Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 3 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,933All CVEsplus 19,141 rejected
- 327Last 24 hours3,187 in the last 7 days
- 17,003Last 30 days1,575 of them critical
- 1,769Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 0 | 10 | 13 | 0 | 0 | 23 | 46 |
| 2025 | 0 | 0 | 6 | 2 | 0 | 8 | 23 |
| 2024 | 1 | 2 | 1 | 1 | 0 | 5 | 15 |
| 2023 | 2 | 3 | 3 | 0 | 0 | 8 | 10 |
| 2022 | 1 | 1 | 0 | 0 | 0 | 2 | 2 |
| Title | ||
|---|---|---|
| CVE-2026-59825 | Mastodon: Unwanted deactivation of SSL/TLS certificate verificationmastodon · mastodon | High7.4 |
| CVE-2026-72916 | Mastodon: SSRF Protection Bypass via IPv4-compatible IPv6 Addressesmastodon · mastodon | Medium6.3 |
| CVE-2026-72915 | Mastodon: Personally-identifying information disclosure due to incorrect access control validationmastodon · mastodon | High7.5 |
| CVE-2026-72914 | Mastodon: Exhausting data by an unauthenticated request to the admin retention APImastodon · mastodon | High7.5 |
| CVE-2026-50129 | Mastodon: Persistent anonymous DoS via unhandled NoMethodError in MATH_TRANSFORMERmastodon · mastodon | High7.5 |
| CVE-2026-50128 | Mastodon: Spoofing of attribution domainsPublic exploitmastodon · mastodon | Medium5.3 |
| CVE-2026-48028 | Mastodon: Removal of integrity-protected JSON entries from signed activitiesmastodon · mastodon | Medium6.5 |
| CVE-2026-47389 | Mastodon: SSRF protection bypass on older Ruby versionsmastodon · mastodon | High8.6 |
| CVE-2026-46349 | Mastodon: LD-Signature Bypass via JSON-LD Named-Graph Restructuringmastodon · mastodon | Medium5.3 |
| CVE-2026-46348 | Mastodon: SSRF Bypass via IPv6 Unspecified Address (::)mastodon · mastodon | High8.7 |
| CVE-2026-47777 | Mastodon has a consent-check bypass in its remote Collectionsmastodon · mastodon | High7.5 |
| CVE-2026-41259 | Mastodon: Insufficient verification of email addressesmastodon · mastodon | High8.2 |
| CVE-2026-33869 | Mastodon has a denial of service for quote authorizationmastodon · mastodon | Medium4.8 |
| CVE-2026-33868 | Mastodon has a GET-Based Open Redirect via '/web/%2F<domain>'mastodon · mastodon | Medium4.3 |
| CVE-2026-27477 | Mastodon has SSRF via unvalidated FASP Provider base_urlmastodon · mastodon | Medium4.6 |
| CVE-2026-27468 | Mastodon may allow unconfirmed FASP to make subscriptionsmastodon · mastodon | Medium4.8 |
| CVE-2026-25540 | Mastodon's signature-dependent ActivityPub collection responses cached under signature-independent keys (Web Cache Poisoning via `Rails.cache`)mastodon · mastodon | Medium6.5 |
| CVE-2026-23964 | Mastodon has insufficient access control to push notification settingsmastodon · mastodon | Medium6.5 |
| CVE-2026-23963 | Mastodon missing length limits on list names, filter names, and filter keywordsmastodon · mastodon | Medium4.3 |
| CVE-2026-23962 | Mastodon vulnerable to Denial of Service from a single post (client/server)mastodon · mastodon | High7.5 |
| CVE-2026-23961 | Mastodon may allow a remote suspension bypassmastodon · mastodon | Medium5.3 |
| CVE-2026-22246 | Local Mastodon users can enumerate and access severed relationships of every other local usermastodon · mastodon | Medium6.5 |
| CVE-2026-22245 | Mastodon has SSRF Protection bypassmastodon · mastodon | High7.1 |
| CVE-2025-67500 | Mastodon Error Handling Discrepancy Enables Private Status Existence Enumerationmastodon · mastodon | Low3.7 |
| CVE-2025-62605 | Mastodon quotes control can be bypassedmastodon · mastodon | Medium4.3 |
| CVE-2025-62176 | Mastadon streaming server allows OAuth clients without the `read` scope to subscribe to public channelsmastodon · mastodon | Medium4.3 |
| CVE-2025-62175 | Mastodon streaming API fails to disconnect disabled and suspended usersmastodon · mastodon | Medium4.3 |
| CVE-2025-62174 | Mastodon allows continued access after password reset via CLImastodon · mastodon | Low3.5 |
| CVE-2025-54879 | Mastodon e‑mail throttle misconfiguration allows unlimited email confirmations against unconfirmed emailsPublic exploitmastodon · mastodon | Medium5.3 |
| CVE-2025-27399 | Mastodon's domain blocks & rationales ignore user approval when visibility set as "users"mastodon · mastodon | Medium5.3 |
| CVE-2025-27157 | Mastodon's rate-limits are missing on `/auth/setup`mastodon · mastodon | Medium5.3 |
| CVE-2024-37903 | Mastodon has improper authorship check on audience extension for existing postsmastodon · mastodon | High8.2 |
| CVE-2024-25623 | Lack of media type verification of Activity Streams objects allows impersonation of remote accountsmastodon · mastodon | High8.5 |
| CVE-2024-25619 | Destroying OAuth Applications doesn't notify Streaming of Access Tokens being destroyed in mastodonmastodon · mastodon | Low3.1 |
| CVE-2024-25618 | External OpenID Connect Account Takeover by E-Mail Change in mastodonPublic exploitmastodon · mastodon | Medium4.2 |
| CVE-2024-23832 | Mastodon Remote user impersonation and takeovermastodon · mastodon | Critical9.4 |
| CVE-2023-42452 | Mastodon vulnerable to Stored XSS through the translation featuremastodon · mastodon | Medium6.1 |
| CVE-2023-42451 | Mastodon Invalid Domain Name Normalization vulnerabilitymastodon · mastodon | High7.4 |
| CVE-2023-42450 | Mastodon Server-Side Request Forgery vulnerabilitymastodon · mastodon | Medium5.4 |
| CVE-2023-36462 | Mastodon's verified profile links can be formatted in a misleading waymastodon · mastodon | Medium5.4 |
| CVE-2023-36461 | Mastodon vulnerable to Denial of Service through slow HTTP responsesmastodon · mastodon | High7.5 |
| CVE-2023-36460 | Mastodon vulnerable to arbitrary file creation through media attachmentsmastodon · mastodon | Critical10.0 |
| CVE-2023-36459 | Mastodon vulnerable to Cross-site Scripting through oEmbed preview cardsmastodon · mastodon | Critical9.3 |
| CVE-2023-28853 | Mastodon's blind LDAP injection in login allows the attacker to leak arbitrary attributes from LDAP databasePublic exploitmastodon · mastodon | High7.7 |
| CVE-2022-2166 | Improper Restriction of Excessive Authentication Attempts in mastodon/mastodonPublic exploitmastodon · mastodon/mastodon | Critical9.8 |
| CVE-2022-0432 | Prototype Pollution in mastodon/mastodonmastodon · mastodon/mastodon | High7.4 |