Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 3 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 405,466All CVEsplus 19,159 rejected
- 640Last 24 hours4,914 in the last 7 days
- 18,832Last 30 days1,596 of them critical
- 1,779Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 6 | 10 | 0 | 0 | 0 | 16 | 48 |
| 2025 | 2 | 15 | 3 | 0 | 0 | 20 | 32 |
| 2024 | 4 | 1 | 1 | 0 | 0 | 6 | 12 |
| 2023 | 0 | 2 | 4 | 0 | 0 | 6 | 6 |
| Title | ||
|---|---|---|
| CVE-2026-105040 | EnergizeLab Eilik User-ID Mass Assignment Account TakeoverEnergizeLab · NestJS auth service | High8.8 |
| CVE-2026-105039 | EnergizeLab Station Middleware Admin APIs Missing Role ChecksEnergizeLab · station-middleware | Critical9.6 |
| CVE-2026-105038 | EnergizeLab Eilik Unauthenticated AI Model Administration and Runtime Model SwitchingEnergizeLab · FastAPI AI inference server | Critical9.8 |
| CVE-2026-105037 | EnergizeLab Station Middleware Authenticated Path Traversal Arbitrary File ReadEnergizeLab · station-middleware | Critical9.9 |
| CVE-2026-105036 | EnergizeLab Firmware Updates Downloaded over HTTP Without Integrity ChecksEnergizeLab · Robot firmware (mode 104000) | High7.5 |
| CVE-2026-105035 | EnergizeLab FirmwareUpdater Universal Hard-Coded AES KeyEnergizeLab · FirmwareUpdater | High7.8 |
| CVE-2026-105034 | EnergizeLab Eilik Unauthenticated Device-Token Issuance for Arbitrary Serial NumbersEnergizeLab · NestJS auth service | High8.2 |
| CVE-2026-105033 | EnergizeLab AI Station Default Root Credentials with SSH EnabledEnergizeLab · AI Station firmware (RK3562) | High8.8 |
| CVE-2026-105032 | EnergizeLab Eilik AI Skill Upload Unauthenticated Path Traversal Arbitrary File WriteEnergizeLab · FastAPI AI inference server | Critical9.1 |
| CVE-2026-14765 | Epic Games Unreal Engine Insecure Default URL Scheme Allowance in LaunchURLEpic Games · Unreal Engine | High7.7 |
| CVE-2026-7574 | Anthropic Claude Desktop Cowork VM Image Contents Not Validated Before UseAnthropic · Claude Desktop Cowork | High8.7 |
| CVE-2026-7415 | Open MQTT orchestration without read/write ACLs in Yarbo robot firmwarePublic exploitYarbo · Firmware | Critical9.8 |
| CVE-2026-7414 | Hardcoded credentials in Yarbo robot firmwarePublic exploitYarbo · Firmware | Critical9.8 |
| CVE-2026-7413 | Persistent undocumented backdoor access in Yarbo robotPublic exploitYarbo · Firmware | High7.2 |
| CVE-2026-4946 | NSA Ghidra Auto-Analysis Annotation Command ExecutionPublic exploitNSA · Ghidra | High8.8 |
| CVE-2026-1442 | Unitree UPK files Hard-Coded KeyPublic exploitUnitree · UPK | High7.8 |
| CVE-2025-35028 | HexStrike AI MCP Server Command InjectionPublic exploit0x4m4 · HexStrike AI | Critical9.1 |
| CVE-2025-35021 | Abilis CPX Fallback Shell Connection RelayAbilis · CPX | Medium6.5 |
| CVE-2025-35027 | Unitree Multiple Robotic Products Command InjectionPublic exploitUnitree · Go2 | High7.3 |
| CVE-2025-8452 | Unauthenticated leak of sensitive information affecting multiple models from Brother Industries, Ltd., Toshiba Tec, and Konica Minolta, Inc.Public exploitBrother Industries, Ltd · DCP-L8410CDW | Medium4.3 |
| CVE-2025-35010 | Microhard Bullet-LTE and IPn4Gii AT+MNPINGTM Argument InjectionPublic exploitMicrohard · IPn4Gii / Bullet-LTE Firmware | High7.1 |
| CVE-2025-35009 | Microhard Bullet-LTE and IPn4Gii AT+MNNETSP Argument InjectionPublic exploitMicrohard · IPn4Gii / Bullet-LTE Firmware | High7.1 |
| CVE-2025-35008 | Microhard Bullet-LTE and IPn4Gii AT+MMNAME Argument InjectionPublic exploitMicrohard · IPn4Gii / Bullet-LTE Firmware | High7.1 |
| CVE-2025-35007 | Microhard Bullet-LTE and IPn4Gii AT+MFRULE Argument InjectionPublic exploitMicrohard · IPn4Gii / Bullet-LTE Firmware | High7.1 |
| CVE-2025-35006 | Microhard Bullet-LTE and IPn4Gii AT+MFPORTFWD Argument InjectionPublic exploitMicrohard · IPn4Gii / Bullet-LTE Firmware | High7.1 |
| CVE-2025-35005 | Microhard Bullet-LTE and IPn4Gii AT+MFMAC Argument InjectionPublic exploitMicrohard · IPn4Gii / Bullet-LTE Firmware | High7.1 |
| CVE-2025-35004 | Microhard Bullet-LTE and IPn4Gii AT+MFIP Argument InjectionPublic exploitMicrohard · IPn4Gii / Bullet-LTE Firmware | High7.1 |
| CVE-2025-32459 | ON Semiconductor Quantenna router_command.sh (in the sync_time argument) Argument InjectionON Semiconductor · Quantenna Wi-Fi chipset | High7.7 |
| CVE-2025-32458 | ON Semiconductor Quantenna router_command.sh (in the get_syslog_from_qtn argument) Argument InjectionON Semiconductor · Quantenna Wi-Fi chipset | High7.7 |
| CVE-2025-32457 | ON Semiconductor Quantenna router_command.sh (in the get_file_from_qtn argument) Argument InjectionON Semiconductor · Quantenna Wi-Fi chipset | High7.7 |
| CVE-2025-32456 | ON Semiconductor Quantenna router_command.sh (in the put_file_to_qtn argument) Argument InjectionON Semiconductor · Quantenna Wi-Fi chipset | High7.7 |
| CVE-2025-32455 | ON Semiconductor Quantenna router_command.sh (in the run_cmd argument) Argument InjectionON Semiconductor · Quantenna Wi-Fi chipset | High7.7 |
| CVE-2025-3461 | ON Semiconductor Quantenna Telnet Missing AuthenticationON Semiconductor · Quantenna Wi-Fi chipset | Critical9.1 |
| CVE-2025-3460 | ON Semiconductor Quantenna set_tx_pow Argument InjectionON Semiconductor · Quantenna Wi-Fi chipset | High7.7 |
| CVE-2025-3459 | ON Semiconductor Quantenna transmit_file Argument InjectionON Semiconductor · Quantenna Wi-Fi chipset | High7.7 |
| CVE-2025-2894 | Unitree Go1 Robot Dog Backdoor Control ChannelPublic exploitUnitree · Go1 | Medium6.6 |
| CVE-2024-4224 | TP-Link TL-SG1016DE XSSPublic exploitTP-Link · TL-SG1016DE | Medium5.4 |
| CVE-2024-2056 | Artica Proxy Loopback Services Remotely Accessible UnauthenticatedPublic exploitArtica Tech · Artica Proxy | Critical9.8 |
| CVE-2024-2055 | Artica Proxy Unauthenticated File Manager VulnerabilityPublic exploitArtica Tech · Artica Proxy | Critical9.8 |
| CVE-2024-2054 | Artica Proxy Unauthenticated PHP Deserialization VulnerabilityPublic exploitArtica Tech · Artica Proxy | Critical9.8 |
| CVE-2024-2053 | Artica Proxy Unauthenticated LFI Protection Bypass VulnerabilityPublic exploitArtica Tech · Artica Proxy | High7.5 |
| CVE-2023-5841 | OpenEXR Heap Overflow in Scanline Deep Data ParsingPublic exploitAcademy Software Foundation · OpenEXR | Critical9.1 |
| CVE-2023-4504 | OpenPrinting CUPS/libppd Postscript Parsing Heap OverflowPublic exploitOpenPrinting · CUPS | High7.0 |
| CVE-2023-2906 | Wireshark CP2179 divide by zeroPublic exploitWireshark Foundation · Wireshark | Medium6.5 |
| CVE-2023-2905 | Cesanta Mongoose MQTT Message Parsing Heap OverflowPublic exploitCesanta · Mongoose | High8.8 |
| CVE-2023-0667 | Wireshark MSMMS parsing buffer overflowPublic exploitWireshark Foundation · Wireshark | Medium6.5 |
| CVE-2023-0668 | Wireshark IEEE-C37.118 parsing buffer overflowPublic exploitWireshark Foundation · Wireshark | Medium6.5 |
| CVE-2023-0666 | Wireshark RTPS Parsing Buffer OverflowPublic exploitWireshark Foundation · Wireshark | Medium6.5 |