Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 2 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,955All CVEsplus 19,141 rejected
- 331Last 24 hours3,207 in the last 7 days
- 17,019Last 30 days1,575 of them critical
- 1,769Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 0 | 3 | 11 | 0 | 0 | 14 | 21 |
| 2025 | 0 | 0 | 0 | 1 | 0 | 1 | 7 |
| 2024 | 0 | 1 | 0 | 0 | 0 | 1 | 6 |
| 2023 | 0 | 0 | 0 | 0 | 0 | 0 | 5 |
| 2022 | 2 | 3 | 0 | 0 | 0 | 5 | 5 |
| Title | ||
|---|---|---|
| CVE-2026-61748 | InvenTree: Report/Label print endpoints ignore per-model permissionsinventree · InvenTree | Medium4.3 |
| CVE-2026-61746 | InvenTree: Plugin-settings GET endpoints are readable without authenticationPublic exploitinventree · InvenTree | Medium5.3 |
| CVE-2026-61744 | InvenTree: Barcode-scan API (`POST /api/barcode/`) returns full serialized object data without enforcing the model's view roleinventree · InvenTree | Medium6.5 |
| CVE-2026-61747 | InvenTree: Authenticated IDOR in the data-import API exposes other users' imported rows (`row_data`/`data`) and column mappingsinventree · InvenTree | Medium4.3 |
| CVE-2026-61749 | InvenTree: Administrative staff users can trigger Arbitrary File Read leading to Credential Disclosureinventree · InvenTree | Medium6.5 |
| CVE-2026-61745 | InvenTree: Missing authorization on machine restart endpoint allows any authenticated user to interrupt production equipmentPublic exploitinventree · InvenTree | Medium4.3 |
| CVE-2026-39362 | InvenTree has SSRF via Remote Image Download — No IP/Hostname Validation on remote_image URLsinventree · InvenTree | Medium5.3 |
| CVE-2026-35479 | InvenTree Plugin Installation - Insufficient Permissionsinventree · InvenTree | Medium6.6 |
| CVE-2026-35476 | InvenTree Affected by Privilege Escalation via APIinventree · InvenTree | High7.2 |
| CVE-2026-35478 | InvenTree has Arbitrary API Token Creationinventree · InvenTree | High8.3 |
| CVE-2026-35477 | InvenTree has SSTI in PART_NAME_FORMAT bypasses CVE-2026-27629 fix via {% if part.pk %} sandbox escapeinventree · InvenTree | Medium5.5 |
| CVE-2026-33531 | InvenTree has Path Traversal In Report Templatesinventree · InvenTree | Medium4.9 |
| CVE-2026-33530 | InvenTree Vulnerable to ORM Filter Injectioninventree · InvenTree | High7.7 |
| CVE-2026-27629 | InvenTree Vulnerable to Server Side Template Injection (SSTI)inventree · InvenTree | Medium5.9 |
| CVE-2025-49000 | InvenTree has uncontrolled memory allocation via built-in label-sheet plugininventree · InvenTree | Low3.5 |
| CVE-2024-47610 | Stored Cross-site Scripting Vulnerability in Markdown Editorinventree · InvenTree | High7.3 |
| CVE-2022-3355 | Cross-site Scripting (XSS) - Stored in inventree/inventreePublic exploitinventree · inventree/inventree | High8.2 |
| CVE-2022-2134 | Allocation of Resources Without Limits or Throttling in inventree/inventreeinventree · inventree/inventree | High7.1 |
| CVE-2022-2113 | Cross-site Scripting (XSS) - Stored in inventree/inventreeinventree · inventree/inventree | High8.4 |
| CVE-2022-2112 | Improper Neutralization of Formula Elements in a CSV File in inventree/inventreeinventree · inventree/inventree | Critical9.0 |
| CVE-2022-2111 | Unrestricted Upload of File with Dangerous Type in inventree/inventreeinventree · inventree/inventree | Critical9.0 |