Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read just now.
At a glance
Published CVEs; rejected ones are not counted.
- 401,765All CVEsplus 19,141 rejected
- 667Last 24 hours3,065 in the last 7 days
- 17,163Last 30 days1,610 of them critical
- 1,769Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 6 | 2 | 8 | 0 | 0 | 16 | 16 |
| Title | ||
|---|---|---|
| CVE-2026-55566 | Yamcs: DOM XSS in Extension Routingyamcs · yamcs | Medium4.3 |
| CVE-2026-55565 | Yamcs: Authenticated remote code execution via unescaped StreamSQL `LIKE` pattern compiled by Janino (`LikeExpression`)yamcs · yamcs | Critical9.9 |
| CVE-2026-55559 | Yamcs: Remote Code Execution via instance-template argument YAML injection (createInstance)yamcs · yamcs | Critical9.8 |
| CVE-2026-55552 | Yamcs: Unauthenticated Directory Traversalyamcs · yamcs | High7.5 |
| CVE-2026-55549 | Yamcs: Reflected XSS in the URL of the Authorize Endpointyamcs · yamcs | Medium6.5 |
| CVE-2026-55547 | Yamcs: Missing Authorization on Role and Privilege Enumeration Endpoints Allows Any Authenticated User to Disclose Full Security Configurationyamcs · yamcs | Medium4.3 |
| CVE-2026-55545 | Yamcs: WebSocket subscription handlers omit the privilege checks their REST siblings enforceyamcs · yamcs | Medium6.5 |
| CVE-2026-55521 | Yamcs : Multiple Missing Function Level Access Control vulnerabilities in Yamcs Core APIyamcs · yamcs | High8.8 |
| CVE-2026-55511 | Yamcs: Authenticated RCE via StreamSQL aggregate-compiler column-name injection in Yamcs `executeSql`yamcs · yamcs | Critical9.1 |
| CVE-2026-55548 | Yamcs: Insecure Direct Object Reference (IDOR) in PacketsApi allows unprivileged users to dump all telemetry packetsyamcs · yamcs | Medium4.3 |
| CVE-2026-46621 | Yamcs: Authenticated Remote Code Execution (RCE) via Jython Algorithm Code Injectionyamcs · yamcs | Critical9.1 |
| CVE-2026-46562 | Yamcs: Remote Code Execution via Mission Database algorithm overrideyamcs · yamcs | Critical9.8 |
| CVE-2026-44632 | Yamcs: Server-Side Code Injection (RCE) via Janino Expression Engine in `JavaExprAlgorithmExecutionFactory`yamcs · yamcs | Critical9.1 |
| CVE-2026-44596 | Yamcs: No Rate Limiting on Authentication Endpointyamcs · yamcs | Medium6.5 |
| CVE-2026-44595 | Yamcs: Unauthorized user enumeration via IAM API endpointsyamcs · yamcs | Medium4.3 |
| CVE-2026-42568 | Yamcs Vulnerable to LDAP Injection in LdapAuthModuleyamcs · yamcs | Medium4.3 |