Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 3 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,113All CVEsplus 19,119 rejected
- 470Last 24 hours2,799 in the last 7 days
- 16,888Last 30 days1,550 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 1 | 7 | 5 | 6 | 0 | 19 | 19 |
| Title | ||
|---|---|---|
| CVE-2026-96596 | erl_tar:extract/2 loops forever on a GNU sparse member with a trailing holeerlang · rebar3 | Medium5.9 |
| CVE-2026-105274 | hex_core decompresses registry and Erlang term API responses without size limitserlang · rebar3 | Low2.1 |
| CVE-2026-81856 | Terminal escape sequence injection in Hex via unneutralized server-supplied outputhexpm · hex | Low2.3 |
| CVE-2026-96612 | Path traversal in Hex via unvalidated dependency app nameshexpm · hex | High7.5 |
| CVE-2026-105668 | Hex release-age cooldown is lifted package-wide when the locked release is retiredhexpm · hex | High7.1 |
| CVE-2026-105280 | Hex writes unverified package tarballs to standard output in mix hex.package fetchhexpm · hex | Medium6.9 |
| CVE-2026-96618 | Hex exhausts memory and disk on oversized or compressed responses from an untrusted mirrorhexpm · hex | Low2.1 |
| CVE-2026-103503 | Hex trusts its bundled CA certificates when cacerts_path is sethexpm · hex | Medium5.9 |
| CVE-2026-103502 | hex_core's default HTTP adapter doesn't verify TLS certificates on OTP 24 and 25hexpm · hex_core | Medium5.9 |
| CVE-2026-86698 | Refresh tokens accepted as private repository credentials at the CDNhexpm · hexpm | Low2.3 |
| CVE-2026-75554 | Explicit organization scopes survive token refresh after membership endshexpm · hexpm | Low2.3 |
| CVE-2026-75542 | OAuth token exchange grants repository scopes for organizations the principal cannot accesshexpm · hexpm | High8.3 |
| CVE-2026-32148 | Lockfile checksums not verified in Hex allows dependency integrity bypasshexpm · hex | High8.9 |
| CVE-2026-23940 | Denial of Service via Oversized Package Uploadhexpm · hexpm | High7.1 |
| CVE-2026-21622 | Password Reset Tokens Do Not Expirehexpm · hexpm | Critical9.5 |
| CVE-2026-21621 | Improper Scope Enforcement in OAuth client_credentials Flow Allows Read-Only API Key to Escalate to Full Accesshexpm · hexpm | High7.0 |
| CVE-2026-21619 | Unsafe Deserialization of Erlang Terms in hex_corehexpm · hex_core | Low2.0 |
| CVE-2026-23939 | Path Traversal in Local File Store Backendhexpm · hexpm | Medium6.9 |
| CVE-2026-21618 | Cross-site scripting (XSS) in OAuth Device Authorization screenhexpm · hexpm | High8.5 |