Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 1 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,298All CVEsplus 19,140 rejected
- 452Last 24 hours2,722 in the last 7 days
- 16,914Last 30 days1,557 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 3 | 12 | 4 | 0 | 0 | 19 | 19 |
| Title | ||
|---|---|---|
| CVE-2026-44829 | Gotenberg: Path traversal in zip entry name via Windows-style separators in upload filenamegotenberg · gotenberg | High8.8 |
| CVE-2026-45742 | Gotenberg: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')gotenberg · gotenberg | High7.5 |
| CVE-2026-45741 | Gotenberg: SSRF deny-list bypass in IsPublicIP via IPv6 6to4 / NAT64 / site-local prefixesgotenberg · gotenberg | High7.5 |
| CVE-2026-55229 | Gotenberg: SSRF via LibreOffice document processinggotenberg · gotenberg | High7.5 |
| CVE-2026-42590 | Gotenberg: ExifTool group-prefix syntax bypasses dangerous-tag blocklistgotenberg · gotenberg | High8.2 |
| CVE-2026-42597 | Gotenberg: Chromium URL conversion routes read arbitrary files under /tmp via file:// schemegotenberg · gotenberg | Medium5.9 |
| CVE-2026-42595 | Gotenberg: Server-Side Request Forgery via Chromium URL Endpoint with Redirect-Based Deny-List Bypassgotenberg · gotenberg | High8.6 |
| CVE-2026-42594 | Gotenberg: Unauthenticated denial of service via echo.Context pool reuse in webhook async goroutinegotenberg · gotenberg | High7.5 |
| CVE-2026-42593 | Gotenberg: Arbitrary PDF read via stampExpression and watermarkExpression in merge, split, and convert routesgotenberg · gotenberg | Medium5.3 |
| CVE-2026-42592 | Gotenberg: DNS rebinding bypasses SSRF validation on Chromium URL conversion routesgotenberg · gotenberg | Medium5.3 |
| CVE-2026-42591 | Gotenberg: Server-Side Request Forgery (SSRF) in github.com/gotenberg/gotenberg/v8gotenberg · gotenberg | High8.2 |
| CVE-2026-42596 | Gotenberg: Unauthenticated SSRF via default deny-list bypass in downloadFrom and webhookgotenberg · gotenberg | Critical9.4 |
| CVE-2026-40893 | Gotenberg: ExifTool Dangerous Tag Blocklist Bypass via Group-Prefixed Tag Names Allows Arbitrary File Rename and Movegotenberg · gotenberg | High8.2 |
| CVE-2026-42589 | Gotenberg: Unauthenticated RCE via ExifTool Metadata Key Injectiongotenberg · gotenberg | Critical9.8 |
| CVE-2026-40281 | Gotenberg vulnerable to argument injection via newlines in ExifTool metadata valuesgotenberg · gotenberg | Critical10.0 |
| CVE-2026-39383 | Gotenberg unauthenticated blind SSRF via unfiltered webhook URLgotenberg · gotenberg | Medium6.9 |
| CVE-2026-40280 | Gotenberg SSRF via case-insensitive URL scheme bypass in webhook and downloadFrom deny-listsgotenberg · gotenberg | High7.8 |
| CVE-2026-35458 | Gotenberg has a ReDoS via extraHttpHeaders scope featuregotenberg · gotenberg | High8.7 |
| CVE-2026-27018 | Gotenberg: Chromium deny-list bypass via case-insensitive URL schemegotenberg · gotenberg | High7.8 |