Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 2 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 400,525All CVEsplus 18,890 rejected
- 426Last 24 hours3,033 in the last 7 days
- 17,435Last 30 days1,599 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 8 | 21 | 10 | 4 | 0 | 43 | 78 |
| 2025 | 2 | 10 | 3 | 0 | 0 | 15 | 35 |
| 2024 | 0 | 6 | 8 | 0 | 0 | 14 | 20 |
| 2023 | 0 | 3 | 2 | 0 | 0 | 5 | 6 |
| 2022 | 0 | 1 | 0 | 0 | 0 | 1 | 1 |
| Title | ||
|---|---|---|
| CVE-2026-119129 | ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.19.5 Account Takeover via Device Authorization Approvalzitadel · zitadel | High8.6 |
| CVE-2026-119128 | ZITADEL 4.0.0 before 4.19.5 Login V2 Account Takeover via Forgeable verificationCheck Cookiezitadel · zitadel | Critical9.1 |
| CVE-2026-119127 | ZITADEL 4.0.0 before 4.19.5 Account Takeover via Login V2 Host Header Injectionzitadel · zitadel | High8.6 |
| CVE-2026-109374 | ZITADEL 3.0.0 before 4.19.2 Privilege Escalation via OIDC Token Exchange Impersonationzitadel · zitadel | Medium5.1 |
| CVE-2026-109373 | ZITADEL 3.0.0 before 4.19.2 Account Takeover via Unsigned Login V2 Session Cookiezitadel · zitadel | Critical9.2 |
| CVE-2026-109372 | ZITADEL 3.0.0 before 4.19.2 Account Takeover via SAML Identity-Provider Confusionzitadel · zitadel | Critical9.3 |
| CVE-2026-109371 | ZITADEL 3.0.0 before 4.18.0 Unauthenticated Username Change via Login V1zitadel · zitadel | High8.8 |
| CVE-2026-105215 | ZITADEL before 4.16.2 Account Pre-Hijacking via Forged External IdP Callbackzitadel · zitadel | Critical9.3 |
| CVE-2026-105214 | Zitadel before 4.16.2 SSRF via Organization Domain HTTP Verificationzitadel · zitadel | Low2.3 |
| CVE-2026-105213 | ZITADEL before 4.17.1 Authentication Bypass via Login V2 for Deactivated Organizationszitadel · zitadel | High8.8 |
| CVE-2026-105212 | ZITADEL before 3.4.14 and 4.16.2 Account Takeover via Passkey Enrollmentzitadel · zitadel | High8.7 |
| CVE-2026-105211 | ZITADEL before 4.17.1 Authentication Bypass via Login V2 OTP returnCodezitadel · zitadel | Critical9.2 |
| CVE-2026-105210 | ZITADEL before 4.17.1 Unauthenticated MFA Enrollment via Login V1 Init Handlerszitadel · zitadel | High8.8 |
| CVE-2026-105209 | ZITADEL before 3.4.15 and 4.17.1 Cross-Organization Account Takeover via Passkey Enrollmentzitadel · zitadel | Critical9.3 |
| CVE-2026-105208 | ZITADEL before 4.17.3 Session Hijacking via Forgeable IdP Intent Tokenszitadel · zitadel | High8.7 |
| CVE-2026-105207 | ZITADEL before 4.17.3 Account Takeover via External IdP Linkingzitadel · zitadel | Critical9.3 |
| CVE-2026-105206 | ZITADEL before 4.17.3 Cross-Organization Authentication Method Enumeration via User Servicezitadel · zitadel | Medium5.3 |
| CVE-2026-85056 | ZITADEL: MFA bypass via session reuse in Login V2zitadel · zitadel | High8.2 |
| CVE-2026-85057 | ZITADEL: Actions V1 sandbox escape: host file read via require()zitadel · zitadel | High8.7 |
| CVE-2026-76081 | ZITADEL: Improper Role Revocation on Granted Projects during Multiple Role Deletionszitadel · zitadel | Medium5.5 |
| CVE-2026-54693 | ZITADEL Users Can Self-Verify Email/Phone via APIzitadel · zitadel | High8.2 |
| CVE-2026-56668 | ZITADEL: Unauthorized Token Privilege Escalation in OAuth2 Token Exchangezitadel · zitadel | High8.1 |
| CVE-2026-56666 | ZITADEL: Auto-linking by email: IdP-side email verification is not checkedzitadel · zitadel | Medium4.8 |
| CVE-2026-56667 | ZITADEL: Stored XSS via Default URI Redirect in Login V2zitadel · zitadel | High7.3 |
| CVE-2026-56665 | ZITADEL: Missing Token Expiration (`exp`) Validation in JWT IdP Providerzitadel · zitadel | Medium4.2 |
| CVE-2026-56664 | ZITADEL: Missing Token Lifecyle Validation (`exp` and `iat`) in JWT IdP Providerzitadel · zitadel | Medium4.2 |
| CVE-2026-55672 | ZITADEL: Missing client_id binding in OIDC authorization code exchange and refresh token flows (RFC 6749 Section 4.1.3 violation)zitadel · zitadel | High7.4 |
| CVE-2026-55671 | ZITADEL: Server-Side Request Forgery (SSRF) and Denylist Bypass in Outgoing HTTP Componentszitadel · zitadel | Low2.3 |
| CVE-2026-55670 | ZITADEL: Cross-Tenant User Leakage via Recycled Identifierszitadel · zitadel | Low2.3 |
| CVE-2026-55669 | ZITADEL: Missing Token Audience Validation (`aud`) in JWT IdP Providerzitadel · zitadel | Medium4.2 |
| CVE-2026-44671 | ZITADEL: LDAP Filter Injection in Login Flowzitadel · zitadel | High7.5 |
| CVE-2026-33132 | ZITADEL is missing enforcement of organization scopeszitadel · zitadel | Medium5.3 |
| CVE-2026-32132 | ZITADEL: Reactivation of Expired Passkey Registration Codeszitadel · zitadel | High7.4 |
| CVE-2026-32131 | ZITADEL Cross-Tenant Information Disclosure in Management APIzitadel · zitadel | High7.7 |
| CVE-2026-32130 | ZITADEL SCIM Authentication Bypass via URL Encodingzitadel · zitadel | High7.5 |
| CVE-2026-29067 | ZITADEL: Account Takeover Due to Improper Instance Validation in V2 Loginzitadel · zitadel | High8.1 |
| CVE-2026-29193 | ZITADEL: Bypassing Zitadel Login Behavior and Security Policy in Login V2zitadel · zitadel | High8.2 |
| CVE-2026-29192 | ZITADEL: Stored XSS via Default URI Redirect Leads to Account Takeoverzitadel · zitadel | High7.7 |
| CVE-2026-29191 | ZITADEL: 1-Click Account Takeover via XSS in /saml-post Endpointzitadel · zitadel | Critical9.3 |
| CVE-2026-27946 | ZITADEL Users Can Self-Verify Email/Phone via UpdateHumanUser APIzitadel · zitadel | High8.2 |
| CVE-2026-27945 | ZITADEL has potential SSRF via Actionszitadel · zitadel | Low2.1 |
| CVE-2026-27840 | ZITADEL's truncated opaque tokens are still validzitadel · zitadel | Medium4.3 |
| CVE-2026-23511 | ZITADEL has a user enumeration vulnerability in Login UIszitadel · zitadel | Medium5.3 |
| CVE-2025-67717 | Zitadel Discloses the Total Number of Instance Userszitadel · zitadel | Medium5.3 |
| CVE-2025-67495 | ZITADEL Vulnerable to Account Takeover via DOM-Based XSS in Zitadel V2 Loginzitadel · zitadel | High8.0 |
| CVE-2025-67494 | ZITADEL Vulnerable to Unauthenticated Full-Read SSRF via V2 Loginzitadel · zitadel | Critical9.3 |
| CVE-2025-64717 | ZITADEL vulnerable to Account Takeover with deactivated Instance IdPzitadel · zitadel | High7.4 |
| CVE-2025-64431 | IDOR Vulnerabilities in ZITADEL's Organization API allows Cross-Tenant Data Temperingzitadel · zitadel | High8.7 |
| CVE-2025-64103 | Zitadel Bypass Second Authentication Factorzitadel · zitadel | High8.7 |
| CVE-2025-64102 | Zitadel allows brute-forcing authentication factorszitadel · zitadel | High7.7 |