Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 1 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,094All CVEsplus 19,119 rejected
- 503Last 24 hours2,830 in the last 7 days
- 16,881Last 30 days1,552 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 6 | 13 | 19 | 3 | 0 | 41 | 42 |
| 2025 | 0 | 0 | 0 | 0 | 0 | 0 | 1 |
| 2024 | 0 | 0 | 1 | 0 | 0 | 1 | 1 |
| Title | ||
|---|---|---|
| CVE-2026-116196 | Rclone before v1.75.2 B2 Credential Leak on Redirect via --b2-download-urlrclone · rclone | Medium6.0 |
| CVE-2026-116195 | Rclone before 1.75.2 Path Traversal via translateLink .rclonelink Suffix Trimrclone · rclone | High7.0 |
| CVE-2026-116194 | Rclone 1.52.0 before 1.75.2 CSRF via pCloud OAuth Callbackrclone · rclone | High7.6 |
| CVE-2026-116193 | Rclone 1.64.0 before 1.75.2 serve webdav Authentication Bypass via OPTIONS Requestsrclone · rclone | Medium6.9 |
| CVE-2026-116192 | rclone from 1.37 before 1.74.2 SSRF via --rc-serve scheme-relative remote rootsrclone · rclone | High8.2 |
| CVE-2026-116191 | Rclone before 1.75.2 Path Traversal via serve webdav MKCOLrclone · rclone | High8.7 |
| CVE-2026-116190 | rclone v1.56.0 before v1.75.2 WebDAV Credential Header Leak on Redirectrclone · rclone | Medium6.3 |
| CVE-2026-116189 | rclone 1.55.0 before 1.75.2 selfupdate Signature Verification Bypass via SHA256SUMSrclone · rclone | High7.7 |
| CVE-2026-116188 | rclone serve s3 1.75.0 before 1.75.2 Memory Limit Bypass via Multipart Overflowrclone · rclone | Medium6.9 |
| CVE-2026-116187 | Rclone v1.68.0 before v1.75.2 Authorization Bypass in serve s3 Multipart Uploadsrclone · rclone | Medium6.1 |
| CVE-2026-93987 | rclone serve docker Path Traversal via Volume Namerclone · rclone | Medium4.6 |
| CVE-2026-93986 | rclone before 1.75.1 Path Traversal via Directory Listing Namesrclone · rclone | Low2.3 |
| CVE-2026-88046 | rclone: source object names can escape the configured root on uploadrclone · rclone | Medium5.3 |
| CVE-2026-88045 | rclone: S3 multipart declared-length memory exhaustionrclone · rclone | High7.5 |
| CVE-2026-88044 | rclone: RC per-server auth-proxy bypassrclone · rclone | Critical9.1 |
| CVE-2026-88018 | rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypassrclone · rclone | Critical9.8 |
| CVE-2026-88017 | rclone: FTP cross-session auth-proxy backend confusionrclone · rclone | High7.3 |
| CVE-2026-88016 | rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destinationrclone · rclone | High7.1 |
| CVE-2026-88015 | rclone local: crafted Range request against a translated symlink panics (DoS)rclone · rclone | Medium5.3 |
| CVE-2026-88014 | rclone archive/zip: Zip Slip via unsanitized zip entry names lets a malicious archive escape its own namespacerclone · rclone | Medium6.3 |
| CVE-2026-88013 | rclone: http backend forwards custom/auth headers to a different host on redirectrclone · rclone | Low3.7 |
| CVE-2026-79783 | rclone before 1.74.4 Privilege Escalation via setuid Metadatarclone · rclone | Low2.0 |
| CVE-2026-79782 | rclone before 1.74.4 Security Token Disclosure via HTTPS to HTTP Redirectrclone · rclone | Critical9.3 |
| CVE-2026-79781 | rclone serve s3 Path Traversal via dot-dot object keysrclone · rclone | Medium6.9 |
| CVE-2026-79780 | rclone before v1.75.0 Credential Exposure via S3 Redirectrclone · rclone | Medium6.0 |
| CVE-2026-79779 | rclone before v1.75.0 WebDAV Credential Exposure via HTTPS-to-HTTP Redirectrclone · rclone | Medium6.0 |
| CVE-2026-79778 | rclone before v1.75.0 Denial of Service via TUS nil-response panicrclone · rclone | Medium6.0 |
| CVE-2026-79777 | rclone before v1.75.0 Information Disclosure via RC APIrclone · rclone | Medium5.1 |
| CVE-2026-79776 | rclone before 1.75.0 Authentication Bypass via pprofrclone · rclone | Medium6.9 |
| CVE-2026-79775 | rclone Archive Backend SquashFS Parser Denial of Servicerclone · rclone | High7.1 |
| CVE-2026-71313 | rclone: Local Encoding Path Traversalrclone · rclone | Medium6.9 |
| CVE-2026-71312 | rclone: PowerShell Smart-Quote Filename Injection Enables SFTP Server-Side Command Executionrclone · rclone | High8.0 |
| CVE-2026-71311 | rclone: FTP Command Arguments Permit CRLF Injection When Custom Encoding Preserves Newlinesrclone · rclone | Medium6.4 |
| CVE-2026-71310 | rclone: Unbounded HTTP CONNECT Response Headers Can Exhaust rclone Memoryrclone · rclone | Medium5.9 |
| CVE-2026-71309 | rclone: Incomplete path validation allows backend root escape in serve resticrclone · rclone | High8.6 |
| CVE-2026-59733 | rclone `serve restic --private-repos` authorization bypass: `..` in the URL path lets an authenticated user read, overwrite and delete other users' repositoriesrclone · rclone | High8.8 |
| CVE-2026-54572 | rclone: Unvalidated symlink target in local `--links` — arbitrary file write from an untrusted remoterclone · rclone | High7.5 |
| CVE-2026-59732 | rclone archive extract allows S3 destination prefix escape via crafted archive pathsrclone · rclone | Medium5.0 |
| CVE-2026-49980 | Rclone: Unauthenticated command execution in `rclone rcd --rc-serve` via inline remote instantiation, bypassing CVE-2026-41179 fixrclone · rclone | Critical9.8 |
| CVE-2026-41179 | RClone: Unauthenticated operations/fsinfo allows attacker-controlled backend instantiation and local command executionrclone · rclone | Critical9.2 |
| CVE-2026-41176 | Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command executionrclone · rclone | Critical9.2 |
| CVE-2024-52522 | Rclone Improper Permission and Ownership Handling on Symlink Targets with --links and --metadatarclone · rclone | Medium5.4 |