Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 6 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 400,943All CVEsplus 19,118 rejected
- 382Last 24 hours2,817 in the last 7 days
- 16,800Last 30 days1,547 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 1 | 12 | 36 | 3 | 0 | 52 | 62 |
| 2025 | 0 | 1 | 0 | 0 | 0 | 1 | 10 |
| 2024 | 0 | 1 | 3 | 0 | 0 | 4 | 9 |
| 2023 | 0 | 4 | 1 | 0 | 0 | 5 | 5 |
| Title | ||
|---|---|---|
| CVE-2026-118259 | opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsingopen-telemetry · opentelemetry-java | Medium5.3 |
| CVE-2026-116694 | OpenTelemetry Python: Unbounded memory allocation in Jaeger baggage propagationopen-telemetry · opentelemetry-python | Medium6.3 |
| CVE-2026-114603 | OpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-apiopen-telemetry · opentelemetry-python | Medium5.3 |
| CVE-2026-104872 | Multiple @opentelemetry/instrumentation-* packages expose database username via unconditional db.user span attributeopen-telemetry · opentelemetry-js-contrib | Medium5.8 |
| CVE-2026-81871 | OpenTelemetry-Go: Log gRPC exporter ignores env TLS certs, bypassing mTLS/pinningopen-telemetry · opentelemetry-go | Medium6.3 |
| CVE-2026-81872 | OpenTelemetry-Go: BatchProcessor can busy-spin when export buffer is fullopen-telemetry · opentelemetry-go | Medium6.3 |
| CVE-2026-81869 | OpenTelemetry-Go: UTF-8 replacement rune bypasses attribute length truncationopen-telemetry · opentelemetry-go | Medium5.1 |
| CVE-2026-81870 | OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logsopen-telemetry · opentelemetry-go | Low2.0 |
| CVE-2026-55701 | OpenTelemetry githubreceiver silently ignores configured required_headers authenticationopen-telemetry · opentelemetry-collector-contrib | Medium6.9 |
| CVE-2026-47256 | OpenTelemetry: Path traversal in Sentry exporter via attacker-controlled service.name reaches privileged Sentry API endpoints with operator bearer tokenopen-telemetry · opentelemetry-collector-contrib | Medium5.3 |
| CVE-2026-47701 | OpenTelemetry Operator: ServiceMonitor bearerTokenFile reads arbitrary local file and sends contents as bearer authopen-telemetry · opentelemetry-operator | High7.7 |
| CVE-2026-48496 | opentelemetry-ebpf-profiler: Unprivileged process can trigger a denial of service on the ebpf-profiler agentopen-telemetry · opentelemetry-ebpf-profiler | Medium6.2 |
| CVE-2026-81192 | OpenTelemetry.Resources.Host vulnerable to arbitrary code execution via local PATH hijacking on macOSopen-telemetry · opentelemetry-dotnet-contrib | High7.0 |
| CVE-2026-45404 | OpenTelemetry-Go: Unsynchronized baggage map can panic under concurrent accessopen-telemetry · opentelemetry-go | Medium5.9 |
| CVE-2026-48504 | OpenTelemetry Rust: Unbounded memory allocation in W3C Baggage propagationopen-telemetry · opentelemetry-rust | Medium5.3 |
| CVE-2026-59892 | OpenTelemetry JavaScript: Denial of service in `JaegerPropagator` via unhandled exception on a malformed headeropen-telemetry · opentelemetry-js | High7.5 |
| CVE-2026-54712 | OpenTelemetry Javaagent RMI context propagation allows resource exhaustionopen-telemetry · opentelemetry-java-instrumentation | Medium5.3 |
| CVE-2026-54704 | OpenTelemetry Java Instrumentation: JDBC Auto-Instrumentation Logging Clear-Text Passwordsopen-telemetry · opentelemetry-java-instrumentation | Medium6.5 |
| CVE-2026-54285 | opentelemetry-js: Unbounded memory allocation in W3C Baggage propagationopen-telemetry · opentelemetry-js | Medium5.3 |
| CVE-2026-44967 | opentelemetry-cpp: OTLP HTTP exporters read unbounded HTTP responseopen-telemetry · opentelemetry-cpp | Medium5.3 |
| CVE-2026-45287 | OpenTelemetry-Go's Schema ParseFile leaks file descriptors on each parseopen-telemetry · go.opentelemetry.io/otel/schema/v1.1 | Low2.1 |
| CVE-2026-41178 | OpenTelemetry-Go's baggage parsing no longer caps raw header lengthopen-telemetry · go.opentelemetry.io/otel/baggage | Medium5.3 |
| CVE-2026-45686 | OpenTelemetry eBPF Instrumentation: Memcached payload length overflow can crash OBIopen-telemetry · opentelemetry-ebpf-instrumentation | High7.5 |
| CVE-2026-45685 | OpenTelemetry eBPF Instrumentation: MongoDB parser panics on malformed wire messagesopen-telemetry · opentelemetry-ebpf-instrumentation | High7.5 |
| CVE-2026-45684 | OpenTelemetry eBPF Instrumentation: Log enricher writev path can overread and overwrite user buffersopen-telemetry · opentelemetry-ebpf-instrumentation | Medium4.9 |
| CVE-2026-45683 | OpenTelemetry eBPF Instrumentation: Java TLS ioctl kprobe allows kernel memory disclosureopen-telemetry · opentelemetry-ebpf-instrumentation | Low3.8 |
| CVE-2026-45681 | OpenTelemetry eBPF Instrumentation: CPU-mismatch fallback uses 256-byte buffer with 8KB sizeopen-telemetry · opentelemetry-ebpf-instrumentation | Medium5.9 |
| CVE-2026-45680 | OpenTelemetry eBPF Instrumentation: Unbounded BPF internal metrics replay can exhaust CPUopen-telemetry · opentelemetry-ebpf-instrumentation | Medium5.9 |
| CVE-2026-45679 | OpenTelemetry eBPF Instrumentation: Redis error text is exported in span status messagesopen-telemetry · opentelemetry-ebpf-instrumentation | Medium6.5 |
| CVE-2026-45678 | OpenTelemetry eBPF Instrumentation: Postgres BIND parsing can panic on malformed payloadsopen-telemetry · opentelemetry-ebpf-instrumentation | High7.5 |
| CVE-2026-45676 | OpenTelemetry eBPF Instrumentation: Unsafe fastelf parsing allows malformed ELF to crash agentopen-telemetry · opentelemetry-ebpf-instrumentation | Medium5.5 |
| CVE-2026-45682 | OpenTelemetry eBPF Instrumentation: CappedConcurrentHashMap leaks keys after removalsopen-telemetry · opentelemetry-ebpf-instrumentation | Medium5.1 |
| CVE-2026-45292 | opentelemetry-java: Unbounded Memory Allocation in W3C Baggage Propagationopen-telemetry · opentelemetry-java | Medium5.3 |
| CVE-2026-44902 | opentelemetry-js: Prometheus exporter process crash via malformed HTTP requestopen-telemetry · opentelemetry-js | High7.5 |
| CVE-2026-44213 | OpenTelemetry.Exporter.Instana bypasses TLS certificate validation when a proxy is configuredopen-telemetry · opentelemetry-dotnet-contrib | Medium6.5 |
| CVE-2026-42602 | azureauthextension Authenticate method does not validate bearer tokens, allowing auth bypass via replayopen-telemetry · opentelemetry-collector-contrib | High8.1 |
| CVE-2026-42191 | OpenTelemetry.Exporter.OpenTelemetryProtocol: Disk retry default temp path enables local blob injection for OTLP Exporteropen-telemetry · opentelemetry-dotnet | Medium6.5 |
| CVE-2026-42348 | OpAMP client reads unbounded HTTP response bodiesopen-telemetry · opentelemetry-dotnet-contrib | Medium5.9 |
| CVE-2026-41484 | OpenTelemetry.Exporter.OneCollector vulnerable to denial of service via unbounded HTTP error response bodyopen-telemetry · opentelemetry-dotnet-contrib | Medium5.3 |
| CVE-2026-41483 | Unbounded HTTP response body read in OpenTelemetry.Resources.Azureopen-telemetry · opentelemetry-dotnet-contrib | Medium5.9 |
| CVE-2026-41310 | OpenTelemetry .NET Zipkin exporter has unbounded remote endpoint cache leading to memory growthopen-telemetry · opentelemetry-dotnet | Medium5.3 |
| CVE-2026-41433 | OpenTelemetry eBPF Instrumentation: Privileged Java agent injection allows arbitrary host file overwrite via untrusted TMPDIRopen-telemetry · opentelemetry-ebpf-instrumentation | High8.4 |
| CVE-2026-41173 | Unbounded HTTP response body read in OpenTelemetry.Sampler.AWSopen-telemetry · opentelemetry-dotnet-contrib | Medium5.9 |
| CVE-2026-41078 | OpenTelemetry dotnet: Potential memory exhaustion via unbounded pooled-list sizing in Jaeger exporter conversion pathopen-telemetry · opentelemetry-dotnet | Medium5.9 |
| CVE-2026-40894 | OpenTelemetry dotnet: Excessive memory allocation when parsing OpenTelemetry propagation headersopen-telemetry · opentelemetry-dotnet | Medium5.3 |
| CVE-2026-40891 | OpenTelemetry dotnet: Unbounded `grpc-status-details-bin` parsing in OTLP/gRPC retry handlingopen-telemetry · opentelemetry-dotnet | Medium5.3 |
| CVE-2026-40182 | OpenTelemetry dotnet: OTLP exporter reads unbounded HTTP response bodiesopen-telemetry · opentelemetry-dotnet | Medium5.3 |
| CVE-2026-39883 | OpenTelemetry-Go has an incomplete fix for CVE-2026-24051: BSD kenv command not using absolute path enables PATH hijackingopen-telemetry · opentelemetry-go | High7.3 |
| CVE-2026-39882 | OpenTelemetry-Go OTLP HTTP exporters read unbounded HTTP response bodiesopen-telemetry · opentelemetry-go | Medium5.3 |
| CVE-2026-29181 | OpenTelemetry-Go multi-value `baggage` header extraction causes excessive allocations (remote dos amplification)open-telemetry · opentelemetry-go | High7.5 |