Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 4 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 400,565All CVEsplus 18,890 rejected
- 360Last 24 hours2,992 in the last 7 days
- 17,093Last 30 days1,578 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 1 | 1 | 7 | 1 | 0 | 10 | 42 |
| 2025 | 0 | 1 | 5 | 2 | 0 | 8 | 32 |
| 2024 | 0 | 0 | 2 | 0 | 0 | 2 | 24 |
| 2023 | 0 | 1 | 4 | 1 | 0 | 6 | 22 |
| 2022 | 0 | 3 | 7 | 2 | 0 | 12 | 16 |
| 2021 | 0 | 0 | 2 | 0 | 0 | 2 | 4 |
| 2020 | 0 | 0 | 0 | 0 | 0 | 0 | 2 |
| 2019 | 0 | 0 | 0 | 0 | 0 | 0 | 2 |
| 2018 | 0 | 0 | 0 | 0 | 0 | 0 | 2 |
| 2017 | 0 | 1 | 1 | 0 | 0 | 2 | 2 |
| Title | ||
|---|---|---|
| CVE-2026-115474 | Zulip: Saving a draft DM to a user bypasses can_access_all_users_group permissionzulip · zulip | Medium6.5 |
| CVE-2026-115574 | Zulip: Custom profile fields can be read by logged-out visitors in organization with web-public channelszulip · zulip | Medium5.3 |
| CVE-2026-97701 | Zulip: Missing content-length limit on POST /messages/render allows denial-of-service via oversized requestszulip · zulip | Medium6.5 |
| CVE-2026-100404 | Zulip: Guests can read new messages in non-subscribed public channelszulip · zulip | Medium6.5 |
| CVE-2026-102893 | Zulip: OpenID Connect authentication ignores the email_verified claimzulip · zulip | Critical9.1 |
| CVE-2026-40300 | Zulip: Message edit history visible in "moves only" policy through /api/v1/messages/{id}/historyzulip · zulip | Medium6.0 |
| CVE-2026-26058 | Zulip: Path Traversal in Importzulip · zulip | Medium6.1 |
| CVE-2026-25742 | Zulip: Anonymous File Access After Disabling Spectator Accesszulip · zulip | Medium5.3 |
| CVE-2026-25741 | Zulip Vulnerable to Modification of Payment Method (Stripe Default Card) by Non-Billing Userszulip · zulip | High7.1 |
| CVE-2026-24050 | Zulip affected by Stored XSS in user profile modalzulip · zulip | Low1.1 |
| CVE-2025-52559 | Zulip XSS in digest preview URLzulip · zulip | Medium6.8 |
| CVE-2025-47930 | Zulip Server has access control bypass for restrictions on creation of specific channel typeszulip · zulip | Medium5.3 |
| CVE-2025-31478 | Zulip Authentication Backend Configuration Bypasszulip · zulip | High8.2 |
| CVE-2025-30369 | Zulip allows the deletion of Custom profile fields by administrators of a different organizationzulip · zulip | Low2.7 |
| CVE-2025-30368 | Zulip allows the deletion of organization by administrators of a different organizationzulip · zulip | Low2.7 |
| CVE-2025-27149 | Zulip exports can leak private datazulip · zulip | Medium4.6 |
| CVE-2025-25195 | Zulip events can leak private channel nameszulip · zulip | Medium4.3 |
| CVE-2024-56136 | /api/v1/jwt/fetch_api_key endpoint can leak if an email address has an account in Zulip serverzulip · zulip | Medium6.9 |
| CVE-2024-27286 | Moving single messages from public to private streams leaves them accessiblezulip · zulip | Medium6.5 |
| CVE-2024-21630 | Zulip non-admins can invite new users to streams they would not otherwise be able to add existing users tozulip · zulip | Medium4.3 |
| CVE-2023-47642 | Stream description leaks to ex-subscribers in Zulipzulip · zulip | Medium4.3 |
| CVE-2023-32678 | Zulip vulnerable to insufficient authorization check for edition/deletion of messages and topics in private streams by former subscriberszulip · zulip | Medium6.5 |
| CVE-2023-33186 | Cross-site scripting vulnerability in Zulip Server development branch via topic tooltipzulip · zulip | High8.2 |
| CVE-2023-28623 | Unauthorized user can register an account in specific configurations in Zulipzulip · zulip | Medium6.5 |
| CVE-2023-32677 | Users who can send invitations can erroneously add users to streams during invitation in Zulipzulip · zulip | Low3.1 |
| CVE-2023-22735 | User uploads proxied from S3 lack `Content-Security-Policy` headers, may be served with `Content-Disposition: inline` in zulipzulip · zulip | Medium4.4 |
| CVE-2022-41914 | Non-constant-time SCIM token comparison in Zulip Serverzulip · zulip | Low3.7 |
| CVE-2022-36048 | IP address leak via image proxy bypass in Zulip Serverzulip · zulip | Medium4.3 |
| CVE-2022-35962 | Crafted link in Zulip message can cause disclosure of credentialszulip · zulip-mobile | High8.0 |
| CVE-2022-31168 | Zulip Server insufficient authorization for changing bot roleszulip · zulip | Medium5.4 |
| CVE-2022-31134 | Zulip Server public data export contains attachments that are non-publiczulip · zulip | Medium4.9 |
| CVE-2022-31017 | Expression Always True vulnerability in Zulip Serverzulip · zulip | Low2.0 |
| CVE-2022-24751 | Race condition in Zulipzulip · zulip | Medium5.4 |
| CVE-2022-23656 | Cross-site scripting vulnerability in Zulip Serverzulip · zulip | Medium4.6 |
| CVE-2021-3967 | Improper Access Control in zulip/zulipzulip · zulip/zulip | Medium4.1 |
| CVE-2022-21706 | Multi-use invitations can grant access to other organizations in Zulipzulip · zulip | High7.2 |
| CVE-2021-43799 | RabbitMQ exposes ports with weak default secrets in Zulip Serverzulip · zulip | High8.6 |
| CVE-2021-3866 | Cross-site Scripting (XSS) - Stored in zulip/zulipzulip · zulip/zulip | Medium6.8 |
| CVE-2021-43791 | Ineffective expiration validation for invitation links in Zulipzulip · zulip | Medium6.5 |
| CVE-2021-41115 | Regular expression denial-of-service in Zulipzulip · zulip | Medium4.3 |
| CVE-2017-0910 | In Zulip Server before 1.7.1, on a server with multiple realms, a vulnerability in the invitation system lets an authorized user of one realm on the server…Zulip · Zulip Server | High8.8 |
| CVE-2017-0896 | Zulip Server 1.5.1 and below suffer from an error in the implementation of the invite_by_admins_only setting in the Zulip group chat application server that…Zulip · Zulip Server | Medium6.5 |