Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 4 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,273All CVEsplus 19,140 rejected
- 463Last 24 hours2,741 in the last 7 days
- 16,922Last 30 days1,555 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 7 | 14 | 9 | 3 | 0 | 33 | 38 |
| 2025 | 0 | 2 | 0 | 0 | 0 | 2 | 5 |
| 2024 | 1 | 0 | 0 | 0 | 0 | 1 | 3 |
| 2023 | 0 | 0 | 0 | 0 | 0 | 0 | 2 |
| 2022 | 0 | 0 | 0 | 0 | 0 | 0 | 2 |
| 2021 | 0 | 0 | 0 | 0 | 0 | 0 | 2 |
| 2020 | 0 | 0 | 0 | 0 | 0 | 0 | 2 |
| 2019 | 0 | 0 | 2 | 0 | 0 | 2 | 2 |
| Title | ||
|---|---|---|
| CVE-2026-55614 | uhttpd vulnerable to HTTP request smuggling via case-sensitive Transfer-Encoding matchingopenwrt · uhttpd | Medium6.9 |
| CVE-2026-55612 | uhttpd vulnerable to HTTP request smuggling via invalid chunk-length state resetopenwrt · uhttpd | Low3.7 |
| CVE-2026-55613 | uhttpd: HTTP request smuggling via ubus POST body parse-error desyncopenwrt · uhttpd | Medium6.9 |
| CVE-2026-55606 | odhcpd: Stack buffer overread via DUID length endianness mismatch in memcmp()openwrt · odhcpd | Medium6.5 |
| CVE-2026-53918 | odhcpd DHCPv6 IA dangling first pointer use-after-freeopenwrt · odhcpd | High8.8 |
| CVE-2026-53920 | odhcpd DHCPv6 Short IA_NA/IA_PD Body Stack Disclosureopenwrt · odhcpd | High8.7 |
| CVE-2026-53921 | odhcpd: Stack buffer overflow in DHCPv6 IA reply serialization (2 independent sites)openwrt · odhcpd | Critical9.8 |
| CVE-2026-53922 | odhcpd: pre-auth remote DoS via size_t underflow in dhcpv6_ia_handle_IAs (stack BOF, canary-terminated)openwrt · odhcpd | Medium6.5 |
| CVE-2026-55897 | luci-app-advanced-reboot read ACL exposes /bin/sh through file.exec, allowing delegated users to run commands as rootopenwrt · luci | High8.8 |
| CVE-2026-55159 | luci-app-adblock-fast: Delegated `luci-app-adblock-fast` users can reach root command execution by injecting newline-separated cron entriesopenwrt · luci-app-adblock-fast | High8.8 |
| CVE-2026-62381 | luci-lib-px5g 2040-bit Certificate Signing Heap Buffer Overflowopenwrt · luci | Medium6.9 |
| CVE-2026-72842 | OpenWrt luci-app-lxc ACL Inconsistency Authentication Bypassopenwrt · luci | Critical9.4 |
| CVE-2026-72841 | luci-app-openvpn Path Traversal RCE via instance_name2openwrt · luci | Critical9.4 |
| CVE-2026-72840 | OpenWrt LuCI luci-mod-system-mounts ACL Root RCE via Crontab Writeopenwrt · luci | High8.7 |
| CVE-2026-69096 | OpenWrt luci-app-dockerman Read ACL Remote Code Executionopenwrt · luci | High8.7 |
| CVE-2026-69095 | OpenWrt luci-app-bmx7 Path Traversal via bmx7-infoopenwrt · luci | High8.7 |
| CVE-2026-68583 | luci-app-adblock-fast before 1.2.4-4 Stored XSS via file_url.nameopenwrt · luci | Medium5.1 |
| CVE-2026-67352 | luci-app-https-dns-proxy Stored XSS via resolver_urlopenwrt · luci | Medium6.8 |
| CVE-2026-62947 | OpenWrt: ACL bypass and arbitrary root file read via cgi-io cgi-downloadopenwrt · openwrt | Medium4.9 |
| CVE-2026-62948 | OpenWrt odhcpd/LuCI: unauthenticated DHCPv6 client can inject lease-file lines via FQDN hostname → stored XSS in the LuCI admin UIopenwrt · openwrt | Critical9.6 |
| CVE-2026-62184 | luci-app-banip Log Monitor IP Extraction Bypassopenwrt · luci-app-banip | High8.7 |
| CVE-2026-61876 | LuCI DHCPv6 Lease Hostname Stored Cross-Site Scriptingopenwrt · luci | Critical9.4 |
| CVE-2026-61875 | luci-app-upnp Stored XSS via UPnP Port Mapping Descriptionopenwrt · luci | High8.7 |
| CVE-2026-59260 | OpenWrt luci-app-samba4 read ACL remote code execution via smbdopenwrt · luci | High8.7 |
| CVE-2026-55490 | OpenWrt: EAD Integer Underflow → Pre-Auth Denial of Serviceopenwrt · openwrt | Medium6.5 |
| CVE-2026-58652 | luci-app-travelmate - Arbitrary Command Execution via UCI Script Parameteropenwrt · luci-app-travelmate | High7.7 |
| CVE-2026-58000 | luci-proto-openvpn - Command Injection via cl_meta Parameter in generateKeyopenwrt · luci-proto-openvpn | High8.7 |
| CVE-2026-57999 | luci-app-tailscale-community - Command Injection via tailscale.do_login RPCopenwrt · luci-app-tailscale-community | High7.7 |
| CVE-2026-32721 | LuCI luci-mod-network: Possible XSS attack in WiFi scan on Joining Wireless Client modalopenwrt · luci | High8.6 |
| CVE-2026-30874 | OpenWrt procd PATH Environment Variable Filter Bypass via Incorrect String Comparison Leads to Privilege Escalationopenwrt · openwrt | Low1.8 |
| CVE-2026-30873 | OpenWrt Project jsonpath: Memory leak when processing strings, labels, and regexp tokensopenwrt · openwrt | Low2.4 |
| CVE-2026-30872 | OpenWrt Project has a Stack-based Buffer Overflow vulnerability via IPv6 reverse DNS lookupopenwrt · openwrt | Critical9.5 |
| CVE-2026-30871 | OpenWrt Project has Stack-based Buffer Overflow in DNS PTR Queryopenwrt · openwrt | Critical9.5 |
| CVE-2025-62526 | OpenWrt ubusd vulnerable to heap buffer overflowopenwrt · openwrt | High7.9 |
| CVE-2025-62525 | OpenWrt vulnerable to local privilage escalationopenwrt · openwrt | High7.9 |
| CVE-2024-54143 | openwrt/asu allows build artifact poisoning via truncated SHA-256 hash and command injectionopenwrt · asu | Critical9.3 |
| CVE-2019-5102 | An exploitable information leak vulnerability exists in the ustream-ssl library of OpenWrt, versions 18.06.4 and 15.05.1. When connecting to a remote server,…OpenWRT · OpenWRT | Medium4.0 |
| CVE-2019-5101 | An exploitable information leak vulnerability exists in the ustream-ssl library of OpenWrt, versions 18.06.4 and 15.05.1. When connecting to a remote server,…OpenWRT · OpenWRT | Medium4.0 |