Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 1 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 400,898All CVEsplus 19,118 rejected
- 378Last 24 hours2,800 in the last 7 days
- 16,786Last 30 days1,549 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 10 | 58 | 104 | 3 | 0 | 175 | 182 |
| 2025 | 0 | 2 | 5 | 0 | 0 | 7 | 7 |
| Title | ||
|---|---|---|
| CVE-2026-118173 | MISP Guard Incomplete Tag Validation Allows Non-Allowed Taxonomy Tags to Bypass Feed Policy EnforcementMISP · misp-guard | Medium6.1 |
| CVE-2026-116469 | MISP Guard Case-Sensitive Policy Bypass Allows Unauthorized Feed Data ForwardingMISP · misp-guard | High7.1 |
| CVE-2026-116372 | MISP mispguard: Feed responses with 2xx status codes other than 200 bypass filtering rulesMISP · misp-guard | High7.7 |
| CVE-2026-112991 | MISP html_to_markdown Module SSRF via Incomplete IP Range Blocking in is_safe_url()MISP · misp-modules | Medium6.3 |
| CVE-2026-112192 | MISP Module Settings Expose Redacted Values and Allow API Modification of CLI-Only SettingsMISP · MISP | Medium5.3 |
| CVE-2026-112188 | MISP Server Settings Lookup Exposes Sensitive Configuration Data via Branch Name ResolutionMISP · MISP | High7.1 |
| CVE-2026-112184 | MISP Workflow Module: Reflected XSS via Unescaped misp-modules Parameter Names in Form LabelsMISP · MISP | Medium4.8 |
| CVE-2026-112183 | MISP CSS Injection via Remote Tag Colour in Event PreviewMISP · MISP | Medium4.8 |
| CVE-2026-112180 | MISP Incomplete Event Deletion Leaves Orphaned Sensitive RecordsMISP · MISP | Medium5.1 |
| CVE-2026-112179 | MISP Event Synchronization Exposes Non-Exportable Tags on Remote InstancesMISP · MISP | Medium5.3 |
| CVE-2026-112178 | MISP Proposal ACL Bypass: Incomplete Distribution Level Check in Shadow Attribute Access ControlMISP · MISP | High7.1 |
| CVE-2026-107278 | MISP Object Sync Drops Objects and Attributes When Description Is EmptyMISP · MISP | Medium5.3 |
| CVE-2026-107276 | MISP Email OTP Race Condition Allows One-Time Password to Be Consumed by Multiple Concurrent RequestsMISP · MISP | Medium6.3 |
| CVE-2026-107180 | MISP: Forced TOTP Enrolment Bypassed via Non-Browser Request Types on otp_required InstancesMISP · MISP | High7.1 |
| CVE-2026-107175 | MISP Correlation Engine Fails to Refresh When Event Distribution or Sharing Group ChangesMISP · MISP | Medium5.3 |
| CVE-2026-106513 | MISP: Site-Admin Can Repoint Redis Workers to Attacker-Controlled Server via UI/API Configuration ChangeMISP · MISP | Medium6.9 |
| CVE-2026-106512 | MISP sachertortephp - CakeResponse::download() HTTP Response Splitting via Unsanitized Filename Enables Stored XSSMISP · sachertortephp | High8.4 |
| CVE-2026-104914 | MISP: Soft-Deleted Attributes from Other Organizations Exposed via Attribute Search and Paginated ViewMISP · MISP | Medium5.3 |
| CVE-2026-104912 | MISP Correlation Authorization Bypass Exposes Restricted Event and Attribute DataMISP · MISP | High7.1 |
| CVE-2026-104910 | MISP Information Disclosure via Related Events Listing Bypassing Per-Event AuthorizationMISP · MISP | Medium5.3 |
| CVE-2026-104908 | MISP Decaying Model Import Mass Assignment Allows Cross-Organization Model Overwrite and Default FlaggingMISP · MISP | High7.1 |
| CVE-2026-104907 | MISP: JavaScript Injection via Remote Tag ID in Event Preview Inline HandlerMISP · MISP | Medium4.8 |
| CVE-2026-104906 | MISP TAXII Object Viewer Stored XSS via Unescaped JSON OutputMISP · MISP | Medium6.2 |
| CVE-2026-104901 | MISP ID Translator: Unescaped Remote Event ID Enables Cross-Site Scripting via Linked ServerMISP · MISP | Medium5.1 |
| CVE-2026-104900 | MISP Stored XSS via Unescaped Count Field Value in Remote Event Preview IndexMISP · MISP | Medium5.3 |
| CVE-2026-103858 | MISP Incomplete Thread Authorization Allows Unauthorized Read and Post Access to DiscussionsMISP · MISP | Medium5.3 |
| CVE-2026-103664 | MISP Reflected Cross-Site Scripting via Unsanitized Analyst Data Seed ParameterMISP · MISP | Medium4.8 |
| CVE-2026-103662 | MISP Reflected XSS in Taxonomy Tag Confirmation FormsMISP · MISP | Medium5.1 |
| CVE-2026-103659 | MISP: Object Distribution ACL Bypass via Event Flattening Exposes Organisation-Only AttributesMISP · MISP | High7.1 |
| CVE-2026-103655 | MISP TOTP Code Replay Allows Duplicate Authentication Within Validity PeriodMISP · MISP | Critical9.3 |
| CVE-2026-103651 | MISP HOTP Token Replay via Stale Session-Cached Counter Allows Second-Factor Authentication BypassMISP · MISP | High7.6 |
| CVE-2026-103389 | MISP Stored Cross-Site Scripting via Unvalidated Galaxy Icon Field in Correlation GraphMISP · MISP | Medium6.2 |
| CVE-2026-103388 | MISP Stored Cross-Site Scripting via JavaScript URL in Galaxy Cluster Source FieldMISP · MISP | Medium6.2 |
| CVE-2026-103321 | MISP Stored Cross-Site Scripting (XSS) via Unvalidated Event Graph Preview ImageMISP · MISP | High8.3 |
| CVE-2026-103239 | MISP Tag Collection Save Allows Privilege Escalation via Sibling Model InjectionMISP · MISP | High8.6 |
| CVE-2026-103237 | MISP: Nested Model Alias Key Bypasses Sanitization to Modify Cross-Tenant RowsMISP · MISP | High8.3 |
| CVE-2026-103235 | MISP Event Delegation Mass Assignment Allows Retargeting Delegation to Arbitrary EventsMISP · MISP | High8.7 |
| CVE-2026-97863 | misp-modules: Shell Command Injection in MISP cisco_firesight_manager_ACL_rule_export Module via Unescaped Attribute Valuesmisp · misp-modules | Medium6.3 |
| CVE-2026-95806 | MISP: PHP phar stream wrapper enables deserialization and code execution via caller-influenced filesystem pathsMISP · MISP | High7.7 |
| CVE-2026-95805 | MISP ACLComponent: Typo in previewEventAttributes ACL key bypasses intended access restrictionMISP · MISP | Medium5.3 |
| CVE-2026-95754 | MISP: Disabled-user check ineffective in pre-authentication TOTP login branchMISP · MISP | Medium6.9 |
| CVE-2026-95703 | MISP OrganisationsController File Existence and Image-Type Oracle via Forged Upload tmp_nameMISP · MISP | Medium5.1 |
| CVE-2026-95701 | MISP Path Traversal via Organization Name in Org-Statistics Logo CheckMISP · MISP | Medium5.1 |
| CVE-2026-95698 | MISP Path Traversal in OrgImgHelper findOrgImage via Crafted Organization NameMISP · MISP | Medium5.3 |
| CVE-2026-95697 | MISP: Insufficient Authorization Allows Sharing Group Editors to Overwrite Organization MetadataMISP · MISP | Medium5.3 |
| CVE-2026-95693 | MISP Information Disclosure via Forged Upload PathMISP · MISP | Medium5.3 |
| CVE-2026-95685 | MISP Missing Authorization on replaceSuggestionInReport Event Report ActionMISP · MISP | Medium5.3 |
| CVE-2026-95683 | MISP Overmind Event View Discloses Report Content Bypassing Report-Level ACLMISP · MISP | Medium5.3 |
| CVE-2026-95682 | MISP Stored Cross-Site Scripting via Unescaped Organization Name in Admin Email ViewMISP · MISP | Medium4.8 |
| CVE-2026-95679 | MISP Unauthenticated Blind SSRF via XML Body ProcessingMISP · MISP | Medium6.9 |