Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 8 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,736All CVEsplus 19,141 rejected
- 659Last 24 hours3,036 in the last 7 days
- 17,189Last 30 days1,611 of them critical
- 1,769Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 0 | 4 | 17 | 7 | 0 | 28 | 44 |
| 2025 | 0 | 3 | 8 | 2 | 0 | 13 | 16 |
| 2024 | 0 | 1 | 2 | 0 | 0 | 3 | 3 |
| Title | ||
|---|---|---|
| CVE-2026-114128 | Astro: Reflected/Stored XSS via unescaped <script>/<style> tag content in JSX/MDX renderingwithastro · astro | Medium6.5 |
| CVE-2026-114127 | Astro: Arbitrary CSS injection in Astro View Transitionswithastro · astro | Low2.3 |
| CVE-2026-102984 | Astro: Malformed port in the Host header can crash the Node adapterwithastro · astro | High8.2 |
| CVE-2026-102983 | Astro: Netlify Image CDN allowlist bypass enables SSRFwithastro · astro | Medium6.3 |
| CVE-2026-84376 | Astro: Authorization bypass from missing path-segment boundary check when stripping the configured basewithastro · astro | Medium6.3 |
| CVE-2026-73424 | Astro: Unauthenticated path override in the @astrojs/vercel ISR functionwithastro · astro | Medium6.5 |
| CVE-2026-73425 | @astrojs/netlify generates an overly-broad Netlify Image CDN allowlist because remotePatterns.pathname metacharacters are not escapedwithastro · astro | Low3.7 |
| CVE-2026-73423 | Astro: composable `astro/hono` pipeline bypasses `security.checkOrigin` when `middleware()` is absent or misorderedwithastro · astro | Medium5.1 |
| CVE-2026-73422 | Astro: Reflected XSS via unescaped View Transition animation propertieswithastro · astro | Medium5.3 |
| CVE-2026-59730 | @astrojs/node: Backslash-prefixed paths not recognized as internal by trailing-slash redirectwithastro · astro | Low2.1 |
| CVE-2026-59728 | @astrojs/rss: XML Injection via Unescaped RSS Feed Fieldswithastro · astro | Medium4.3 |
| CVE-2026-59727 | Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islandswithastro · astro | Low2.1 |
| CVE-2026-59729 | Astro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for CVE-2026-54298)withastro · astro | Medium5.1 |
| CVE-2026-59731 | Astro 6.4.7 Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatchwithastro · astro | High8.2 |
| CVE-2026-54299 | Astro: Host-header full-read SSRF in core prerendered error-page fetch (prerenderedErrorPageFetch default + unvalidated createRequestFromNodeRequest URL)withastro · astro | High7.5 |
| CVE-2026-54298 | Astro: XSS via Unescaped Attribute Names in Spread Propswithastro · astro | Medium4.2 |
| CVE-2026-50146 | Astro: Reflected XSS via unescaped slot namewithastro · astro | High7.1 |
| CVE-2026-54300 | @astrojs/netlify broadens Astro image.remotePatterns in Netlify Image CDN configwithastro · astro | Medium5.3 |
| CVE-2026-45028 | Astro: Server island encrypted parameters vulnerable to cross-component replaywithastro · astro | Low2.9 |
| CVE-2026-41322 | @astrojs/node: Cache Poisoning due to incorrect error handling when if-match header is malformedwithastro · astro | Medium5.3 |
| CVE-2026-41321 | @astrojs/cloudflare: SSRF via redirect following in Cloudflare image-binding-transform endpointwithastro · @astrojs/cloudflare | Low2.2 |
| CVE-2026-41067 | Astro: XSS via incomplete `</script>` sanitization in `define:vars` allows case-insensitive and whitespace-based bypasswithastro · astro | Medium6.1 |
| CVE-2026-33769 | Astro: Remote allowlist bypass via unanchored matchPathname wildcardwithastro · astro | Low2.9 |
| CVE-2026-33768 | Astro: Unauthenticated Path Override via `x-astro-path` / `x_astro_path`withastro · astro | Medium6.5 |
| CVE-2026-29772 | Astro: Memory exhaustion DoS due to missing request body size limit in Server Islandswithastro · astro | Medium5.9 |
| CVE-2026-27829 | Astro is vulnerable to SSRF due to missing allowlist enforcement in remote image inferSizewithastro · astro | Medium6.5 |
| CVE-2026-27729 | Astro has memory exhaustion DoS due to missing request body size limit in Server Actionswithastro · astro | Medium5.9 |
| CVE-2026-25545 | Astro has Full-Read SSRF in error rendering via Host: header injectionwithastro · astro | Medium6.9 |
| CVE-2025-66202 | Astro has an Authentication Bypass via Double URL Encoding, a bypass for CVE-2025-64765withastro · astro | Medium6.5 |
| CVE-2025-64765 | Astro middleware authentication checks based on url.pathname can be bypassed via url encoded valueswithastro · astro | Medium6.9 |
| CVE-2025-64764 | Astro is vulnerable to Reflected XSS via the server islands featurewithastro · astro | High7.1 |
| CVE-2025-65019 | Astro Cloudflare adapter has a Stored Cross Site Scripting vulnerability in /_image endpointwithastro · astro | Medium5.4 |
| CVE-2025-64757 | Astro Development Server is Vulnerable to Arbitrary Local File Readwithastro · astro | Low3.5 |
| CVE-2025-64745 | Astro development server error page vulnerable to reflected Cross-site Scriptingwithastro · astro | Low2.7 |
| CVE-2025-64525 | Astro: URL manipulation via unsanitized headers leads to path-based middleware protections bypass, potential SSRF/cache-poisoning, CVE-2025-61925 bypasswithastro · astro | Medium6.5 |
| CVE-2025-59837 | astro allows bypass of image proxy domain validation leading to SSRF and potential XSSwithastro · astro | High7.2 |
| CVE-2025-61925 | Astro's `X-Forwarded-Host` is reflected with no validationwithastro · astro | Medium6.5 |
| CVE-2025-58179 | Astro Cloudflare adapter is vulnerable to Server-Side Request Forgery via /_image endpointwithastro · astro | High7.2 |
| CVE-2025-55303 | Unauthorized third-party images in Astro’s _image endpointwithastro · astro | Medium6.9 |
| CVE-2025-55207 | @astrojs/node's trailing slash handling causes open redirect issuewithastro · astro | Medium5.5 |
| CVE-2025-54793 | Astro: Duplicate trailing slash feature can lead to Open Redirectswithastro · astro | Medium5.5 |
| CVE-2024-56159 | Server source code is exposed to the public if sourcemaps are enabledwithastro · astro | High7.8 |
| CVE-2024-56140 | Bypass of CSRF Middleware in Astrowithastro · astro | Medium5.9 |
| CVE-2024-47885 | astro's client-side router has DOM Clobbering Gadget that leads to XSSwithastro · astro | Medium5.9 |