Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 2 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 405,273All CVEsplus 19,158 rejected
- 604Last 24 hours4,872 in the last 7 days
- 18,874Last 30 days1,615 of them critical
- 1,779Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 132 | 175 | 102 | 15 | 3 | 427 | 474 |
| 2025 | 10 | 14 | 23 | 0 | 0 | 47 | 47 |
| Title | ||
|---|---|---|
| CVE-2026-120212 | Web::Simple versions before 0.037 for Perl do not escape single quotes in HTML::Tags outputWeb-Simple | Not scored |
| CVE-2026-125729 | Plack::Middleware::CSP versions before 0.03 for Perl send the Content Security Policy under the wrong header name, so browsers never enforce itPlack-Middleware-CSP | Not scored |
| CVE-2026-115864 | Monoceros versions before 0.30 for Perl allow a request declaring a large Content-Length to kill a worker by exhausting memoryMonoceros | Not scored |
| CVE-2026-123776 | RRD::CGI::Image versions through 0.01 for Perl pass CGI query parameters containting "tz" to tzset(), , so a FIFO or device path blocks the CGI processRRD-CGI-Image | Critical9.8 |
| CVE-2026-121265 | SQL::Abstract versions before 2.000003 for Perl allow SQL injection via an arrayref column value in insert and updateSQL-Abstract | Critical9.8 |
| CVE-2026-121006 | HTTP::Body versions before 1.24_02 for Perl parse the trailer in quadratic timeHTTP-Body | High7.5 |
| CVE-2026-121009 | SQL::Abstract versions from 1.90_01 before 2.000001_04 for Perl skip the injection_guard check for function names given with -funcSQL-Abstract | High7.3 |
| CVE-2026-121008 | SQL::Abstract::Tree versions before 2.000001_04 for Perl allow cross-site scripting via unescaped SQL text and bind values in the html profileSQL-Abstract | Medium5.4 |
| CVE-2026-121007 | SQL::Abstract versions from 1.90_01 before 2.000001_04 for Perl allow SQL injection via the where values of a nested statement in an identifier positionSQL-Abstract | High7.3 |
| CVE-2026-114627 | Web::Simple versions before 0.036 for Perl do not escape values interpolated into double-quoted strings in HTML::Tags outputWeb-Simple | Medium6.1 |
| CVE-2026-121632 | Data::MuForm versions through 0.05 for Perl render attribute values and option labels into HTML without escapingData-MuForm | Medium6.1 |
| CVE-2026-120651 | CGI versions before 5.00 for Perl allow an infinite loop on a short request body when $DISABLE_UPLOADS is setCGI | High7.5 |
| CVE-2026-120650 | CGI versions before 5.00 for Perl allow memory, CPU and disk exhaustion via missing or unenforced request size, parameter and upload limitsCGI | Medium6.5 |
| CVE-2026-120648 | CGI versions before 5.00 for Perl allow HTML injection via text containing --> in commentCGI | Medium6.1 |
| CVE-2026-120647 | CGI versions before 5.00 for Perl allow Content-Disposition parameter injection via unescaped double quotes in the header attachment filenameCGI | Critical9.8 |
| CVE-2026-120646 | CGI versions from 4.71 before 5.00 for Perl allow denial of service via a plain string dereferenced as a symbolic reference in uploadInfoCGI | High7.5 |
| CVE-2026-120645 | CGI versions before 5.00 for Perl allow denial of service via submitted values used as a regex for optgroup selection in scrolling_listCGI | High7.5 |
| CVE-2026-120644 | CGI::Cookie versions before 5.00 for Perl allow cookie attribute injection via unvalidated path, domain and expires valuesCGI | Critical9.1 |
| CVE-2026-120643 | CGI versions from 4.62 before 5.00 for Perl allow cross-site scripting via a raw apostrophe in URLs returned by url and self_urlCGI | Medium6.1 |
| CVE-2026-120642 | CGI versions before 5.00 for Perl return request-derived values untainted under taint modeCGI | Critical9.1 |
| CVE-2026-120641 | CGI versions before 5.00 for Perl return upload filenames with any client-supplied path, including ../ and Windows pathsCGI | High8.8 |
| CVE-2026-120640 | CGI versions before 5.00 for Perl allow the POSTDATA, PUTDATA, PATCHDATA and XForms:Model parameters to be set from the query string or form fieldsCGI | Medium6.5 |
| CVE-2026-120639 | CGI versions before 5.00 for Perl allow HTTP header injection via entity decoding after the newline check in header and unchecked values in multipart_start and do_pushCGI | High7.2 |
| CVE-2026-120638 | CGI versions before 5.00 for Perl allow open redirects via HTML entity decoding of the URL after application validation in redirectCGI | Medium6.1 |
| CVE-2026-120637 | CGI versions before 5.00 for Perl take request parameters from the process command line arguments for an unrecognised REQUEST_METHODCGI | Critical9.8 |
| CVE-2026-120636 | CGI versions before 5.00 for Perl allow open redirects and script injection via URLs built from REQUEST_URI in url and start_formCGI | Medium6.1 |
| CVE-2026-120635 | CGI versions before 5.00 for Perl allow form fields to be smuggled past proxies and WAFs via multipart parsing that differs from the RFCsCGI | High8.1 |
| CVE-2026-120634 | CGI::Carp versions before 5.00 for Perl leak warnings across requests in persistent environments via the warningsToBrowser bufferCGI | Medium6.5 |
| CVE-2026-120633 | CGI versions before 5.00 for Perl trust the client X-Forwarded-Host header in url, self_url, virtual_host and virtual_portCGI | Medium6.1 |
| CVE-2026-120632 | CGI versions before 5.00 for Perl allow CPU exhaustion via a backtracking regex on the XForms multipart/related Content-TypeCGI | Medium6.5 |
| CVE-2026-120631 | CGI::Cookie versions from 4.67 before 5.00 for Perl allow denial of service via the client cookie expires value used as a regex in parseCGI | High7.5 |
| CVE-2026-74846 | Catalyst::Plugin::Authentication versions before 0.10029 for Perl allow timing attacks on stored passwords via eq comparisons in the legacy password verifierCatalyst-Plugin-Authentication | High7.5 |
| CVE-2026-65059 | Furl versions before 3.16 for Perl allow memory exhaustion via unbounded decompression of HTTP responsesFurl | High7.5 |
| CVE-2026-74760 | Google::Auth versions from 0.11 through 0.12 for Perl accept an authorization code from any local process because the gcloud-auth login callback does not check the OAuth stateGoogle-Auth | High8.8 |
| CVE-2026-74759 | Google::Auth versions 0.12 for Perl allow server side request forgery via unvalidated credential_source URLs in AWS external account credentialsGoogle-Auth | Critical9.8 |
| CVE-2026-13575 | HTTP::Session versions before 0.54 for Perl allow memcached command injection via unfiltered session ids in HTTP::Session::Store::CHIhttp-session | Medium5.6 |
| CVE-2026-115946 | XS::libbrotli versions before 1.2.1.0 for Perl bundle a brotli library with an out-of-bounds write in the decoderXS-libbrotli | Critical9.8 |
| CVE-2026-78192 | WebDyne versions from 2.022 before 3.022 for Perl disclose application source to unauthenticated clients via the viewer in the default index pageWebDyne | High7.5 |
| CVE-2026-78191 | WebDyne versions from 2.031 before 3.022 for Perl execute files with .psp anywhere in the name as Perl pagesWebDyne | Critical9.8 |
| CVE-2026-78190 | WebDyne versions from 2.014 before 3.022 for Perl reflect request parameters unescaped into form field values, allowing cross-site scriptingWebDyne | Medium6.1 |
| CVE-2026-78189 | WebDyne versions from 3.007 before 3.022 for Perl execute .psp files outside the document root via path traversal in the PSGI API route fallbackWebDyne | Critical9.8 |
| CVE-2026-78188 | WebDyne versions from 2.014 before 3.022 for Perl issue session cookies without the Secure, HttpOnly and SameSite attributesWebDyne | Medium5.4 |
| CVE-2026-118986 | CallBackery versions before 0.62.0 for Perl allow session cookie forgery via a signing secret generated with rand()CallBackery | High7.5 |
| CVE-2026-118987 | CallBackery versions before 0.62.0 for Perl accept session cookies of any age sent in the X-Session-Cookie headerCallBackery | Medium5.3 |
| CVE-2026-118990 | CallBackery versions before 0.62.0 for Perl leave a world-readable dump of the configuration database in /tmp when taking a configuration backupCallBackery | Medium5.5 |
| CVE-2026-118991 | CallBackery versions before 0.62.0 for Perl encrypt configuration backups with the padded password as the AES keyCallBackery | High7.5 |
| CVE-2026-118992 | CallBackery versions before 0.62.0 for Perl allow OS command execution via sqlite3 shell commands in a restored configuration backupCallBackery | High8.4 |
| CVE-2026-118993 | CallBackery versions before 0.62.0 for Perl allow denial of service via the request path interpolated as a regular expression under CGI, FastCGI and PSGICallBackery | High7.5 |
| CVE-2026-118994 | CallBackery versions before 0.62.0 for Perl allow log injection via newlines in the login nameCallBackery | Critical9.8 |
| CVE-2026-118995 | CallBackery versions before 0.62.0 for Perl accept unintended values in form fields checked by createRxValidatorCallBackery | Critical9.1 |