Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 3 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,298All CVEsplus 19,140 rejected
- 452Last 24 hours2,722 in the last 7 days
- 16,913Last 30 days1,557 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 2 | 9 | 6 | 1 | 0 | 18 | 24 |
| 2025 | 0 | 3 | 1 | 0 | 0 | 4 | 6 |
| 2024 | 0 | 1 | 0 | 0 | 0 | 1 | 2 |
| 2023 | 0 | 0 | 1 | 0 | 0 | 1 | 1 |
| Title | ||
|---|---|---|
| CVE-2026-116578 | Tornado: Open redirect in RedirectHandler via protocol-relative URLstornadoweb · tornado | Low2.1 |
| CVE-2026-116577 | Tornado: Quadratic CPU usage when parsing HTTP headers with line foldingtornadoweb · tornado | Medium5.3 |
| CVE-2026-115927 | Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunkstornadoweb · tornado | Medium5.3 |
| CVE-2026-103263 | Tornado before 6.5.9 StaticFileHandler Path Traversal via Symlinktornadoweb · tornado | High8.2 |
| CVE-2026-103262 | Tornado before 6.5.9 Denial of Service via CurlAsyncHTTPClienttornadoweb · tornado | High8.7 |
| CVE-2026-103261 | Tornado before 6.5.9 Denial of Service via Query Stringtornadoweb · tornado | Medium6.9 |
| CVE-2026-91992 | Tornado before 6.5.7 Credential Leak via Handle Reusetornadoweb · tornado | High8.2 |
| CVE-2026-91991 | Tornado before 6.5.8 Cookie Attribute Injection via Capitalized kwargstornadoweb · tornado | Medium6.3 |
| CVE-2026-91990 | Tornado before 6.5.8 Memory Amplification DoS via multiparttornadoweb · tornado | High8.7 |
| CVE-2024-58384 | Tornado before 6.4.1 CRLF Injection via CurlAsyncHTTPClienttornadoweb · tornado | Medium6.3 |
| CVE-2024-14029 | Tornado before 6.4.1 HTTP Request Smuggling via Transfer-Encodingtornadoweb · tornado | Critical9.0 |
| CVE-2023-54397 | Tornado before 6.3.3 HTTP Request Smuggling via Content-Lengthtornadoweb · tornado | Critical9.0 |
| CVE-2026-82397 | Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event looptornadoweb · tornado | High7.5 |
| CVE-2026-49855 | tornado AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb)tornadoweb · tornado | High7.5 |
| CVE-2026-49854 | Tornado: Out-of-bounds memory access in C extensiontornadoweb · tornado | Medium5.3 |
| CVE-2026-49853 | Tornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClienttornadoweb · tornado | High7.7 |
| CVE-2026-35536 | In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.set_cookie were not checked…tornadoweb · Tornado | High7.2 |
| CVE-2026-31958 | Tornado has a DoS due to too many multipart partstornadoweb · tornado | High8.7 |
| CVE-2025-67726 | Tornado is Vulnerable to Quadratic DoS via Crafted Multipart Parameterstornadoweb · tornado | High7.5 |
| CVE-2025-67725 | Tornado is Vulnerable to Quadratic DoS via Repeated Header Coalescingtornadoweb · tornado | High7.5 |
| CVE-2025-67724 | Tornado vulnerable to Header Injection and XSS via reason argumenttornadoweb · tornado | Medium5.4 |
| CVE-2025-47287 | Tornado vulnerable to excessive logging caused by malformed multipart form datatornadoweb · tornado | High7.5 |
| CVE-2024-52804 | Tornado has HTTP cookie parsing DoS vulnerabilitytornadoweb · tornado | High7.5 |
| CVE-2023-28370 | Open redirect vulnerability in Tornado versions 6.3.1 and earlier allows a remote unauthenticated attacker to redirect a user to an arbitrary web site and…tornadoweb · Tornado | Medium6.1 |