Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 5 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,167All CVEsplus 19,120 rejected
- 475Last 24 hours2,785 in the last 7 days
- 16,854Last 30 days1,538 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 1 | 5 | 5 | 0 | 0 | 11 | 17 |
| 2025 | 0 | 0 | 3 | 0 | 0 | 3 | 6 |
| 2024 | 0 | 0 | 3 | 0 | 0 | 3 | 3 |
| Title | ||
|---|---|---|
| CVE-2026-93389 | LiteSpeed Cache <= 7.9.1 - Unauthenticated Sensitive Information Disclosure (WooCommerce Store API Cart/Checkout PII + Cart-Token) via Public REST Cachinglitespeedtech · LiteSpeed Cache | High8.2 |
| CVE-2026-119559 | OpenLiteSpeed through 1.9.4 mTLS Bypass via HTTP/3 SNI and Host Mismatchlitespeedtech · openlitespeed | High8.2 |
| CVE-2026-116763 | LiteSpeed Cache <= 7.9.1 - Unauthenticated Stored Cross-Site Scripting via HTML Minifier Predictable Placeholder (md5(REQUEST_TIME) + two-pass str_replace)litespeedtech · LiteSpeed Cache | Medium5.4 |
| CVE-2026-109215 | LiteSpeed Cache <= 7.9.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via VPI Image Attribute Re-Serializationlitespeedtech · LiteSpeed Cache | Medium6.4 |
| CVE-2026-115482 | In lsquic before 4.9.0, the HTTP/3 implementation can use an excessive amount of memory because the number of buffered header sets is not limited, as…litespeedtech · lsquic | High7.5 |
| CVE-2026-104474 | OpenLiteSpeed before 1.9.3 Local Privilege Escalation via lsup.sh Auto-Updatelitespeedtech · openlitespeed | Medium5.4 |
| CVE-2026-93903 | LiteSpeed Web Server (LSWS) before 6.3.7 build 1 mishandles internal redirect URL validation in a certain "corner case" of %252e%252e double decoding, letting…litespeedtech · LiteSpeed Web Server | Critical9.4 |
| CVE-2026-76579 | LiteSpeed Cache <= 7.9 - Reflected Cross-Site Scripting via ESI 'esi' Parameterlitespeedtech · LiteSpeed Cache | Medium4.7 |
| CVE-2026-3129 | LiteSpeed Cache <= 7.7 - Authenticated (Author+) Stored Cross-Site Scripting via img Tag Attributeslitespeedtech · LiteSpeed Cache | Medium6.4 |
| CVE-2026-18978 | LiteSpeed Cache <= 7.8.1 - Unauthenticated Stored Cross-Site Scripting via Comment Contentlitespeedtech · LiteSpeed Cache | High7.2 |
| CVE-2026-3375 | LiteSpeed Cache <= 7.7 - Unauthenticated Stored Cross-Site Scripting via QUIC.cloud CCSS/UCSS REST API Endpointslitespeedtech · LiteSpeed Cache | High7.2 |
| CVE-2025-12450 | LiteSpeed Cache <= 7.5.0.1 - Reflected Cross-Site Scriptinglitespeedtech · LiteSpeed Cache | Medium6.1 |
| CVE-2025-54939 | LiteSpeed QUIC (LSQUIC) Library before 4.3.1 has an lsquic_engine_packet_in memory leak.litespeedtech · LSQUIC | Medium5.3 |
| CVE-2025-24947 | A hash collision vulnerability (in the hash table used to manage connections) in LSQUIC (aka LiteSpeed QUIC) before 4.2.0 allows remote attackers to cause a…litespeedtech · LSQUIC | Medium5.3 |
| CVE-2024-9169 | litespeed cache <= 6.4.1 - Authenticated (Administrator+) Stored Cross-Site Scriptinglitespeedtech · LiteSpeed Cache | Medium5.5 |
| CVE-2024-3246 | LiteSpeed Cache <= 6.2.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scriptinglitespeedtech · LiteSpeed Cache | Medium6.1 |
| CVE-2023-4372 | LiteSpeed Cache <= 5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodelitespeedtech · LiteSpeed Cache | Medium6.4 |