Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 1 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,298All CVEsplus 19,140 rejected
- 452Last 24 hours2,722 in the last 7 days
- 16,914Last 30 days1,557 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 1 | 7 | 9 | 0 | 0 | 17 | 21 |
| 2025 | 0 | 0 | 1 | 0 | 0 | 1 | 4 |
| 2024 | 0 | 1 | 0 | 0 | 0 | 1 | 3 |
| 2023 | 0 | 1 | 0 | 0 | 0 | 1 | 2 |
| 2022 | 0 | 1 | 0 | 0 | 0 | 1 | 1 |
| Title | ||
|---|---|---|
| CVE-2026-120489 | Outline before 1.12.0 Incorrect Authorization via authorizeDocumentPublish() Detached DraftOutline · Outline | Medium5.3 |
| CVE-2026-120449 | Outline before 1.12.0 Improper Access Control via Public Document SharesOutline · Outline | Medium6.9 |
| CVE-2026-113611 | Outline before 1.8.0 Information Disclosure via Orphaned Webhook Subscriptionsoutline · outline | Medium6.9 |
| CVE-2026-54573 | Authorization Bypass in API Key/OAuth Scopes via Path Parsing Discrepancyoutline · outline | Medium5.3 |
| CVE-2026-44695 | Outline: Slack OAuth state can link a victim Outline account to an attacker Slack identityoutline · outline | Medium5.8 |
| CVE-2026-43889 | Outline: Unauthorized Document Publication via Mixed collectionId+documentId Shareoutline · outline | Medium6.5 |
| CVE-2026-43888 | Outline: Zip Extraction Path Escape via PATH_MAX Truncation in Collection Importoutline · outline | High8.7 |
| CVE-2026-43890 | Outline: IDOR in subscriptions.create allows cross-tenant subscription on private documents (sibling of GHSA-23jj-rp48-w7q7)outline · outline | High7.7 |
| CVE-2026-43886 | Outline: OAuth Scope Validation Logic Error Allows Privilege Escalation to Wildcard API Accessoutline · outline | High8.2 |
| CVE-2026-43887 | Outline: Stored XSS via Comment Mentionsoutline · outline | High7.3 |
| CVE-2026-41649 | Outline has IDOR in document share creation that allows unauthorized access to private documents across workspacesoutline · outline | High7.7 |
| CVE-2026-33640 | Outline has a rate limit bypass that allows brute force of email login OTPoutline · outline | Critical9.1 |
| CVE-2026-28506 | Outline's Information Disclosure in Activity Logs allows User Enumeration of Private Draftsoutline · outline | Medium4.3 |
| CVE-2026-24901 | Outline's IDOR allows unauthorized viewing and seizing of private deleted draftsoutline · outline | High8.1 |
| CVE-2025-68663 | Outline has a suspended user authentication bypass via WebSocket connectionsoutline · outline | Medium6.9 |
| CVE-2025-64487 | Outline is vulnerable to privilege escalation vulnerability in document sharingoutline · outline | High7.6 |
| CVE-2026-25062 | Outline Affected an Arbitrary File Read via Path Traversal in JSON Importoutline · outline | Medium5.5 |
| CVE-2025-58351 | Outline's Local File Storage Feature can Cause CSP Bypassoutline · outline | Medium6.8 |
| CVE-2024-40626 | Stored Cross-site Scripting (XSS) vulnerability in Outline editoroutline · outline | High7.3 |
| CVE-2023-3532 | Cross-site Scripting (XSS) - Stored in outline/outlineoutline · outline/outline | High8.5 |
| CVE-2022-2342 | Cross-site Scripting (XSS) - Stored in outline/outlineoutline · outline/outline | High7.3 |