Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 5 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 402,515All CVEsplus 19,144 rejected
- 391Last 24 hours3,362 in the last 7 days
- 16,979Last 30 days1,508 of them critical
- 1,769Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 0 | 8 | 9 | 6 | 0 | 23 | 33 |
| 2025 | 0 | 1 | 5 | 0 | 0 | 6 | 10 |
| 2024 | 0 | 3 | 1 | 0 | 0 | 4 | 4 |
| Title | ||
|---|---|---|
| CVE-2026-123824 | Symfony: XXE (Local File Read) in Config XmlUtils::parse() via validateOnParse = truesensiolabs · symfony | Low2.3 |
| CVE-2026-122053 | Symfony: ObjectNormalizer Dotted-Key Property-Path Traversal Bypasses #[Ignore] on Nested Objectssensiolabs · symfony | Medium6.9 |
| CVE-2026-118515 | Symfony: The Serializer Builds UploadedFile Objects From Request Data, Letting a Client Point an Upload at Any Server Filesensiolabs · symfony | High8.4 |
| CVE-2026-121623 | Symfony: DataUriNormalizer Opens Data URIs With a Non-Lowercase Scheme as Local Files, Letting a Client Read Any Server Filesensiolabs · symfony | High8.2 |
| CVE-2026-123792 | Symfony: Exponential and Quadratic Parse Times in the YAML Parser Let a Single Document Hold a Processsensiolabs · symfony | High8.7 |
| CVE-2026-123339 | Symfony: Inline Fragments Let Untrusted Forwarded Headers Set the Host, Scheme and Port of the URLs Generated for the Main Requestsensiolabs · symfony | Low2.3 |
| CVE-2026-118514 | Symfony: HEAD Requests Bypass the methods Option of security.access_control Rules and Firewallssymfony · symfony | Medium6.3 |
| CVE-2026-123746 | Symfony: Programmatic Logins Skip the checkPostAuth() Method of User Checkerssensiolabs · symfony | Low2.3 |
| CVE-2026-121949 | Symfony: HtmlSanitizer Does Not URL-Sanitize srcset and imagesrcset: Media Scheme and Host Allow-List Bypasssensiolabs · symfony | Low2.3 |
| CVE-2026-118517 | Symfony: HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URLs Without a Well-Formed Authority (Incomplete Fix for CVE-2026-45066)Public exploitsensiolabs · symfony | Low2.3 |
| CVE-2026-123125 | Symfony: Ip Constraint public/private Modes Accept IPv4-Mapped and IPv4-Compatible IPv6 Addresses allowing SSRF Filter Bypasssensiolabs · symfony | Medium6.3 |
| CVE-2026-123119 | Symfony: NoPrivateNetworkHttpClient Does Not Pin the Checked IP of Cached Hosts, Letting DNS Rebinding Enumerate Internal Ports (Incomplete Fix for CVE-2024-50342)sensiolabs · symfony | Low2.3 |
| CVE-2026-121971 | Symfony: ScopingHttpClient Sends the Credentials of Its Default Scope to Other Origins Through Network-Path Referencessensiolabs · symfony | High8.2 |
| CVE-2026-121373 | Symfony: HtmlSanitizer MetaRefreshAttributeSanitizer Matches Only a Narrow Subset of the Browser Refresh Grammar (Incomplete Fix for CVE-2026-48761)sensiolabs · symfony | Medium5.3 |
| CVE-2026-118516 | Symfony: Host Placeholders Can Match the Start of the Path in Compiled URL Matchers, Bypassing Path-Based Access Controlsensiolabs · symfony | Medium6.3 |
| CVE-2026-118513 | Symfony: X.509 Authentication Impersonation via DN Value Injection (incomplete fix for CVE-2026-45063)sensiolabs · symfony | High7.7 |
| CVE-2026-77157 | ast-cli: Auto-update downloads are not verified against a checksum before executionCheckmarx · github.com/checkmarx/ast-cli | Medium6.3 |
| CVE-2026-77156 | ast-cli: Path traversal in tar extraction on Linux/macOS allows writes outside the install directoryCheckmarx · github.com/checkmarx/ast-cli | Medium6.3 |
| CVE-2026-109449 | Symfony: Unbounded Nesting in the Expression Parser Lets Untrusted Expressions Crash the Processsensiolabs · symfony | High8.7 |
| CVE-2026-109413 | Symfony: Unbounded Recursion in the YAML Inline Lexer Lets a Single Document Crash the Processsensiolabs · symfony | High8.7 |
| CVE-2026-108082 | Symfony: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Headersensiolabs · symfony | High8.7 |
| CVE-2026-9591 | Cross-Site Request Forgery (CSRF) in SimplCommerce News Modulesimplcommerce · SimplCommerce | Medium6.9 |
| CVE-2026-11975 | Stored Cross-Site Scripting (XSS) in SimplCommerce News Module Admin Interfacesimplcommerce · SimplCommerce | Medium6.2 |
| CVE-2014-125128 | 'sanitize-html' prior to version 1.0.3 is vulnerable to Cross-site Scripting (XSS). The function 'naughtyHref' doesn't properly validate the hyperreference…Public exploitsanitize-html | Medium6.1 |
| CVE-2019-25225 | `sanitize-html` prior to version 2.0.0-beta is vulnerable to Cross-site Scripting (XSS). The `sanitizeHtml()` function in `index.js` does not sanitize content…Public exploitsanitize-html | Medium6.1 |
| CVE-2014-125127 | Denial of Service (DoS) vulnerability in mikecao/flightPublic exploitflightphp · core | High7.5 |
| CVE-2025-6050 | Stored Cross-Site Scripting (XSS) in Mezzanine CMS Admin InterfacePublic exploitjupo · mezzanine | Medium4.8 |
| CVE-2018-25110 | Regular Expression Denial of Service (ReDoS) in markedjs/markedPublic exploitmarked | Medium6.9 |
| CVE-2025-0825 | CRLF injection in Cpp-httplibcpp-httplib | Medium6.9 |
| CVE-2024-8374 | Arbitrary Code Injection in CuraUltimaker · Cura | High7.8 |
| CVE-2024-5685 | Broken Function Level Authorization (BFLA) in snipe/snipe-itsnipe · snipe-it | High7.6 |
| CVE-2024-4068 | Memory Exhaustion in bracesmicromatch · braces | High7.5 |
| CVE-2024-4067 | Regular Expression Denial of Service in micromatchmicromatch · micromatch | Medium5.3 |