Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 2 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 405,750All CVEsplus 19,170 rejected
- 378Last 24 hours4,866 in the last 7 days
- 16,927Last 30 days1,491 of them critical
- 1,779Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 389 | 616 | 5,180 | 183 | 0 | 6,368 | 17,983 |
| 2025 | 52 | 657 | 5,038 | 154 | 0 | 5,901 | 11,615 |
| 2024 | 11 | 438 | 2,210 | 271 | 0 | 2,930 | 5,714 |
| 2023 | 5 | 125 | 1,232 | 569 | 0 | 1,931 | 2,784 |
| 2022 | 1 | 75 | 467 | 310 | 0 | 853 | 853 |
| Title | ||
|---|---|---|
| CVE-2026-127273 | Linksys EA8100 JNAP API IsAdminPasswordDefault missing authenticationPublic exploitLinksys · EA8100 | Medium5.3 |
| CVE-2026-127120 | Governikus AusweisApp Mobile StartPAOSResponse cross site scriptingGovernikus · AusweisApp Mobile | Medium5.3 |
| CVE-2026-126998 | JeecgBoot Authentication Filter call OpenApiController.call server-side request forgeryPublic exploitJeecgBoot | Medium6.9 |
| CVE-2026-126997 | JeecgBoot flow-run Endpoint a.class RestTemplate.exchange server-side request forgeryPublic exploitJeecgBoot | Medium6.9 |
| CVE-2026-126996 | SakanaAI text-to-LoRA Checkpoint Loading model_loading.py get_tokenizer path traversalPublic exploitSakanaAI · text-to-LoRA | Medium5.3 |
| CVE-2026-126995 | tjake Jlama SafeTensorIndex.java SafeTensorIndex.loadWeights path traversalPublic exploittjake · Jlama | Medium5.3 |
| CVE-2026-126994 | braindecode Model Config Deserialization util.py resolve_type_kwargs externally-controlled input to select classes or codePublic exploitbraindecode | Medium5.3 |
| CVE-2026-126993 | SiteServer SSCMS captcha inadequate encryptionSiteServer · SSCMS | Medium6.9 |
| CVE-2026-126795 | ToolJet Onboarding Signup Endpoint util.service.ts activateUserWithPassword missing authenticationPublic exploitToolJet | Medium6.9 |
| CVE-2026-126785 | rmalright TR-VISION HOME IOCTL WFanManager.sys sub_11504 default permissionrmalright · TR-VISION HOME | Critical9.3 |
| CVE-2026-126759 | H3C ICG2000 Unified Communication Gateway Web Management check.j missing authenticationH3C · ICG2000 Unified Communication Gateway | Medium6.9 |
| CVE-2026-126758 | Moonshot AI Kimi Code WorkspaceDirsService local.toml reliance on untrusted inputs in a security decisionPublic exploitMoonshot AI · Kimi Code | Medium4.8 |
| CVE-2026-126757 | Moonshot AI Kimi Code Web UI index-HU0LCM-X.js isOriginAllowed redirectPublic exploitMoonshot AI · Kimi Code | Medium5.3 |
| CVE-2026-124503 | sooperset mcp-atlassian io.py validate_safe_path path traversalPublic exploitsooperset · mcp-atlassian | Medium5.3 |
| CVE-2026-125087 | Michael-A-Kuykendall Shimmy Inference API server.rs missing authenticationMichael-A-Kuykendall · Shimmy | Medium6.9 |
| CVE-2026-125086 | D-Link M60 emDaemon MQTT Broker mosquitto.conf system hard-coded credentialsPublic exploitD-Link · M60 | Critical10.0 |
| CVE-2026-125082 | sunkaifei FlyCMS Content Rendering detail.html ModelDataService.insertData cross site scriptingPublic exploitsunkaifei · FlyCMS | Medium5.1 |
| CVE-2026-125079 | D-Link DCS-6501LH Media Service SystemConfig.ini mydlink_default_sys_info hard-coded credentialsPublic exploitD-Link · DCS-6501LH | Medium6.9 |
| CVE-2026-125078 | SourceCodester Smart Attendance System with QR Code Scanner login.php session fixiationPublic exploitSourceCodester · Smart Attendance System with QR Code Scanner | Medium5.3 |
| CVE-2026-125077 | SourceCodester Smart Attendance System with QR Code Scanner cross-site request forgeryPublic exploitSourceCodester · Smart Attendance System with QR Code Scanner | Medium5.3 |
| CVE-2026-125076 | SourceCodester Smart Attendance System with QR Code Scanner JSON Endpoint attendance_handler.php missing authenticationPublic exploitSourceCodester · Smart Attendance System with QR Code Scanner | Medium6.9 |
| CVE-2026-125075 | SourceCodester Smart Attendance System with QR Code Scanner Admin Account Creation create_admin.php getMessage missing authenticationPublic exploitSourceCodester · Smart Attendance System with QR Code Scanner | Medium6.9 |
| CVE-2026-125074 | SourceCodester Smart Attendance System with QR Code Scanner Password Reset reset_password.php password recoveryPublic exploitSourceCodester · Smart Attendance System with QR Code Scanner | Medium6.9 |
| CVE-2026-124999 | braindecode Hub Integration base.py EEGModuleMixin._from_pretrained path traversalPublic exploitbraindecode | Medium5.3 |
| CVE-2026-124996 | Turboderp-org ExLlamaV3 hash-MoE routing routing.cu routing_sel_norm_kernel out-of-boundsTurboderp-org · ExLlamaV3 | Medium5.3 |
| CVE-2026-124994 | Turboderp-org ExLlamaV3 NGramEmbedding ngram.cu ngram_dequant out-of-boundsPublic exploitTurboderp-org · ExLlamaV3 | Medium5.3 |
| CVE-2026-124992 | nushell Data Conversion ser.rs escape_bytes control sequencenushell | Medium4.8 |
| CVE-2026-124987 | mikefarah yq encoder_properties.go Encode escape outputmikefarah · yq | Medium5.3 |
| CVE-2026-124834 | iomad Password Field company_user.php store_temporary_password information disclosureiomad | Medium6.3 |
| CVE-2026-124636 | kevquirk PureBlog Page Editor content.php save_page path traversalkevquirk · PureBlog | Medium5.1 |
| CVE-2026-124635 | kevquirk PureBlog Admin Image Upload Endpoint upload-image.php unrestricted uploadkevquirk · PureBlog | Medium5.1 |
| CVE-2026-124625 | PipraPay Admin Panel pp-functions.php deleteData sql injectionPublic exploitPipraPay | Medium5.3 |
| CVE-2026-124624 | PipraPay pp-token anti-CSRF pp-adapter.php hash_hmac hard-coded credentialsPublic exploitPipraPay | Medium6.9 |
| CVE-2026-124623 | PipraPay ZIP Archive system-settings-import unrestricted uploadPublic exploitPipraPay | Medium5.1 |
| CVE-2026-124622 | olivier-ls PHP-FTS Storage.php open toctouolivier-ls · PHP-FTS | Medium4.8 |
| CVE-2026-124621 | kongxin-github Java_Library_Management_System Swing UI Layer MainInterface.java Landing.sureadmin improper authorizationPublic exploitkongxin-github · Java_Library_Management_System | Medium5.3 |
| CVE-2026-113702 | iomad PDF Certificate lib.php local_iomad_pluginfile authorizationiomad | Medium5.3 |
| CVE-2026-124591 | Bahleel CsvExporter.php fputcsv csv injectionBahleel | Medium5.1 |
| CVE-2026-124590 | zhangbw409 library_manager_system UserController.java BookController.addBook improper authorizationPublic exploitzhangbw409 · library_manager_system | Medium6.9 |
| CVE-2026-124589 | lxtGH OMG-Seg MoE Shard Checkpoint Loader handle_moe_load_and_save.py load_state_dict_into_model path traversalPublic exploitlxtGH · OMG-Seg | Medium5.3 |
| CVE-2026-124588 | huggingface finetrainers Model Index model.py resolve_component_cls code injectionPublic exploithuggingface · finetrainers | Medium5.3 |
| CVE-2026-124587 | elizaOS eliza HTTP Server api-base-owner.ts information disclosurePublic exploitelizaOS · eliza | Medium5.3 |
| CVE-2026-124586 | Tencent RapidJSON diyfp.h GetCachedPowerByIndex out-of-boundsPublic exploitTencent · RapidJSON | Medium6.9 |
| CVE-2026-124585 | Chengdu Feiyuxing Technology VW2100/VEC10GP Web Administration webserver add_expmac os command injectionPublic exploitChengdu Feiyuxing Technology · VW2100 | Critical9.4 |
| CVE-2026-124584 | wummel patool Gzip Extraction fileutil.py extract_gzip symlinkwummel · patool | Medium4.8 |
| CVE-2026-124582 | WebTorrent File Path torrent.js getFileModtimes path traversalPublic exploitWebTorrent | Medium5.3 |
| CVE-2026-124581 | itsourcecode Airline Reservation System manage_flight.php sql injectionPublic exploititsourcecode · Airline Reservation System | Medium6.9 |
| CVE-2026-124580 | Chengdu Feiyuxing Technology VW2100/VEC10GP Weixin Auth Endpoint webserver handle_wechat_cn_wifi os command injectionPublic exploitChengdu Feiyuxing Technology · VW2100 | Critical10.0 |
| CVE-2026-124579 | aaPanel BillionMail Relay Configuration API relay.go injectionPublic exploitaaPanel · BillionMail | Medium5.3 |
| CVE-2026-124578 | Pantum BP5100DW Web omDB.shtml missing authenticationPantum · BP5100DW | Medium6.9 |