Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 9 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,253All CVEsplus 19,138 rejected
- 471Last 24 hours2,753 in the last 7 days
- 16,910Last 30 days1,554 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 3 | 7 | 2 | 0 | 0 | 12 | 12 |
| Title | ||
|---|---|---|
| CVE-2026-49407 | OpenHuman: Unauthenticated dictation WebSocket allows arbitrary audio streaming and unbounded memory growthtinyhumansai · openhuman | High7.7 |
| CVE-2026-54142 | OpenHuman: Indirect prompt injection via background email sync executes Composio actions without user approvaltinyhumansai · openhuman | High8.7 |
| CVE-2026-54146 | OpenHuman: Bearer token leak via process environment variable on macOS (same-UID local RCE primitive)tinyhumansai · openhuman | High8.8 |
| CVE-2026-54143 | OpenHuman allows remote inbound channel messages to create unapproved shell cron jobs leading to host command executiontinyhumansai · openhuman | Critical9.8 |
| CVE-2026-54141 | OpenHuman: Yuanbao non-web channel can bypass human approval to execute `node_exec`tinyhumansai · openhuman | Critical9.0 |
| CVE-2026-49393 | OpenHuman: Unauthenticated Socket.IO RPC bypass allows invoking protected OpenHuman core controllers without the Bearer tokentinyhumansai · openhuman | High8.4 |
| CVE-2026-54145 | OpenHuman: Bearer token leaked via approval gate session_id (SQLite plaintext + debug log + RPC response)tinyhumansai · openhuman | High8.8 |
| CVE-2026-49405 | OpenHuman: Unauthenticated server-sent events endpoint leaks user-facing event datatinyhumansai · openhuman | Medium6.2 |
| CVE-2026-54144 | OpenHuman: Embedded Google Meet webview can silently capture the macOS desktop without a user gesturetinyhumansai · openhuman | Medium6.1 |
| CVE-2026-54140 | OpenHuman: MCP tool description injection: untrusted server descriptions execute in agent LLM context without sanitizationtinyhumansai · openhuman | High8.3 |
| CVE-2026-49410 | OpenHuman /auth/telegram CSRF allows attacker-controlled session implantationtinyhumansai · openhuman | High8.1 |
| CVE-2026-55743 | OpenHuman desktop agent shell tool sandbox bypass leads to arbitrary command executiontinyhumansai · OpenHuman | Critical9.4 |