Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 6 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 400,449All CVEsplus 18,890 rejected
- 365Last 24 hours2,978 in the last 7 days
- 17,371Last 30 days1,592 of them critical
- 1,767Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 0 | 2 | 7 | 2 | 0 | 11 | 37 |
| 2025 | 0 | 0 | 0 | 0 | 0 | 0 | 26 |
| 2024 | 0 | 0 | 0 | 0 | 0 | 0 | 26 |
| 2023 | 2 | 1 | 2 | 0 | 0 | 5 | 26 |
| 2022 | 2 | 10 | 9 | 0 | 0 | 21 | 21 |
| Title | ||
|---|---|---|
| CVE-2026-115762 | draw.io: Prototype pollution in GraphML (mxGraphMlCodec)jgraph · drawio | Medium6.1 |
| CVE-2026-97373 | draw.io: Incomplete SSRF blocklist in `ProxyServlet` / `Utils.sanitizeUrl`: RFC 6598 CGNAT range `100.64.0.0/10` is not blocked -> server-side request to internal CGNAT hostsjgraph · drawio | Medium5.8 |
| CVE-2026-119333 | draw.io Desktop allows Windows executable search-path hijackingjgraph · drawio-desktop | High7.8 |
| CVE-2026-114606 | draw.io Desktop: Arbitrary local-file read via read-side IPC (no blessed-path gate)jgraph · drawio-desktop | Medium5.6 |
| CVE-2026-76898 | draw.io: Unauthenticated SSRF via IPv6 ULA blocklist bypass in /embed2.jsjgraph · drawio | High7.7 |
| CVE-2026-63373 | draw.io: OAuth CSRF via missing state validation on self-hosted deployments allows session token injectionjgraph · drawio | Medium4.2 |
| CVE-2026-63334 | draw.io: SSRF via DNS rebinding in ProxyServlet bypasses private IP blocklistjgraph · drawio | Medium6.8 |
| CVE-2026-63416 | draw.io: Path traversal in ExportProxyServlet allows access to arbitrary backend endpointsjgraph · drawio | Low3.7 |
| CVE-2026-58504 | draw.io: Stored XSS on file open via editable=0 sibling cell — patch bypass of CVE-2026-46642jgraph · drawio | Medium6.1 |
| CVE-2026-46642 | draw.io: XSS via crafted cell label when opening a .drawio filejgraph · drawio | Medium6.1 |
| CVE-2026-42195 | Unvalidated gitlab URL parameter redirects OAuth authorize step to attacker-controlled hostjgraph · drawio | Low3.4 |
| CVE-2023-3975 | OS Command Injection in jgraph/drawiojgraph · jgraph/drawio | High8.3 |
| CVE-2023-3974 | OS Command Injection in jgraph/drawiojgraph · jgraph/drawio | Critical9.6 |
| CVE-2023-3973 | Cross-site Scripting (XSS) - Reflected in jgraph/drawiojgraph · jgraph/drawio | Critical9.6 |
| CVE-2023-3398 | Denial of Service in jgraph/drawiojgraph · jgraph/drawio | Medium5.3 |
| CVE-2023-3026 | Cross-site Scripting (XSS) - Stored in jgraph/drawiojgraph · jgraph/drawio | Medium6.5 |
| CVE-2022-3873 | Cross-site Scripting (XSS) - DOM in jgraph/drawiojgraph · jgraph/drawio | Medium6.5 |
| CVE-2022-3223 | Cross-site Scripting (XSS) - Stored in jgraph/drawiojgraph · jgraph/drawio | Medium4.3 |
| CVE-2022-3133 | OS Command Injection in jgraph/drawiojgraph · jgraph/drawio | High7.0 |
| CVE-2022-3138 | Cross-site Scripting (XSS) - Generic in jgraph/drawiojgraph · jgraph/drawio | Medium4.3 |
| CVE-2022-3148 | Cross-site Scripting (XSS) - Generic in jgraph/drawiojgraph · jgraph/drawio | Medium5.3 |
| CVE-2022-3127 | Cross-site Scripting (XSS) - Stored in jgraph/drawiojgraph · jgraph/drawio | Medium5.5 |
| CVE-2022-3065 | Improper Access Control in jgraph/drawiojgraph · jgraph/drawio | Medium5.3 |
| CVE-2022-2015 | Cross-site Scripting (XSS) - Stored in jgraph/drawiojgraph · jgraph/drawio | Medium6.1 |
| CVE-2022-2014 | Code Injection in jgraph/drawiojgraph · jgraph/drawio | Critical9.6 |
| CVE-2022-1815 | Exposure of Sensitive Information to an Unauthorized Actor in jgraph/drawiojgraph · jgraph/drawio | Medium5.3 |
| CVE-2022-1784 | Server-Side Request Forgery (SSRF) in jgraph/drawiojgraph · jgraph/drawio | High7.5 |
| CVE-2022-1730 | Cross-site Scripting (XSS) - Stored in jgraph/drawiojgraph · jgraph/drawio | Medium6.3 |
| CVE-2022-1774 | Exposure of Sensitive Information to an Unauthorized Actor in jgraph/drawiojgraph · jgraph/drawio | High8.2 |
| CVE-2022-1767 | Server-Side Request Forgery (SSRF) in jgraph/drawiojgraph · jgraph/drawio | High7.5 |
| CVE-2022-1727 | Improper Input Validation in jgraph/drawiojgraph · jgraph/drawio | High8.3 |
| CVE-2022-1711 | Server-Side Request Forgery (SSRF) in jgraph/drawiojgraph · jgraph/drawio | High7.5 |
| CVE-2022-1723 | Server-Side Request Forgery (SSRF) in jgraph/drawiojgraph · jgraph/drawio | High7.5 |
| CVE-2022-1713 | SSRF on /proxy in jgraph/drawiojgraph · jgraph/drawio | High7.5 |
| CVE-2022-1721 | Path Traversal in WellKnownServlet in jgraph/drawiojgraph · jgraph/drawio | High7.5 |
| CVE-2022-1722 | SSRF in editor's proxy via IPv6 link-local address in jgraph/drawiojgraph · jgraph/drawio | High7.5 |
| CVE-2022-1575 | Arbitrary Code Execution through Sanitizer Bypass in jgraph/drawiojgraph · jgraph/drawio | Critical9.6 |