Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 8 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,292All CVEsplus 19,140 rejected
- 451Last 24 hours2,724 in the last 7 days
- 16,915Last 30 days1,557 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 2 | 14 | 7 | 0 | 0 | 23 | 31 |
| 2025 | 0 | 0 | 1 | 0 | 0 | 1 | 8 |
| 2024 | 0 | 0 | 0 | 0 | 0 | 0 | 7 |
| 2023 | 0 | 1 | 0 | 0 | 0 | 1 | 7 |
| 2022 | 0 | 0 | 0 | 0 | 0 | 0 | 6 |
| 2021 | 1 | 3 | 1 | 0 | 0 | 5 | 6 |
| 2020 | 0 | 1 | 0 | 0 | 0 | 1 | 1 |
| Title | ||
|---|---|---|
| CVE-2026-61741 | http4s-scala-xml has an XML External Entity (XXE) processing issuehttp4s · http4s-scala-xml | Critical9.3 |
| CVE-2026-88975 | Http4s: Ember HTTP/2 buffers a frame's declared payload before checking SETTINGS_MAX_FRAME_SIZEhttp4s · http4s | High7.5 |
| CVE-2026-69206 | Http4s: DigestAuth allows replay of captured requestshttp4s · http4s | Medium5.9 |
| CVE-2026-69202 | Http4s Ember HTTP/2: unbounded inbound body bufferinghttp4s · http4s | High7.5 |
| CVE-2026-69218 | Http4s Ember HTTP/2: unbounded continuation frame accumulationhttp4s · http4s | High7.5 |
| CVE-2026-69203 | Http4s Ember HTTP/2: does not enforce SETTINGS_MAX_CONCURRENT_STREAMShttp4s · http4s | High7.5 |
| CVE-2026-69217 | Http4s: Ember Server accepts duplicate Content-Length headershttp4s · http4s | High8.7 |
| CVE-2026-69210 | Http4s: WebSocket decoder accepts negative length, causing infinite decode loophttp4s · http4s | High7.5 |
| CVE-2026-69215 | Http4s: CookieJar middleware matches by substring, leaking cookies cross-originhttp4s · http4s | Medium6.8 |
| CVE-2026-69205 | Http4s: Ember Transfer-Encoding value parsing (TE.CL / TE.0 request smuggling)http4s · http4s | High8.7 |
| CVE-2026-69212 | Http4s: FollowRedirect middleware leaks credentials over https->http same-authority redirecthttp4s · http4s | Medium5.9 |
| CVE-2026-69213 | Http4s Ember HTTP/2: unbounded outbound frame queuehttp4s · http4s | High7.5 |
| CVE-2026-69214 | Http4s: CookieJar middleware accepts arbitrary Set-Cookie domainhttp4s · http4s | Medium6.8 |
| CVE-2026-69201 | Http4s: ResourceService and Webjar Service path escape via percent-encoded separatorshttp4s · http4s | Medium5.9 |
| CVE-2026-69216 | Http4s: Ember chunk parser lenience (TE.TE request smuggling)http4s · http4s | Medium5.4 |
| CVE-2026-69211 | Http4s: Set-Cookie rendering does not escape attribute delimitershttp4s · http4s | Medium4.8 |
| CVE-2026-69209 | Http4s: WebSocket decoder accepts unbounded message sizeshttp4s · http4s | High7.5 |
| CVE-2026-69208 | Http4s: DigestAuth nonce map grows unboundedhttp4s · http4s | High7.5 |
| CVE-2026-69204 | Http4s: Ember accepts Transfer-Encoding combined with Content-Length (CL.TE request smuggling)http4s · http4s | Critical9.2 |
| CVE-2026-73494 | blaze: Multiple HTTP/1.1 request-smuggling primitives in blaze's Java wire parserhttp4s · blaze | High7.4 |
| CVE-2026-54556 | Http4s: HTTP/2 Denial of Service with Ember Backendhttp4s · http4s | High8.2 |
| CVE-2026-73495 | blaze: Chunked-body trailer fields promoted into Request.headers in blaze-server (front-end header-sanitization bypass)http4s · blaze | High7.4 |
| CVE-2026-73493 | http4s-blaze-server: Unbounded WebSocket message aggregationhttp4s · blaze | High7.5 |
| CVE-2025-59822 | Http4s vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer sectionhttp4s · http4s | Medium6.3 |
| CVE-2023-22465 | Http4s has fatal error parsing User-Agent and Server headershttp4s · http4s | High7.5 |
| CVE-2021-41084 | Response Splitting from unsanitized headers in http4shttp4s · http4s | High8.7 |
| CVE-2021-39185 | Default CORS config allows any origin with credentialshttp4s · http4s | Critical9.1 |
| CVE-2021-32643 | StaticFile.fromUrl can leak presence of a directoryhttp4s · http4s | Medium5.8 |
| CVE-2021-21294 | Unbounded connection acceptance in http4s-blaze-serverhttp4s · http4s | High7.5 |
| CVE-2021-21293 | Unbounded connection acceptance leads to file handle exhaustionhttp4s · blaze | High7.5 |
| CVE-2020-5280 | Local file inclusion vulnerability in http4shttp4s · http4s | High7.6 |