Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 9 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 405,719All CVEsplus 19,170 rejected
- 442Last 24 hours4,857 in the last 7 days
- 16,902Last 30 days1,491 of them critical
- 1,779Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 19 | 60 | 39 | 6 | 0 | 124 | 231 |
| 2025 | 11 | 13 | 10 | 1 | 0 | 35 | 107 |
| 2024 | 2 | 6 | 14 | 2 | 0 | 24 | 72 |
| 2023 | 3 | 7 | 7 | 1 | 0 | 18 | 48 |
| 2022 | 0 | 6 | 7 | 0 | 0 | 13 | 30 |
| 2021 | 1 | 6 | 9 | 1 | 0 | 17 | 17 |
| Title | ||
|---|---|---|
| CVE-2026-19877 | Brute-forceable image-share link password in INFINITT ULiteINFINITT Healthcare · INFINITT ULite | High7.5 |
| CVE-2026-19876 | Reflected XSS in INFINITT ULite login error page (pre-auth)INFINITT Healthcare · INFINITT ULite | Medium6.1 |
| CVE-2026-114421 | Empty initial password permits GINA account takeoverSEPPmail AG · SEPPmail Secure Email Gateway (SEG) | High8.3 |
| CVE-2026-114420 | LDAP wildcard injection exposes GINA recipient accountsSEPPmail AG · SEPPmail Secure Email Gateway (SEG) | Medium6.9 |
| CVE-2026-114426 | Pre-authentication upload parsing permits resource exhaustionSEPPmail AG · SEPPmail Secure Email Gateway (SEG) | High8.7 |
| CVE-2026-114425 | Forged LFT metadata permits arbitrary file read and deletionSEPPmail AG · SEPPmail Secure Email Gateway (SEG) | Critical9.2 |
| CVE-2026-114424 | Code execution through double evaluation in address replacement rulesSEPPmail AG · SEPPmail Secure Email Gateway (SEG) | Critical9.2 |
| CVE-2026-115425 | Multiple cross-site scripting (XSS) in OPNsenseOPNsense · OPNsense firewall | Medium5.6 |
| CVE-2026-114357 | DJI CrystalSky ZS600C ships ADB without authentication (ro.adb.secure=0)DJI · CrystalSky ZS600C | High7.0 |
| CVE-2026-114356 | DJI CrystalSky ZS600C DJIUpdateService binder exposes privileged operations without authorizationDJI · CrystalSky ZS600C | High7.0 |
| CVE-2026-114355 | DJI CrystalSky ZS600C hardware_monitor evaluates attacker-controlled log data as rootDJI · CrystalSky ZS600C | High8.6 |
| CVE-2026-114354 | DJI CrystalSky ZS600C android.dji.server binder transaction 1018 command injection as rootDJI · CrystalSky ZS600C | High8.6 |
| CVE-2026-114353 | DJI CrystalSky ZS600C USB-gadget backdoor allows root command executionDJI · CrystalSky ZS600C | High7.0 |
| CVE-2026-14933 | Unblu Spark Cross-Site Scripting in Embedded Co-BrowsingUnblu inc. · Unblu Spark | High8.6 |
| CVE-2026-9589 | Unblu Spark Authorization Bypass in Configuration Cascade OperationsUnblu inc. · Unblu Spark | Critical9.3 |
| CVE-2026-108120 | path traversal inKoozali - SME Serverkoozali · SME Server | High7.7 |
| CVE-2026-108121 | Koozali - SME Server Improper Input Validation in domain Creation Leads to Denial of ServiceKoozali · SME Server | Medium6.9 |
| CVE-2026-104811 | Mitel MiVoice Office 400 Music on Hold WAV File Upload Code ExecutionMitel · Mitel MiVoice Office 400 | High8.4 |
| CVE-2026-104810 | Mitel MiVoice Office 400 File Management File Browser path traversal vulnerabilityMitel · Mitel MiVoice Office 400 | High8.4 |
| CVE-2026-104809 | Mitel MiVoice Office 400 Shared Object Hijacking Leading to Arbitrary Code ExecutionMitel · Mitel MiVoice Office 400 | High8.4 |
| CVE-2026-104808 | Mitel MiVoice Office 400 stored Cross-Site ScriptingMitel · Mitel MiVoice Office 400 | Low1.9 |
| CVE-2026-104807 | Mitel MiVoice Office 400 stored Cross-Site ScriptingMitel · Mitel MiVoice Office 400 | Low1.9 |
| CVE-2026-104806 | Mitel MiVoice Office 400 System Logs Path Traversal Information DisclosureMitel · Mitel MiVoice Office 400 | Medium5.5 |
| CVE-2026-104805 | Mitel MiVoice Office 400 Backup Restoration Arbitrary File Write Leading to Root Code ExecutionMitel · Mitel MiVoice Office 400 | High8.5 |
| CVE-2026-104706 | Mitel MiVoice Office 400 view system files path traversalMitel · Mitel MiVoice Office 400 | High8.4 |
| CVE-2026-104721 | Logback: Incomplete protection against CVE-2026-19880QOS.CH Sarl · Logback-classic | Medium6.3 |
| CVE-2026-104733 | User Impersonation/Authorization Bypass in XMPP Server ejabberdProcessOne · ejabberd | High7.4 |
| CVE-2026-84830 | OS command injection in privileged configuration handlingSEPPmail AG · Secure Email Gateway | High8.6 |
| CVE-2026-84832 | Unsafe deserialization in the REST interfaceSEPPmail AG · SEPPmail Secure Email Gateway (SEG) | High8.6 |
| CVE-2026-84831 | Mandatory MFA bypass before enrollmentSEPPmail AG · SEPPmail Secure Email Gateway (SEG) | High7.7 |
| CVE-2026-14208 | Local Privilege Escalation via Insecure DLL Permissions in Remote Utilities Host <=7.7.3.0Remote Utilities Pte. Ltd. · Remote Utilities Host | High7.3 |
| CVE-2026-19880 | Incomplete protection against CVE-2025-11226QOS.CH Sarl · Logback-classic | Medium6.3 |
| CVE-2026-16458 | Timing side-channel in RSA PKCS#1 v1.5 decryption in ocryptoOberon microsystems AG · ocrypto | Medium5.9 |
| CVE-2026-16459 | Timing side-channel in RSA PKCS#1 v1.5 decryption in Oberon PSA CryptoOberon microsystems AG · Oberon PSA Crypto | Medium5.9 |
| CVE-2026-54205 | TeamDavid: Server-Side Request Forgery (SSRF) via 'pathname' parameter in link storing functionalityPublic exploitTobit Laboratories AG · TeamDavid | Medium6.3 |
| CVE-2026-54218 | TeamDavid: Weak Cryptography and Insecure Password StoragePublic exploitTobit Laboratories AG · TeamDavid | High8.8 |
| CVE-2026-54217 | TeamDavid: Stored XSS in web applicationPublic exploitTobit Laboratories AG · TeamDavid | Medium5.3 |
| CVE-2026-54216 | TeamDavid: Reflected Cross Site Scripting (XSS) via the 'EntryInfo' parameterPublic exploitTobit Laboratories AG · TeamDavid | Medium5.3 |
| CVE-2026-54215 | TeamDavid: Open Redirect via the 'replyUrl' parameterPublic exploitTobit Laboratories AG · TeamDavid | Medium5.3 |
| CVE-2026-54214 | TeamDavid: Header Injection through the 'cType' URL parameterPublic exploitTobit Laboratories AG · TeamDavid | Medium5.3 |
| CVE-2026-54213 | TeamDavid: Denial of Service via endpoint 'internalRestart'Public exploitTobit Laboratories AG · TeamDavid | Critical9.2 |
| CVE-2026-54212 | TeamDavid: Buffer Overflow in JSON-parsingPublic exploitTobit Laboratories AG · TeamDavid | Critical9.5 |
| CVE-2026-54211 | TeamDavid: Buffer Overflow in multiple form data parametersTobit Laboratories AG · TeamDavid | Critical9.5 |
| CVE-2026-54210 | TeamDavid: Buffer Overflow in file names of file upload functionalitiesTobit Laboratories AG · TeamDavid | Critical9.5 |
| CVE-2026-54209 | TeamDavid: Buffer Overflow in 'editini' functionTobit Laboratories AG · TeamDavid | High8.9 |
| CVE-2026-54208 | TeamDavid: Arbitrary File Write leading to Stored XSSTobit Laboratories AG · TeamDavid | High8.5 |
| CVE-2026-54207 | TeamDavid: Server-Side Request Forgery (SSRF) via 'pathname' parameter in move archive functionalityTobit Laboratories AG · TeamDavid | Medium6.3 |
| CVE-2026-54206 | TeamDavid: Server-Side Request Forgery (SSRF) via 'pathname' parameter in sending functionalityTobit Laboratories AG · TeamDavid | Medium6.3 |
| CVE-2026-54204 | TeamDavid: Server-Side Request Forgery (SSRF) via 'pathnameroot' parameter in search functionalityTobit Laboratories AG · TeamDavid | High7.7 |
| CVE-2026-54203 | TeamDavid: Memory Leak leaking sensitive informationTobit Laboratories AG · TeamDavid | Critical9.2 |