Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 3 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 405,496All CVEsplus 19,165 rejected
- 585Last 24 hours4,926 in the last 7 days
- 18,770Last 30 days1,596 of them critical
- 1,779Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 8 | 6 | 3 | 0 | 0 | 17 | 63 |
| 2025 | 4 | 3 | 0 | 0 | 0 | 7 | 46 |
| 2024 | 4 | 32 | 3 | 0 | 0 | 39 | 39 |
| Title | ||
|---|---|---|
| CVE-2026-87988 | An arbitrary file access vulnerability in Mistral Vibe allows an attacker to bypass workspace restrictions through commands classified as unconditionally…mistralai · mistral-vibe | Critical10.0 |
| CVE-2026-87987 | An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using environment variable assignments…mistralai · mistral-vibe | Critical10.0 |
| CVE-2026-87986 | An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using shell constructs it's parser cannot…mistralai · mistral-vibe | Critical10.0 |
| CVE-2026-87985 | An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using ANSI-C quoted arguments. These arguments…mistralai · mistral-vibe | Critical10.0 |
| CVE-2026-87984 | An arbitrary file write vulnerability in Mistral Vibe, introduced in version 1.3.4, allows an attacker to create or overwrite files outside the active…mistralai · mistral-vibe | Critical9.3 |
| CVE-2026-87983 | An arbitrary file read vulnerability in Mistral Vibe, introduced in version 2.6.0, allows an attacker to bypass workspace restrictions using quoted absolute…mistralai · mistral-vibe | Critical9.2 |
| CVE-2026-79721 | Code execution can occur in versions of the MLflow platform running version 0.0.1 or newer, enabling a maliciously crafted model artifact to execute arbitrary…mlflow · mlflow | High8.6 |
| CVE-2026-79720 | Reflected XSS in Netron versions <=9.1.2 on desktop application through unsanitized node names allows an attacker to hide certain nodes, perform port scanning…Public exploitNetron · Netron | Medium6.8 |
| CVE-2026-79719 | Reflected XSS in Netron versions <=9.1.2 on desktop application through unsanitized node names allows an attacker to hide certain nodes, perform port scanning…Public exploitNetron · Netron | Medium6.8 |
| CVE-2026-79718 | Reflected XSS in Netron versions <=9.1.2 on desktop application through unsanitized node names allows an attacker to hide certain nodes, perform port scanning…Public exploitNetron · Netron | Medium6.8 |
| CVE-2026-45833 | A code injection vulnerability in version 0.4.17 or later of the ChromaDB Python project allows an authenticated attacker to run arbitrary code on the server…Public exploitChroma · ChromaDB | Critical9.4 |
| CVE-2026-45832 | All V1 collection-level endpoints in ChromaDB's Python project pass None for the tenant and database to the authorization layer, allowing attackers to bypass…Chroma · ChromaDB | High8.8 |
| CVE-2026-45831 | The SimpleRBACAuthorizationProvider authorization provider in versions 0.5.0 or later of the ChromaDB Python project evaluates whether a user holds a given…Chroma · ChromaDB | High8.8 |
| CVE-2026-8828 | A lack of authorization validation in version 1.0.0 or later of the ChromaDB Rust project allows any authenticated users to arbitrarily read, write, update, or…Chroma · ChromaDB | High8.8 |
| CVE-2026-45830 | A lack of authorization validation in version 0.4.17 or later of the ChromaDB Python project allows any authenticated users to arbitrarily read, write, update,…Chroma · ChromaDB | High8.8 |
| CVE-2026-45829 | A pre-authentication, code injection vulnerability in version 1.0.0 or later of the ChromaDB Python project allows an unauthenticated attacker to run arbitrary…Public exploitChroma · ChromaDB | Critical10.0 |
| CVE-2026-3071 | Deserialization of untrusted data in the LanguageModel class of Flair from versions 0.4.1 to latest are vulnerable to arbitrary code execution when loading a…Public exploitFlair · Flair | High8.4 |
| CVE-2025-62354 | Improper neutralization of special elements used in an OS command ('command injection') in Cursor allows an unauthorized attacker to execute commands that are…cursor · cursor | Critical9.8 |
| CVE-2025-62356 | A path traversal vulnerability in all versions of the Qodo Qodo Gen IDE enables a threat actor to read arbitrary local files in and outside of current projects…Public exploitQodo · Qodo Gen | High7.5 |
| CVE-2025-62353 | A path traversal vulnerability in all versions of the Windsurf IDE enables a threat actor to read and write arbitrary local files in and outside of current…Public exploitWindsurf · Windsurf | Critical9.8 |
| CVE-2025-49655 | Deserialization of untrusted data can occur in versions of the Keras framework running versions 3.11.0 up to but not including 3.11.3, enabling a maliciously…Public exploitKeras · Keras | Critical9.8 |
| CVE-2025-49653 | Exposure of sensitive Information allows account takeoverPublic exploitLablup · BackendAI | High8.0 |
| CVE-2025-49652 | Improper access control allows arbitrary account creationPublic exploitLablup · BackendAI | Critical9.8 |
| CVE-2025-49651 | Missing Authorization for Interactive SessionsPublic exploitLablup · BackendAI | High8.1 |
| CVE-2024-45858 | An arbitrary code execution vulnerability exists in versions 0.2.9 up to 0.5.10 of the Guardrails AI Guardrails framework because of the way it validates XML…Public exploitGuardrails AI · guardrails | High7.8 |
| CVE-2024-45856 | A cross-site scripting (XSS) vulnerability exists in all versions of the MindsDB platform, enabling the execution of a JavaScript payload whenever a user…mindsdb · mindsdb | Critical9.0 |
| CVE-2024-45855 | Deserialization of untrusted data can occur in versions 23.10.2.0 and newer of the MindsDB platform, enabling a maliciously uploaded ‘inhouse’ model to run…mindsdb · mindsdb | High7.1 |
| CVE-2024-45854 | Deserialization of untrusted data can occur in versions 23.10.3.0 and newer of the MindsDB platform, enabling a maliciously uploaded ‘inhouse’ model to run…mindsdb · mindsdb | High7.1 |
| CVE-2024-45853 | Deserialization of untrusted data can occur in versions 23.10.2.0 and newer of the MindsDB platform, enabling a maliciously uploaded ‘inhouse’ model to run…mindsdb · mindsdb | High7.1 |
| CVE-2024-45852 | Deserialization of untrusted data can occur in versions 23.3.2.0 and newer of the MindsDB platform, enabling a maliciously uploaded model to run arbitrary code…mindsdb · mindsdb | High8.8 |
| CVE-2024-45851 | An arbitrary code execution vulnerability exists in versions 23.10.5.0 up to 24.7.4.1 of the MindsDB platform, when the Microsoft SharePoint integration is…mindsdb · mindsdb | High8.8 |
| CVE-2024-45850 | An arbitrary code execution vulnerability exists in versions 23.10.5.0 up to 24.7.4.1 of the MindsDB platform, when the Microsoft SharePoint integration is…mindsdb · mindsdb | High8.8 |
| CVE-2024-45849 | An arbitrary code execution vulnerability exists in versions 23.10.5.0 up to 24.7.4.1 of the MindsDB platform, when the Microsoft SharePoint integration is…Public exploitmindsdb · mindsdb | High8.8 |
| CVE-2024-45848 | An arbitrary code execution vulnerability exists in versions 23.12.4.0 up to 24.7.4.1 of the MindsDB platform, when the ChromaDB integration is installed on…Public exploitmindsdb · mindsdb | High8.8 |
| CVE-2024-45847 | An arbitrary code execution vulnerability exists in versions 23.11.4.2 up to 24.7.4.1 of the MindsDB platform, when one of several integrations is installed on…Public exploitmindsdb · mindsdb | High8.8 |
| CVE-2024-45846 | An arbitrary code execution vulnerability exists in versions 23.10.3.0 up to 24.7.4.1 of the MindsDB platform, when the Weaviate integration is installed on…Public exploitmindsdb · mindsdb | High8.8 |
| CVE-2024-45857 | Deserialization of untrusted data can occur in versions 2.4.0 or newer of the Cleanlab project, enabling a maliciously crafted datalab.pkl file to run…Public exploitCleanlab · cleanlab | High7.8 |
| CVE-2024-27321 | An arbitrary code execution vulnerability exists in versions 0.0.8 and newer of the Refuel Autolabel library because of the way its multilabel classification…Public exploitRefuel · autolabel | High7.8 |
| CVE-2024-27320 | An arbitrary code execution vulnerability exists in versions 0.0.8 and newer of the Refuel Autolabel library because of the way its classification tasks handle…Public exploitRefuel · autolabel | High7.8 |
| CVE-2024-37066 | A command injection vulnerability exists in Wyze V4 Pro firmware versions before 4.50.4.9222, which allows attackers to execute arbitrary commands over…Wyze · Wyze Cam V4 Pro | Medium6.8 |
| CVE-2024-37065 | Deserialization of untrusted data can occur in versions 0.6 or newer of the skops python library, enabling a maliciously crafted model to run arbitrary code on…Skops-dev · Skops | High7.8 |
| CVE-2024-37064 | Deseriliazation of untrusted data can occur in versions 3.7.0 or newer of Ydata's ydata-profiling open-source library, enabling a maliciously crafted dataset…Public exploitYdataAI · ydata-profiling | High7.8 |
| CVE-2024-37063 | A cross-site scripting (XSS) vulnerability in versions 3.7.0 or newer of Ydata's ydata-profiling open-source library allows for payloads to be run when a…Public exploitYdataAI · ydata-profiling | High7.8 |
| CVE-2024-37062 | Deserialization of untrusted data can occur in versions 3.7.0 or newer of Ydata's ydata-profiling open-source library, enabling a malicously crafted report to…Public exploitYdataAI · ydata-profiling | High7.8 |
| CVE-2024-37061 | Remote Code Execution can occur in versions of the MLflow platform running version 1.11.0 or newer, enabling a maliciously crafted MLproject to execute…Public exploitMLflow · MLflow | High8.8 |
| CVE-2024-37060 | Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.27.0 or newer, enabling a maliciously crafted Recipe to…MLflow · MLflow | High8.8 |
| CVE-2024-37059 | Deserialization of untrusted data can occur in versions of the MLflow platform running version 0.5.0 or newer, enabling a maliciously uploaded PyTorch model to…MLflow · MLflow | High8.8 |
| CVE-2024-37058 | Deserialization of untrusted data can occur in versions of the MLflow platform running version 2.5.0 or newer, enabling a maliciously uploaded Langchain…Public exploitMLflow · MLflow | High8.8 |
| CVE-2024-37057 | Deserialization of untrusted data can occur in versions of the MLflow platform running version 2.0.0rc0 or newer, enabling a maliciously uploaded Tensorflow…Public exploitMLflow · MLflow | High8.8 |
| CVE-2024-37056 | Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.23.0 or newer, enabling a maliciously uploaded LightGBM…MLflow · MLflow | High8.8 |