergofiber · fiber | High8.6 |
| CVE-2023-45128 | CSRF Token Reuse Vulnerability in fibergofiber · fiber | Critical10.0 |
| CVE-2023-41338 | Vulnerability in Ctx.IsFromLocal() in gofibergofiber · fiber | Medium5.3 |
| CVE-2020-15111 | CRLF vulnerability in Fibergofiber · fiber | Medium4.2 |