Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 10 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 400,898All CVEsplus 19,118 rejected
- 380Last 24 hours2,800 in the last 7 days
- 16,786Last 30 days1,549 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 2 | 33 | 52 | 3 | 0 | 90 | 90 |
| Title | ||
|---|---|---|
| CVE-2026-116201 | Snipe-IT before 8.5.0 SAML Assertion Replay via Race Conditiongrokability · snipe-it | High8.7 |
| CVE-2026-116200 | Snipe-IT before 8.6.3 LDAP StartTLS Downgrade via connectToLdap()grokability · snipe-it | High8.2 |
| CVE-2026-116199 | Snipe-IT before 8.6.3 Authentication Bypass via Google SSO Callbackgrokability · snipe-it | Critical9.2 |
| CVE-2026-116198 | Snipe-IT before 8.7.0 Missing Encryption via Api AssetsController storegrokability · snipe-it | Medium5.3 |
| CVE-2026-114064 | Snipe-IT before 8.7.0 SSRF Port Scanning via Webhook Testing Endpointgrokability · snipe-it | Medium5.1 |
| CVE-2026-62368 | Snipe-IT: Stored XSS via Custom Field name in asset-list column headersgrokability · snipe-it | High8.1 |
| CVE-2026-63493 | Snipe-IT: 2FA bypass via the API token flowgrokability · snipe-it | High8.6 |
| CVE-2026-63498 | Snipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files APIgrokability · snipe-it | High8.7 |
| CVE-2026-88894 | Snipe-IT before 8.7.2 Authorization Bypass via Predefined Kit Checkoutgrokability · snipe-it | Medium5.3 |
| CVE-2026-86774 | Snipe-IT before 8.7.0 Broken Access Control via AssetModelPolicygrokability · snipe-it | Medium5.3 |
| CVE-2026-86773 | Snipe-IT 8.6.3 Broken Access Control via Kit Update Endpointsgrokability · snipe-it | Medium5.3 |
| CVE-2026-86772 | Snipe-IT 8.6.3 Stored XSS via Department Namesgrokability · snipe-it | Medium5.1 |
| CVE-2026-86771 | Snipe-IT before 8.7.0 Server-Side Request Forgery via employee_numgrokability · snipe-it | High8.3 |
| CVE-2026-86770 | Snipe-IT before 8.7.0 Authentication Bypass via SAML Username Collationgrokability · snipe-it | High8.6 |
| CVE-2026-86769 | Snipe-IT before 8.7.0 Audit Log Misattribution via Consumables Checkoutgrokability · snipe-it | Medium5.3 |
| CVE-2026-86768 | Snipe-IT before 8.7.0 Improper Input Validation via API Checkoutgrokability · snipe-it | Medium5.3 |
| CVE-2026-86767 | Snipe-IT before 8.7.0 Cross-Company Read via requested-assetsgrokability · snipe-it | Medium5.3 |
| CVE-2026-86766 | Snipe-IT 8.6.3 Race Condition via Consumable Checkoutgrokability · snipe-it | High7.1 |
| CVE-2026-86765 | Snipe-IT 8.6.3 Authorization Bypass via Asset Update Endpointgrokability · snipe-it | High7.1 |
| CVE-2026-86764 | Snipe-IT 8.6.4 before 8.7.0 Permission Bypass via assigned componentsgrokability · snipe-it | High7.1 |
| CVE-2026-86763 | snipe-it 7.0.12 through 8.6.3 Authorization Bypass via Importergrokability · snipe-it | Medium5.1 |
| CVE-2026-86762 | Snipe-IT before 8.7.0 Authentication Bypass via API Middlewaregrokability · snipe-it | High8.6 |
| CVE-2026-86761 | snipe-it 8.6.3 before 8.7.0 Authorization Bypass via print endpointsgrokability · snipe-it | Medium5.3 |
| CVE-2026-86760 | snipe-it 8.2.0 before 8.7.0 Authentication Bypass via activated flaggrokability · snipe-it | Medium5.3 |
| CVE-2026-86759 | Snipe-IT before 8.7.0 Missing Authorization via asset-history CSV importergrokability · snipe-it | High7.1 |
| CVE-2026-86758 | Snipe-IT before 8.7.0 License Key Exposure via CSV Exportgrokability · snipe-it | High7.1 |
| CVE-2026-86757 | Snipe-IT before 8.7.0 Information Disclosure via Custom Fieldsgrokability · snipe-it | High7.1 |
| CVE-2026-86756 | Snipe-IT 8.5.0 through 8.6.3 Open Redirect via SAML RelayStategrokability · snipe-it | Medium5.3 |
| CVE-2026-86755 | Snipe-IT 4.2.0 through 8.6.3 Permission Bypass via OAuthgrokability · snipe-it | Medium5.3 |
| CVE-2026-86754 | Snipe-IT before 8.7.0 Authorization Bypass via OAuth Clientsgrokability · snipe-it | High8.5 |
| CVE-2026-86753 | snipe-it before 8.7.0 Business Logic Bypass via asset_model endpointgrokability · snipe-it | Medium5.3 |
| CVE-2026-86752 | snipe-it before 8.7.0 Authorization Bypass via Asset Audit Endpointsgrokability · snipe-it | Medium5.3 |
| CVE-2026-86751 | Snipe-IT before 8.7.0 Arbitrary File Read and SSRF via Markdowngrokability · snipe-it | High8.4 |
| CVE-2026-86750 | snipe-it before 8.7.0 Authorization Bypass via API User Create/Updategrokability · snipe-it | High8.3 |
| CVE-2026-86749 | snipe-it before 8.7.0 Data Loss via Failed Image Writegrokability · snipe-it | High7.0 |
| CVE-2026-86748 | Snipe-IT before 8.7.0 Database Wipe via Invalid Backup Archivegrokability · snipe-it | Medium6.9 |
| CVE-2026-86747 | snipe-it before 8.7.0 Authorization Bypass via Pivot-Only Usergrokability · snipe-it | Medium5.3 |
| CVE-2026-86746 | Snipe-IT before 8.7.0 Authorization Bypass via Livewire Snapshot Replaygrokability · snipe-it | High7.4 |
| CVE-2026-86745 | Snipe-IT before 8.7.0 CSV Formula Injection via Location-Scoping Exportgrokability · snipe-it | Medium5.1 |
| CVE-2026-86744 | snipe-it before 8.7.0 Race Condition in Asset Checkoutgrokability · snipe-it | Low2.1 |
| CVE-2026-86743 | Snipe-IT before 8.7.0 Authorization Bypass via Asset Acceptance Reportgrokability · snipe-it | Medium5.3 |
| CVE-2026-86742 | Snipe-IT before 8.7.0 CSV Formula Injection via Asset Acceptance Reportgrokability · snipe-it | Medium5.1 |
| CVE-2026-86741 | Snipe-IT before 8.7.0 Arbitrary File Read and SSRF via Category EULAgrokability · snipe-it | High8.4 |
| CVE-2026-86740 | Snipe-IT before 8.7.0 Attachment Deletion Reports Success While File Remainsgrokability · snipe-it | Medium5.1 |
| CVE-2026-86739 | Snipe-IT before 8.7.0 Acceptance Finalization Without Stored Evidencegrokability · snipe-it | Low2.3 |
| CVE-2026-86738 | Snipe-IT before 8.7.0 CSS Injection via Custom CSSgrokability · snipe-it | Critical9.3 |
| CVE-2026-86737 | snipe-it before 8.7.0 Missing Authorization via barcode endpointgrokability · snipe-it | Medium5.3 |
| CVE-2026-86736 | snipe-it before 8.7.0 Checkout Request Counter Integrity Failuregrokability · snipe-it | Medium5.3 |
| CVE-2026-86735 | snipe-it before 8.7.0 SSRF via IPv6 transition address bypassgrokability · snipe-it | Medium5.9 |
| CVE-2026-86734 | Snipe-IT before 8.7.1 Denial of Service via Unbounded Note Fieldgrokability · snipe-it | High7.1 |