Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 5 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,310All CVEsplus 19,140 rejected
- 461Last 24 hours2,731 in the last 7 days
- 16,919Last 30 days1,560 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 4 | 12 | 6 | 0 | 0 | 22 | 23 |
| 2025 | 0 | 0 | 0 | 0 | 0 | 0 | 1 |
| 2024 | 0 | 1 | 0 | 0 | 0 | 1 | 1 |
| Title | ||
|---|---|---|
| CVE-2026-45569 | Roxy-WI: Path-traversal patch in commit d4d10006 is a no-op (tuple-membership bug)roxy-wi · roxy-wi | High8.1 |
| CVE-2026-45567 | Roxy-WI: Authentication bypass via 'api' substring in URL + unauthenticated /api/gptroxy-wi · roxy-wi | High8.3 |
| CVE-2026-45566 | Roxy-WI: Open redirect on /login?next= via basic-auth userinfo syntax bypassroxy-wi · roxy-wi | Medium6.1 |
| CVE-2026-45565 | Roxy-WI: EscapedString validator skips its '..' block when stripping (root cause for several path-traversal/RCE vectors)roxy-wi · roxy-wi | High8.1 |
| CVE-2026-45564 | Roxy-WI: Authenticated RCE via 'configver' URL parameter (os.system sink in /config/versions/.../save)roxy-wi · roxy-wi | High8.8 |
| CVE-2026-45563 | Roxy-WI: IDOR — any authenticated user can read another user's full action historyroxy-wi · roxy-wi | Medium4.3 |
| CVE-2026-45561 | Roxy-WI: SSRF in /smon/agent/<endpoint>/<server_ip> reachable to cloud metadata IPsroxy-wi · roxy-wi | Medium6.5 |
| CVE-2026-45560 | Roxy-WI: Stored XSS in log viewer (wrap_line/highlight_word produce unescaped HTML)roxy-wi · roxy-wi | Medium6.1 |
| CVE-2026-45559 | Roxy-WI: LDAP injection in /user/ldap/<username> (admin-only)roxy-wi · roxy-wi | Medium4.9 |
| CVE-2026-45558 | Roxy-WI: Authenticated RCE on every managed HAProxy load balancer via `option` field config injection in section saveroxy-wi · roxy-wi | Critical9.9 |
| CVE-2026-45556 | Roxy-WI: Authenticated arbitrary file write on every managed load balancer (and downstream RCE) via WAF rule save `config_file_name`roxy-wi · roxy-wi | Critical9.9 |
| CVE-2026-45550 | Roxy-WI: IDOR on PUT /smon/check — any user can rewrite any tenant's monitoring URL/IP/bodyroxy-wi · roxy-wi | Critical9.1 |
| CVE-2026-45549 | Roxy-WI: Authorization bypass on POST /smon/agent/action/<action> — guest can stop or restart smon-agent on any hostroxy-wi · roxy-wi | High8.5 |
| CVE-2026-45552 | Roxy-WI: Cross-tenant authorization bypass on /install/* — guest can run Ansible / SSH on every registered serverroxy-wi · roxy-wi | Critical9.9 |
| CVE-2026-33208 | Roxy-WI Vulnerable to Authenticated Remote Code Execution via OS Command Injection in find-in-config Endpointroxy-wi · roxy-wi | High7.4 |
| CVE-2026-33078 | Roxy-WI has SQL Injection in haproxy_section_save Endpoint via Unsanitized server_ip Parameterroxy-wi · roxy-wi | High8.9 |
| CVE-2026-33077 | Roxy-WI has an arbitrary file read vulnerabilityroxy-wi · roxy-wi | High7.7 |
| CVE-2026-33076 | Roxy-WI vulnerable to path traversal and arbitrary file writingroxy-wi · roxy-wi | High8.9 |
| CVE-2026-33432 | Roxy-WI has Pre-Authentication LDAP Injection that Leads to Authentication Bypassroxy-wi · roxy-wi | High7.7 |
| CVE-2026-33431 | Roxy-WI Vulnerable to Authenticated Arbitrary File Read via Path Traversal in Config Version Viewerroxy-wi · roxy-wi | Medium5.7 |
| CVE-2026-27811 | Roxy-WI has a Command Injection via diff parameter in config comparison allows authenticated RCEroxy-wi · roxy-wi | High8.8 |
| CVE-2026-22265 | Roxy-WI has a Command Injection via grep parameter in logs.py allows authenticated RCEroxy-wi · roxy-wi | High7.5 |
| CVE-2024-43804 | OS Command Injection via Port Scan Functionality in Roxy-WIroxy-wi · roxy-wi | High8.8 |