Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 6 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 400,943All CVEsplus 19,118 rejected
- 382Last 24 hours2,817 in the last 7 days
- 16,800Last 30 days1,547 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 0 | 5 | 2 | 1 | 0 | 8 | 13 |
| 2025 | 0 | 3 | 2 | 0 | 0 | 5 | 5 |
| Title | ||
|---|---|---|
| CVE-2026-104269 | ModSecurity: RFC 2231 `filename*` Parameter Bypasses Multipart Filename Rules on RFC-Compliant Backends (Go, Python, Node, Java)owasp-modsecurity · ModSecurity | High8.6 |
| CVE-2026-73856 | ModSecurity: Response Body Inspection Bypassowasp-modsecurity · ModSecurity | High8.6 |
| CVE-2026-61813 | ModSecurity: Incorrect libcurl TLS hostname verification setting in HttpsClient::downloadowasp-modsecurity · ModSecurity | Low3.7 |
| CVE-2026-103932 | ModSecurity: PCRE2 `@rxGlobal` match-limit errors are converted to no-matchowasp-modsecurity · ModSecurity | Medium5.8 |
| CVE-2026-52747 | ModSecurity: Multipart form-data parser silently strips embedded line breaks from form-field values, enabling request-body inspection bypassowasp-modsecurity · ModSecurity | High8.6 |
| CVE-2026-52761 | ModSecurity: Transformation utf8toUnicode produces wrong output on i386 architectureowasp-modsecurity · ModSecurity | Medium5.8 |
| CVE-2026-42268 | ModSecurity: Unsigned integer underflow in @verifySSN / @verifyCPF / @verifySVNR operatorsowasp-modsecurity · ModSecurity | High8.2 |
| CVE-2026-30923 | libModSecurity3 denial of service via segfault when using t:hexDecode on single-character query stringsowasp-modsecurity · ModSecurity | High8.2 |
| CVE-2025-54571 | ModSecurity's Insufficient Return Value Handling can Lead to XSS and Source Code Disclosureowasp-modsecurity · ModSecurity | Medium6.9 |
| CVE-2025-52891 | ModSecurity empty XML tag causes segmentation faultowasp-modsecurity · ModSecurity | Medium6.5 |
| CVE-2025-48866 | ModSecurity has possible DoS vulnerability in sanitiseArg actionowasp-modsecurity · ModSecurity | High7.5 |
| CVE-2025-47947 | ModSecurity Has Possible DoS Vulnerabilityowasp-modsecurity · ModSecurity | High7.5 |
| CVE-2025-27110 | Libmodsecurity3 has possible bypass of encoded HTML entitiesowasp-modsecurity · ModSecurity | High7.9 |