Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 4 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,293All CVEsplus 19,140 rejected
- 449Last 24 hours2,722 in the last 7 days
- 16,914Last 30 days1,557 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 3 | 9 | 4 | 2 | 0 | 18 | 18 |
| Title | ||
|---|---|---|
| CVE-2026-63224 | OpenRemote has authenticated SQL injection in crosstab datapoint exportsopenremote · openremote | High7.2 |
| CVE-2026-116186 | OpenRemote before 1.31.0 Gateway Authorization Bypass via Reversible mapAssetIdopenremote · core | Low2.3 |
| CVE-2026-116185 | OpenRemote before 1.31.0 Cross-Realm Information Disclosure via getGatewayActiveTunnelInfosopenremote · core | Medium5.3 |
| CVE-2026-116184 | OpenRemote before 1.31.0 Cross-Realm Gateway Impersonation via Websocketopenremote · core | Low2.1 |
| CVE-2026-114661 | OpenRemote 1.2.0 before 1.31.0 Missing Authorization in Gateway Tunnel Endpointsopenremote · openremote | Critical9.0 |
| CVE-2026-54641 | OpenRemote: Cross-Realm User Information Disclosure in UserResourceImplopenremote · openremote | High7.7 |
| CVE-2026-54640 | OpenRemote: XXE in KNXProtocol.startAssetImport() allows arbitrary file read via unprotected XMLInputFactoryopenremote · openremote | High7.6 |
| CVE-2026-49439 | OpenRemote read-only asset users can write predicted datapointsopenremote · openremote | Medium4.3 |
| CVE-2026-81679 | OpenRemote before 1.28.0 Cross-Realm Information Disclosure via Notification APIopenremote · openremote | High8.3 |
| CVE-2026-73616 | OpenRemote Notification Delete Cross-Realm Insecure Direct Object Referenceopenremote · openremote | High7.1 |
| CVE-2026-67310 | openremote before 1.27.0 Cross-Tenant IDOR via setAssetLinksopenremote · openremote | Medium5.3 |
| CVE-2026-66013 | OpenRemote before 1.26.2 Authentication Bypass via Console Registrationopenremote · openremote | Critical9.3 |
| CVE-2026-65009 | OpenRemote before 1.26.2 Information Disclosure via Syslog REST APIopenremote · openremote | Medium5.3 |
| CVE-2026-62238 | OpenRemote < 1.26.0 SQL Injection via Crosstab Exportopenremote · openremote | High7.2 |
| CVE-2026-56784 | OpenRemote < 1.25.0 IDOR via Bulk Alarm Deletion Endpointopenremote · openremote | High8.6 |
| CVE-2026-40882 | OpenRemote has XXE in Velbus Asset Importopenremote · openremote | High7.6 |
| CVE-2026-41166 | OpenRemote has Improper Access Control via updateUserRealmRoles functionopenremote · openremote | High7.0 |
| CVE-2026-39842 | OpenRemote is Vulnerable to Expression Injectionopenremote · openremote | Critical10.0 |