Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 1 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,765All CVEsplus 19,141 rejected
- 676Last 24 hours3,065 in the last 7 days
- 17,168Last 30 days1,611 of them critical
- 1,769Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 4 | 2 | 6 | 0 | 0 | 12 | 16 |
| 2025 | 0 | 0 | 0 | 0 | 0 | 0 | 4 |
| 2024 | 0 | 0 | 0 | 0 | 0 | 0 | 4 |
| 2023 | 0 | 0 | 3 | 0 | 0 | 3 | 4 |
| 2022 | 0 | 0 | 0 | 0 | 0 | 0 | 1 |
| 2021 | 0 | 0 | 0 | 0 | 0 | 0 | 1 |
| 2020 | 1 | 0 | 0 | 0 | 0 | 1 | 1 |
| Title | ||
|---|---|---|
| CVE-2026-55486 | Goobi viewer: IIIF Auth 2.0 origin parameter unsanitized — CSP malformation and reflected XSSintranda · goobi-viewer-core | Critical9.3 |
| CVE-2026-55465 | Goobi viewer: Solr injection via unvalidated region parameter in spatial searchintranda · goobi-viewer-core | Medium5.3 |
| CVE-2026-55463 | Goobi viewer: WebSocket endpoints lack server-side authentication and origin validationintranda · goobi-viewer-core | Medium6.5 |
| CVE-2026-55459 | Goobi viewer: OpenID JWT audience not enforced by the verifierintranda · goobi-viewer-core | High7.4 |
| CVE-2026-55457 | Goobi viewer: Empty webapi.authorization.token default permits unauthenticated authorization bypassintranda · goobi-viewer-core | High7.4 |
| CVE-2026-55444 | Goobi viewer: Solr query injection via the legacy RSS servlet q and filterQuery parametersintranda · goobi-viewer-core | Medium5.3 |
| CVE-2026-46652 | Path traversal via HTTP `Content-Disposition` header in ExternalFilesDownloader enables remote code execution in Goobi viewerintranda · goobi-viewer-core | Critical9.8 |
| CVE-2026-46651 | Unauthenticated SSRF and local file inclusion via DownloadTaskEndpoint WebSocket in Goobi viewerintranda · goobi-viewer-core | Critical9.8 |
| CVE-2026-46347 | Goobi viewer: Predictable Replacement Password Allows Account Takeover After Password Resetintranda · goobi-viewer-core | Medium6.8 |
| CVE-2026-46346 | Goobi viewer: Predictable Password Reset Token Allows Unauthorized Password Resetintranda · goobi-viewer-core | Medium6.5 |
| CVE-2026-55442 | Goobi viewer: cleanUpQuery double-brace bypass allows arbitrary Solr local-param injectionintranda · goobi-viewer-core | Medium5.3 |
| CVE-2026-45083 | Goobi viewer: Unauthenticated Solr Streaming Expression Proxyintranda · goobi-viewer-core | Critical9.8 |
| CVE-2023-29016 | Goobi viewer Core has Cross-Site Scripting Vulnerability in User Nicknamesintranda · goobi-viewer-core | Medium6.1 |
| CVE-2023-29015 | Goobi viewer Core has Cross-Site Scripting Vulnerability in User Commentsintranda · goobi-viewer-core | Medium6.1 |
| CVE-2023-29014 | Goobi viewer Core Reflected Cross-Site Scripting Vulnerability Using LOGID Parameterintranda · goobi-viewer-core | Medium6.1 |
| CVE-2020-15124 | Path traversal in Goobi viewer Coreintranda · goobi-viewer-core | Critical9.6 |