Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 8 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,292All CVEsplus 19,140 rejected
- 451Last 24 hours2,724 in the last 7 days
- 16,915Last 30 days1,557 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 2 | 11 | 14 | 0 | 0 | 27 | 49 |
| 2025 | 2 | 5 | 0 | 0 | 0 | 7 | 22 |
| 2024 | 3 | 1 | 3 | 0 | 0 | 7 | 15 |
| 2023 | 2 | 2 | 2 | 2 | 0 | 8 | 8 |
| Title | ||
|---|---|---|
| CVE-2026-75597 | pyLoad: Unauthenticated access to /web/<path:filename> bypasses authentication on sensitive templates and leaks internal error details via exception attribute typopyload · pyload | Medium5.3 |
| CVE-2026-48484 | pyLoad: Lack of Input Size Validation Leads to Denial of Service (DoS) and Process Terminationpyload · pyload | Medium6.5 |
| CVE-2026-48987 | pyLoad: Unbounded Memory Growth Leading to DoS and Potential DDoS in EventManagerpyload · pyload | Medium6.5 |
| CVE-2026-48737 | pyLoad: SSRF guard bypass via IPv6 6to4/NAT64 transition wrappers of internal IPspyload · pyload | Medium4.9 |
| CVE-2026-45306 | pyLoad: Incomplete Fix for CVE-2026-33509 -storage_folder Bypass via Session Directorypyload · pyload | Medium6.5 |
| CVE-2026-45348 | pyLoad: Stored XSS in Downloads view via unsanitized link URL in packages.js template literalpyload · pyload | High8.7 |
| CVE-2026-46561 | pyLoad: SSRF via HTTP Redirect Bypass in parse_urls APIpyload · pyload | Medium5.0 |
| CVE-2026-44226 | pyLoad: Unauthenticated traceback disclosure via global exception handler in WebUIpyload · pyload | Medium5.3 |
| CVE-2026-42315 | pyLoad: Path Traversal via Package Folder Name in set_package_datapyload · pyload | High8.1 |
| CVE-2026-42314 | pyLoad: Path Traversal via Package Folder Namepyload · pyload | Medium6.5 |
| CVE-2026-42312 | pyload-ng: non-admin SETTINGS users can disable outbound TLS peer verificationpyload · pyload | Medium6.8 |
| CVE-2026-42313 | pyload-ng: non-admin SETTINGS users can redirect all outbound traffic through an attacker-controlled proxypyload · pyload | High8.3 |
| CVE-2026-41133 | pyLoad has Stale Session Privilege After Role/Permission Change (Privilege Revocation Bypass)pyload · pyload | High8.8 |
| CVE-2026-40594 | pyLoad: Session Cookie Security Downgrade via Untrusted X-Forwarded-Proto Header Spoofing (Global State Race Condition)pyload · pyload | Medium4.8 |
| CVE-2026-40071 | pyLoad WebUI JSON permission mismatch lets ADD/DELETE users invoke MODIFY-only actionspyload · pyload | Medium5.4 |
| CVE-2026-35592 | pyLoad has an Incomplete Tar Path Traversal Fix in UnTar._safe_extractall via os.path.commonprefix Bypasspyload · pyload | Medium5.3 |
| CVE-2026-35586 | Authorization Bypass for SSL Certificate/Key Configuration Due to Option Name Mismatch in pyload-ngpyload · pyload | Medium6.8 |
| CVE-2026-35464 | pyLoad has an incomplete fix for CVE-2026-33509: unprotected storage_folder enables arbitrary file write to Flask session store and code executionpyload · pyload | High7.5 |
| CVE-2026-35463 | pyLoad has Improper Neutralization of Special Elements used in an OS Commandpyload · pyload | High8.8 |
| CVE-2026-35459 | pyLoad has SSRF fix bypass via HTTP redirectpyload · pyload | Critical9.3 |
| CVE-2026-35187 | pyLoad has SSRF in parse_urls API endpoint via unvalidated URL parameterpyload · pyload | High7.7 |
| CVE-2026-33992 | pyLoad: Server-Side Request Forgery via Download Link Submission Enables Cloud Metadata Exfiltrationpyload · pyload | Critical9.3 |
| CVE-2026-33511 | pyload-ng: Authentication Bypass via Host Header Injection in ClickNLoadpyload · pyload | High8.8 |
| CVE-2026-33509 | pyload-ng: SETTINGS Permission Users Can Achieve Remote Code Execution via Unrestricted Reconnect Script Configurationpyload · pyload | High7.5 |
| CVE-2026-33314 | pyload-ng: Improper Authentication and Origin Validation Errorpyload · pyload | Medium6.5 |
| CVE-2026-32808 | pyLoad: Arbitrary File Deletion via Path Traversal during Encrypted 7z Password Verificationpyload · pyload | High8.1 |
| CVE-2026-29778 | pyLoad: Arbitrary File Write via Path Traversal in edit_package()pyload · pyload | High7.1 |
| CVE-2025-61773 | pyLoad CNL and captcha handlers allow code Injection via unsanitized parameterspyload · pyload | High8.1 |
| CVE-2025-57751 | Denial-of-Service attack in pyLoad CNL Blueprint using dukpy.evaljspyload · pyload | High7.7 |
| CVE-2025-55156 | PyLoad vulnerable to SQL Injection via API /json/add_package in add_links parameterpyload · pyload | High7.8 |
| CVE-2025-54802 | pyLoad CNL Blueprint is vulnerable to Path Traversal through `dlc_path` leading to Remote Code Execution (RCE)pyload · pyload | Critical9.8 |
| CVE-2025-54140 | pyLoad has Path Traversal Vulnerability in json/upload Endpoint that allows Arbitrary File Writepyload · pyload | High7.5 |
| CVE-2025-53890 | pyLoad vulnerable to remote code execution through js2py onCaptchaResultpyload · pyload | Critical9.8 |
| CVE-2025-7346 | Any unauthenticated attacker can bypass the localhost restrictions posed by the application and utilize this to create arbitrary packagesPyload · Pyload | High8.7 |
| CVE-2024-1240 | Open Redirection in pyload/pyloadpyload · pyload/pyload | Medium4.6 |
| CVE-2024-47821 | pyLoad vulnerable to remote code execution by download to /.pyload/scripts using /flashgot APIpyload · pyload | Critical9.1 |
| CVE-2024-32880 | pyLoad allows upload to arbitrary folder lead to RCEpyload · pyload | Critical9.1 |
| CVE-2024-24808 | pyLoad open redirect vulnerability due to improper validation of the is_safe_url functionpyload · pyload | Medium4.7 |
| CVE-2024-22416 | Cross-Site Request Forgery on any API call in pyLoad may lead to admin privilege escalationpyload · pyload | Critical9.7 |
| CVE-2024-21644 | pyLoad unauthenticated flask configuration leakagepyload · pyload | High7.5 |
| CVE-2024-21645 | pyLoad Log Injectionpyload · pyload | Medium5.3 |
| CVE-2023-0509 | Improper Certificate Validation in pyload/pyloadpyload · pyload/pyload | High7.4 |
| CVE-2023-0488 | Cross-site Scripting (XSS) - Stored in pyload/pyloadpyload · pyload/pyload | Critical9.6 |
| CVE-2023-0435 | Excessive Attack Surface in pyload/pyloadpyload · pyload/pyload | Medium4.0 |
| CVE-2023-0434 | Improper Input Validation in pyload/pyloadpyload · pyload/pyload | Medium5.4 |
| CVE-2023-0297 | Code Injection in pyload/pyloadpyload · pyload/pyload | Critical9.8 |
| CVE-2023-0227 | Insufficient Session Expiration in pyload/pyloadpyload · pyload/pyload | High8.3 |
| CVE-2023-0057 | Improper Restriction of Rendered UI Layers or Frames in pyload/pyloadpyload · pyload/pyload | Low3.1 |
| CVE-2023-0055 | Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in pyload/pyloadpyload · pyload/pyload | Low3.1 |