Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 8 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,644All CVEsplus 19,141 rejected
- 674Last 24 hours2,957 in the last 7 days
- 17,129Last 30 days1,607 of them critical
- 1,769Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 5 | 7 | 8 | 2 | 0 | 22 | 22 |
| Title | ||
|---|---|---|
| CVE-2026-75525 | OpenReception: unauthenticated ML-KEM key injection into the staff-crypto recipient directory in any tenantopen-reception · appointment-booking-software | Medium5.3 |
| CVE-2026-75524 | OpenReception: race condition in add-to-tunnel and create-new-client allows overlapping appointments for one agentopen-reception · appointment-booking-software | Medium5.4 |
| CVE-2026-65825 | OpenReception: one tenant's throttle row disables the PIN brute-force throttle for the same identifier in other tenantsopen-reception · appointment-booking-software | High7.5 |
| CVE-2026-65824 | OpenReception: invite confirmation token is replayable within its validity window and re-issues a registration-bootstrap cookieopen-reception · appointment-booking-software | High7.4 |
| CVE-2026-58202 | OpenReception: Confirmation-email links built from the request Host enable pending-account takeover via `POST /api/auth/resend-confirmation`open-reception · appointment-booking-software | High8.3 |
| CVE-2026-54460 | OpenReception: Unauthenticated WebAuthn passkey injection via `POST /api/auth/passkeys` leads to account takeoveropen-reception · appointment-booking-software | Critical9.8 |
| CVE-2026-48088 | OpenReception vulnerable to unauthenticated staff crypto poisoning that breaks E2E recipient directoryopen-reception · appointment-booking-software | Critical9.4 |
| CVE-2026-48087 | OpenReception: WebAuthn passkey injection allows account takeoveropen-reception · appointment-booking-software | Critical9.8 |
| CVE-2026-48086 | OpenReception: Tenant admin self-promotes to GLOBAL_ADMINopen-reception · appointment-booking-software | Critical9.9 |
| CVE-2026-48085 | OpenReception has unauthenticated GLOBAL_ADMIN account creation post-bootstrapopen-reception · appointment-booking-software | Critical9.8 |
| CVE-2026-48084 | OpenReception doesn't rate limit passphrase login attemptsopen-reception · appointment-booking-software | High7.4 |
| CVE-2026-48083 | OpenReception: Unauthenticated POST /api/log accepts arbitrary content with CRLF injection and no size or rate limitsopen-reception · appointment-booking-software | Medium6.5 |
| CVE-2026-48082 | OpenReception's bootstrap challenge proof-of-work difficulty hardcoded to 16 bits, which enables abuse rate amplificationopen-reception · appointment-booking-software | Low3.7 |
| CVE-2026-48081 | OpenReception vulnerable to stored click-triggered XSS via javascript: tenant links rendered into patient-facing footeropen-reception · appointment-booking-software | High8.1 |
| CVE-2026-48079 | OpenReception's logout page clears local access_token before server-side revocation, leaving duplicated tokens valid until expiryopen-reception · appointment-booking-software | High7.4 |
| CVE-2026-48078 | OpenReception's schedule endpoint discloses isPublic=false channels and slot availability to unauthenticated callersopen-reception · appointment-booking-software | Medium5.3 |
| CVE-2026-48077 | OpenReception: GET appointment by ID returns full appointment record without authorizationopen-reception · appointment-booking-software | Medium5.3 |
| CVE-2026-48076 | OpenReception's bootstrap booking flow allows unauthenticated booking on isPublic=false channelsopen-reception · appointment-booking-software | Medium6.5 |
| CVE-2026-48075 | OpenReception's unauthenticated add-to-tunnel endpoint accepts arbitrary appointment injectionsopen-reception · appointment-booking-software | Medium6.5 |
| CVE-2026-48074 | OpenReception: Staff deletion removes pending invites cross-tenant by email matchopen-reception · appointment-booking-software | Low2.7 |
| CVE-2026-48071 | OpenReception's client PIN challenge throttle is keyed by emailHash only, allowing cross-tenant lockoutopen-reception · appointment-booking-software | Medium5.8 |
| CVE-2026-48080 | OpenReception's tenant detail endpoint discloses live PostgreSQL connection string, superuser-scoped in the tested official deploymentopen-reception · appointment-booking-software | High8.0 |