Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 8 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 405,790All CVEsplus 19,170 rejected
- 332Last 24 hours4,869 in the last 7 days
- 16,859Last 30 days1,490 of them critical
- 1,779Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 1 | 10 | 5 | 0 | 7 | 23 | 30 |
| 2025 | 1 | 2 | 4 | 0 | 0 | 7 | 7 |
| Title | ||
|---|---|---|
| CVE-2026-119723 | When parsing request variables such as query-string and form parameters, HHVM did not check that appending a nested array succeeded before descending into it.…Facebook · HHVM | Not scored |
| CVE-2026-121737 | When a remote, unauthenticated HTTP/1.1 client pipelined the start of a second request and then stopped reading, proxygen's coroutine-based HTTP session could…Facebook · proxygen | Not scored |
| CVE-2026-119237 | In proxygen's HTTP/3 session, when a HEADERS block referenced QPACK dynamic table entries that had not yet been received, header decoding for that stream was…Facebook · proxygen | Not scored |
| CVE-2026-119236 | An mvfst QUIC server retained CRYPTO frame data received at an encryption level (Initial or Handshake) that the TLS handshake had already moved past. Because…Facebook · mvfst | Not scored |
| CVE-2026-119235 | proxygen's QPACK decoder enforced its size limit on a string literal in an encoder-stream instruction only after the entire literal had been received. A…Facebook · proxygen | Not scored |
| CVE-2026-119234 | mvfst did not adequately merge or compact out-of-order STREAM frame data, and a small received fragment could keep a much larger receive buffer alive. QUIC…Facebook · mvfst | Not scored |
| CVE-2026-119233 | proxygen's HTTP/3 codec buffered an incomplete non-DATA frame, such as a control-stream frame, a frame of an unknown or reserved type, or a HEADERS frame,…Facebook · proxygen | Not scored |
| CVE-2026-104026 | In Sapling SCM prior to v0.2.20260929-102736, control characters were allowed to be embedded in Git subtree URLs. A maliciously constructed repository, if…Meta Platforms, Inc · Sapling SCM | High7.8 |
| CVE-2026-92172 | Prior to v66.0.0.733.524 of Meta Horizon OS, OVRMediaService could be induced to send a privileged PendingIntent including a com.oculus.horizon CallerIdentity…Meta Platforms, Inc · Meta Horizon OS | High8.8 |
| CVE-2026-92173 | Prior to v74.0.0.878.1682 of Meta Horizon OS, MediaSyncJobReceiver could be induced to send a privileged PendingIntent including a com.oculus.vrshell…Meta Platforms, Inc · Meta Horizon OS | Critical9.1 |
| CVE-2026-91096 | In proxygen from v2024.10.28.00 until v2026.09.28.00, WebTransportImpl::terminateSessionStreams (WebTransportImpl::destroy in releases before v2025.08.18.00)…Facebook · proxygen | High7.5 |
| CVE-2026-91095 | In proxygen from v2024.10.28.00 until v2026.09.28.00, the HTTPTransaction::onWebTransportUniStream and HTTPTransaction::onWebTransportBidiStream APIs could…Facebook · proxygen | Medium5.3 |
| CVE-2026-84895 | In proxygen from v2026.04.06.00 until v2026.09.28.00, QuicWtSession::closeSession accesses its member fields after calling the base…Facebook · proxygen | High7.3 |
| CVE-2026-84894 | In moxygen before commit 004123dd24c3, MoQSession::dataStreamReadLoop keeps using a stream read handle after reading a FIN, which invalidates the handle under…Meta Platforms, Inc · moxygen | High7.5 |
| CVE-2026-44909 | Proxygen lacked a generalized slow-consumer detection mechanism in its core HTTP session layer. A remote, unauthenticated attacker could exploit HTTP/2…Facebook · proxygen | High7.5 |
| CVE-2026-44907 | A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to excessive CPU…Meta · react-server-dom-turbopack | High7.5 |
| CVE-2026-23870 | A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to server…Meta · react-server-dom-turbopack | High7.5 |
| CVE-2026-23866 | Incomplete validation of AI rich response messages for Instagram Reels in WhatsApp for iOS v2.25.8.0 to v2.26.15.72 and WhatsApp for Android v2.25.8.0 to…Facebook · WhatsApp for Android | Medium4.3 |
| CVE-2026-23863 | An attachment spoofing issue in WhatsApp for Windows prior to v2.3000.1032164386.258709 could have allowed maliciously formatted documents with embedded NUL…Facebook · WhatsApp Desktop for Windows | Medium6.5 |
| CVE-2026-23869 | A denial of service vulnerability exists in React Server Components, affecting the following packages: react-server-dom-parcel, react-server-dom-turbopack and…Meta · react-server-dom-turbopack | High7.5 |
| CVE-2026-23868 | Giflib contains a double-free vulnerability that is the result of a shallow copy in GifMakeSavedImage and incorrect error handling. The conditions needed to…giflib · giflib | Medium5.1 |
| CVE-2026-23865 | An integer overflow in the tt_var_load_item_variation_store function of the Freetype library in versions 2.13.2 and 2.13.3 may allow for an out of bounds read…FreeType · FreeType | Medium5.3 |
| CVE-2026-23864 | Multiple denial of service vulnerabilities exist in React Server Components, affecting the following packages: react-server-dom-parcel,…Meta · react-server-dom-webpack | High7.5 |
| CVE-2025-67779 | It was found that the fix addressing CVE-2025-55184 in React Server Components was incomplete and does not prevent a denial of service attack in a specific…Meta · react-server-dom-parcel | High7.5 |
| CVE-2025-55184 | A pre-authentication denial of service vulnerability exists in React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1,…Public exploitMeta · react-server-dom-webpack | High7.5 |
| CVE-2025-55183 | An information leak vulnerability exists in specific configurations of React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and…Public exploitMeta · react-server-dom-webpack | Medium5.3 |
| CVE-2025-55182 | A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following…ExploitedPublic exploitMeta · react-server-dom-webpack | Critical10.0 |
| CVE-2025-55181 | Sending an HTTP request/response body with greater than 2^31 bytes triggers an infinite loop in proxygen::coro::HTTPQuicCoroSession which blocks the backing…Facebook · proxygen | Medium5.3 |
| CVE-2025-55179 | Incomplete validation of rich response messages in WhatsApp for iOS prior to v2.25.23.73, WhatsApp Business for iOS v2.25.23.82, and WhatsApp for Mac…Facebook · WhatsApp Business for iOS | Medium5.4 |
| CVE-2025-55178 | Llama Stack prior to version v0.2.20 accepted unverified parameters in the resolve_ast_by_type function which could potentially allow for remote code execution.Meta Platforms, Inc · Llama Stack | Medium5.3 |