Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 1 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 405,722All CVEsplus 19,170 rejected
- 445Last 24 hours4,858 in the last 7 days
- 16,905Last 30 days1,491 of them critical
- 1,779Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 1 | 1 | 7 | 0 | 0 | 9 | 25 |
| 2025 | 0 | 0 | 2 | 0 | 0 | 2 | 16 |
| 2024 | 0 | 0 | 0 | 0 | 0 | 0 | 14 |
| 2023 | 0 | 3 | 11 | 0 | 0 | 14 | 14 |
| Title | ||
|---|---|---|
| CVE-2026-127235 | OpenNMS reflected cross-site scripting in the web UI via request parametersThe OpenNMS Group · Meridian | Medium6.1 |
| CVE-2026-127236 | OpenNMS argument injection in ad-hoc RRD graphsThe OpenNMS Group · Meridian | Medium5.4 |
| CVE-2026-111252 | OpenNMS denial of service via XML entity expansionThe OpenNMS Group · Meridian | Medium6.5 |
| CVE-2026-111235 | OpenNMS REST authorization bypass via non-canonical HTTP methodThe OpenNMS Group · Meridian | Critical9.1 |
| CVE-2026-89089 | OpenNMS SQL injection in shipped Asset Management JasperReports via the DATE_FORMAT parameter (ROLE_USER)The OpenNMS Group · Meridian | Medium6.5 |
| CVE-2026-19596 | OpenNMS XML collector XXE allows arbitrary file read from the OpenNMS hostThe OpenNMS Group · Meridian | Medium5.9 |
| CVE-2026-89054 | OpenNMS missing authorization on /api/v2 PATCH endpoints allows unauthenticated configuration changesThe OpenNMS Group · Horizon | High8.2 |
| CVE-2026-19182 | OpenNMS v2 Alarm REST API inverted authorization check lets ROLE_REST users acknowledge alarms as any user and bypass read-onlyThe OpenNMS Group · Meridian | Medium4.3 |
| CVE-2026-19135 | OpenNMS JEXL sandbox bypass in Measurements REST API allows ROLE_USER to load arbitrary classesThe OpenNMS Group · Meridian | Medium5.4 |
| CVE-2025-53122 | SQLi in OpenNMS Horizon and MeridianThe OpenNMS Group · Horizon | Medium6.9 |
| CVE-2025-53121 | Stored XSS in multiple 33.0.8files in opennms/opennmsThe OpenNMS Group · Horizon | Medium6.9 |
| CVE-2023-40314 | Cross-site scripting in bootstrap.jspThe OpenNMS Group · Horizon | Medium5.8 |
| CVE-2023-40612 | Authenticated XXE Injection Via The File EditorThe OpenNMS Group · Horizon | Medium5.3 |
| CVE-2023-40315 | ROLE_FILESYSTEM_EDITOR Can Be Used To Escalate To ROLE_ADMINPublic exploitThe OpenNMS Group · Horizon | Medium5.3 |
| CVE-2023-40313 | Disable BeanShell Interpreter Remote Server ModeThe OpenNMS Group · Horizon | High7.1 |
| CVE-2023-40312 | Reflected XSS in multiple JSP files in opennms/opennmsThe OpenNMS Group · Horizon | Medium6.7 |
| CVE-2023-40311 | Stored XSS in multiple JSP files in opennms/opennmsThe OpenNMS Group · Horizon | Medium6.7 |
| CVE-2023-0872 | ROLE_REST can be used to escalate to ROLE_ADMIN via /rest/usersPublic exploitThe OpenNMS Group · Horizon | High8.2 |
| CVE-2023-0871 | An XML External Entity injection vulnerabilityThe OpenNMS Group · Horizon | Medium5.4 |
| CVE-2023-0870 | Form Can Be Manipulated with Cross-Site Request Forgery (CSRF)The OpenNMS Group · Meridian | High8.1 |
| CVE-2023-0815 | Plaintext Password Present in the Web logsThe OpenNMS Group · Meridian | Medium6.8 |
| CVE-2023-0867 | Multiple stored and reflected Cross-site Scripting in webappThe OpenNMS Group · Meridian | Medium6.7 |
| CVE-2023-0868 | Stealing Cookies using Reflected XSS via graph resultsThe OpenNMS Group · Meridian | Medium6.7 |
| CVE-2023-0869 | Cross-site scripting in outage/list.htmThe OpenNMS Group · Meridian | Medium5.8 |
| CVE-2023-0846 | Unauthenticated, stored XSS in display of alarm reduction-keyThe OpenNMS Group · Horizon | Medium6.7 |