Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 8 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,293All CVEsplus 19,140 rejected
- 448Last 24 hours2,721 in the last 7 days
- 16,913Last 30 days1,557 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 4 | 14 | 13 | 1 | 0 | 32 | 33 |
| 2025 | 1 | 0 | 0 | 0 | 0 | 1 | 1 |
| Title | ||
|---|---|---|
| CVE-2026-73290 | RustFS: Anonymous ListObjectVersions bypasses RestrictPublicBuckets through the ListBucket fallbackrustfs · rustfs | Medium5.3 |
| CVE-2026-73289 | RustFS: ForAllValues/ForAnyValue negated string conditions are transposed, inverting IAM and bucket-policy decisionsrustfs · rustfs | High8.1 |
| CVE-2026-73288 | RustFS: Object Lock (WORM) protections are treated as absent when bucket metadata cannot be read, allowing retained objects to be deletedrustfs · rustfs | Medium6.1 |
| CVE-2026-73287 | RustFS: FTPS MKD bypasses IAM CreateBucket authorizationrustfs · rustfs | Medium5.4 |
| CVE-2026-73286 | RustF: Request headers can populate server-derived IAM condition keys, letting a caller satisfy identity-based policy conditionsrustfs · rustfs | High8.1 |
| CVE-2026-73285 | RustFS: OPA policy plugin omits ExistingObjectTag conditions, allowing tag-based authorization policies to treat tagged objects as untaggedrustfs · rustfs | High7.5 |
| CVE-2026-73284 | RustFS: AddServiceAccount Handler Allows Creation of Root-Parent Service Accountsrustfs · rustfs | High8.8 |
| CVE-2026-73265 | RustFS: Version-specific object reads authorize the non-version actionrustfs · rustfs | Medium6.5 |
| CVE-2026-62378 | RustFS Console: Critical Stored XSS in Preview Modal leading to Administrative Account Takeoverrustfs · console | Critical9.0 |
| CVE-2026-55188 | RustFS: ListRemoteTargetHandler authorization bypass leaks replication target credentialsrustfs · rustfs | High8.2 |
| CVE-2026-49991 | RustFS Snowball Auto-Extract: Path Traversal allows cross-bucket object injectionrustfs · rustfs | High8.6 |
| CVE-2026-55189 | RustFS: FTP frontend skips IAM authorization on object readsrustfs · rustfs | High7.7 |
| CVE-2026-55838 | RustFS: Missing admin authorization on /rustfs/admin/v3/metrics allows any authenticated user to read server metricsrustfs · rustfs | Medium4.3 |
| CVE-2026-45043 | RustFS: ImportIam Allows Creation of Backdoor Service Accounts Under Any Parent Including Rootrustfs · rustfs | Critical9.3 |
| CVE-2026-46685 | RustFS: Reflective CORS with credentials on S3 listener; unauthenticated license metadata endpoint on consolerustfs · rustfs | Medium6.0 |
| CVE-2026-45039 | RustFS: Internode RPC HMAC secret falls back to public default credential, enabling peer impersonationrustfs · rustfs | Critical9.8 |
| CVE-2026-45040 | RustFS: Sensitive Information Leakage (SessionToken and SecretAccessKey) in RustFS Logs [Debug Mode]rustfs · rustfs | Medium5.3 |
| CVE-2026-45041 | RustFS: Hard-coded RSA private key in license verifier permits arbitrary license forgeryrustfs · rustfs | High8.7 |
| CVE-2026-45042 | RustFS: UploadPartCopy Does Not Enforce Destination Bucket Policy on Copy Sourcerustfs · rustfs | High7.1 |
| CVE-2026-45044 | RustFS: Authentication bypass in /profile/cpu and /profile/memory allows unauthenticated access to profiling handlersrustfs · rustfs | High8.8 |
| CVE-2026-47136 | RustFS: Unauthenticated RustFS console license endpoint exposes license metadatarustfs · rustfs | Medium6.9 |
| CVE-2026-40937 | RustFS missing admin authorization on notification target endpoints, which allows unauthenticated configuration of event webhooksrustfs · rustfs | High8.3 |
| CVE-2026-39360 | RustFS has an authorization bypass in multipart UploadPartCopy enables cross-bucket object exfiltrationrustfs · rustfs | Medium5.3 |
| CVE-2026-27822 | Rust has Critical Stored XSS in Preview Modal, leading to Administrative Account Takeoverrustfs · rustfs | Critical9.1 |
| CVE-2026-27607 | RustFS's Missing Post Policy Validation leads to Arbitrary Object Writerustfs · rustfs | High8.1 |
| CVE-2026-24762 | RustFS Logs Sensitive Credentials in Plaintextrustfs · rustfs | Medium6.9 |
| CVE-2026-21862 | RustFS sourceIp bypass via spoofed X-Forwarded-For/Real-IP headersrustfs · rustfs | High7.7 |
| CVE-2026-22782 | RustFS RPC signature verification logs shared secretrustfs · rustfs | Low2.9 |
| CVE-2026-22043 | RustFS has IAM deny_only Short-Circuit that Allows Privilege Escalation via Service Account Mintingrustfs · rustfs | Medium5.7 |
| CVE-2026-22042 | RustFS has IAM Incorrect Authorization in ImportIam that Allows Privilege Escalationrustfs · rustfs | Medium5.7 |
| CVE-2025-69255 | RustFS gRPC GetMetrics deserialization panic enables remote DoSrustfs · rustfs | Medium5.5 |
| CVE-2025-68705 | RustFS Path Traversal Vulnerabilityrustfs · rustfs | High8.8 |
| CVE-2025-68926 | RustFS has a gRPC Hardcoded Token Authentication Bypassrustfs · rustfs | Critical9.8 |