Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 10 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 402,712All CVEsplus 19,156 rejected
- 566Last 24 hours3,406 in the last 7 days
- 17,077Last 30 days1,527 of them critical
- 1,772Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 1,079 | 4,766 | 3,905 | 313 | 0 | 10,063 | 11,184 |
| 2025 | 329 | 444 | 300 | 0 | 0 | 1,073 | 1,121 |
| 2024 | 11 | 14 | 12 | 1 | 0 | 38 | 48 |
| 2023 | 5 | 3 | 2 | 0 | 0 | 10 | 10 |
| Title | ||
|---|---|---|
| CVE-2026-125406 | Ettercap through 0.8.4.1 Stack Buffer Underwrite via Telnet Dissector Backspace HandlingEttercap · ettercap | High8.7 |
| CVE-2026-125405 | Ettercap through 0.8.4.1 Out-of-Bounds Read via HTTP NTLM Authentication ParsingEttercap · ettercap | High7.2 |
| CVE-2026-125404 | Ettercap through 0.8.4.1 Stack Buffer Overflow via WPA CCMP DecryptionEttercap · ettercap | High7.7 |
| CVE-2026-125403 | Ettercap through 0.8.4.1 Out-of-Bounds Read via sslw_remove_stsEttercap · ettercap | High7.2 |
| CVE-2026-125402 | Ettercap through 0.8.4.1 Heap Out-of-Bounds Read via TLS SNI ParsingEttercap · ettercap | High7.2 |
| CVE-2026-125401 | Ettercap through 0.8.4.1 Heap Buffer Overflow via Gadu-Gadu DissectorEttercap · ettercap | High7.2 |
| CVE-2026-125400 | Ettercap through 0.8.4.1 Use-After-Free via PCRE2 Filter SubstitutionEttercap · ettercap | High8.7 |
| CVE-2026-125399 | Fluxion before 6.39 OS Command Injection via Crafted SSIDFluxionNetwork · fluxion | High8.6 |
| CVE-2026-125398 | Instatic before 0.0.21 Authorization Bypass via Row Author Reassignment EndpointCoreBunch · Instatic | High7.1 |
| CVE-2026-125397 | NocoBase plugin-ai 2.1.0 through 2.2.41 Authorization Bypass via Sub-Agent Username Overridenocobase · nocobase | High7.1 |
| CVE-2026-125396 | Ghostscript before 10.08.0 -dSAFER Bypass via .putgstringcopy .forceput RecoveryArtifexSoftware · ghostpdl | High8.5 |
| CVE-2026-125395 | Ampache before 8.4.0 Stored XSS via Song Lyrics ID3 Tagampache · ampache | Medium5.1 |
| CVE-2026-125394 | FreeRDP before 3.33.0 Use-After-Free via Stale Brush Cache PointerFreeRDP · FreeRDP | Medium5.3 |
| CVE-2026-125393 | MailEnable Enterprise Premium before 10.62 Heap Overflow via IMAP X-FB-FETCHMailEnable · MailEnable Enterprise Premium | High7.1 |
| CVE-2026-125392 | Webmin through 2.670 Stored XSS via BIND8 edit_recs.cgi ALL Viewwebmin · webmin | Medium5.1 |
| CVE-2026-125391 | Webmin through 2.670 OS Command Injection via Samba User Account Optionswebmin · webmin | High8.6 |
| CVE-2026-125390 | Group-Office before 6.8.181, 25.0.116, and 26.0.58 Local File Read via processUploadQueueIntermesh · Group-Office | High7.1 |
| CVE-2026-125389 | Group-Office before 6.8.181, 25.0.116, and 26.0.58 Stored XSS via filterXSS BypassIntermesh · Group-Office | Medium5.3 |
| CVE-2026-125388 | Group-Office before 6.8.181, 25.0.116, and 26.0.58 Missing Authorization in Forms Report DownloadIntermesh · Group-Office | High7.1 |
| CVE-2026-125387 | Faveo Helpdesk through 2.0.3 Cross-Department Ticket Tampering via TicketControllerfaveosuite · faveo-helpdesk | Medium5.3 |
| CVE-2026-125386 | langchain4j-aideepin through 3.32.0 IDOR via /character/message reference endpointsmoyangzhan · langchain4j-aideepin | Medium6.0 |
| CVE-2026-125385 | INDOTALENT WHMS before 10.20261109 Path Traversal via FileDocument/GetDocument and FileImage/GetImagego2ismail · Asp.Net-Core-Inventory-Order-Management-System | High7.1 |
| CVE-2026-125384 | INDOTALENT WHMS before 10.20261109 Default Administrator Credentials via UserAdminSeedergo2ismail · Asp.Net-Core-Inventory-Order-Management-System | Critical9.3 |
| CVE-2026-125383 | INDOTALENT WHMS before 10.20261109 Hard-Coded JWT Signing Key Authentication Bypassgo2ismail · Asp.Net-Core-Inventory-Order-Management-System | Critical9.3 |
| CVE-2026-125382 | Map-OS 5.0.0 to before 5.2.2 Privilege Escalation via /api/v1/usuariosRamonSilva20 · mapos | High8.6 |
| CVE-2026-125381 | DataRoom through 3.0.0 SQL Injection via MyBatisService.generateSqlgcpaas · DataRoom | Medium6.0 |
| CVE-2026-125380 | DataRoom through 3.0.0 Incorrect Authorization via /dataRoom/dataset/run/testgcpaas · DataRoom | High7.1 |
| CVE-2026-125379 | Movim through 0.35.5 Authorization Bypass via Post::ajaxGetPost Cached Post Readmovim · movim | Low2.3 |
| CVE-2026-125378 | PowerDNS-Admin before 2026.11.0 Missing Authorization via Template Apply EndpointPowerDNS-Admin · PowerDNS-Admin | Medium5.3 |
| CVE-2026-125377 | Pig before 4.1.2 Missing Authorization Exposes OAuth2 Client Secrets via /clientpig-mesh · pig | High7.1 |
| CVE-2026-125376 | VanBlog through 0.54.0 Private Article Disclosure via Public Password EndpointMereithhh · vanblog | Medium6.9 |
| CVE-2026-125375 | MrDoc through 1.1.1 Missing Authorization via Project Document Sort Handlerszmister2016 · MrDoc | Medium5.3 |
| CVE-2026-125374 | Krayin CRM before 2.2.8 Broken Object Level Authorization via Lead Tag Attach/Detachkrayin · laravel-crm | Medium5.3 |
| CVE-2026-125373 | IETF Datatracker before 12.83.0 Cross-NomCom Authorization Bypass via Nomcom Viewsietf-tools · datatracker | Medium5.3 |
| CVE-2026-125372 | REBUILD before 4.5.3 Authorization Bypass via Feeds Details and Comments Endpointsgetrebuild · rebuild | Medium5.3 |
| CVE-2026-125371 | Tinyproxy through 1.11.3 Hostname ACL Allow-List Bypass via Suffix Matchtinyproxy · tinyproxy | Medium6.3 |
| CVE-2026-125370 | Kubero 3.0.0 through 3.1.1 Authentication Bypass via Hardcoded JWT Secretkubero-dev · kubero | Critical9.3 |
| CVE-2026-125369 | Bitpoll through 0.11.0 Unauthenticated Vote and Comment Disclosure via Unscoped Lookupsfsinfuhh · Bitpoll | Medium6.9 |
| CVE-2026-125368 | OmniAgent Bash Approval Gate Bypass via find -execdir in Safe-Command AllowlistYeQing17-2026 · OmniAgent | High7.7 |
| CVE-2026-125367 | Pico through 4.1.2 SSRF in Feeds Service via run SSH Commandpicosh · pico | Medium5.3 |
| CVE-2026-125366 | Omnom through 0.9.0 SSRF via Add Feed /add_feed Routeasciimoo · omnom | Medium5.3 |
| CVE-2026-125365 | DollarDollar through 4.4 Missing Authorization in /add_expense Balance Tamperingharung1993 · dollardollar | High7.1 |
| CVE-2026-125364 | frab through 0.9.1 Privilege Escalation via conference_users_attributes in UsersControllerfrab · frab | High8.6 |
| CVE-2026-125363 | MikroDash before 0.8.79 SSRF via Personal Notification ChannelsSecOps-7 · MikroDash | Medium5.3 |
| CVE-2026-125362 | Seahub through 14.0.10 Predictable Share Link Passwords via Batch Endpointhaiwen · seahub | Low2.3 |
| CVE-2026-125361 | Tencent BrowserSkill through 0.4.2 Missing Authentication in Local WebSocket TransportTencent · BrowserSkill | High7.2 |
| CVE-2026-125360 | Storyden through 1.26.16 Privilege Escalation via MANAGE_ROLES Role AssignmentSouthclaws · storyden | High8.6 |
| CVE-2026-125359 | Mediary Scout before 2026.11.05 SSRF via PanSou Search Source Settingfancydirty · mediary-scout | Medium5.3 |
| CVE-2026-125358 | Universal-modder before e88f687 Cross-Site WebSocket Command Execution via HostLinkrehan-remade · universal-modder | High7.2 |
| CVE-2026-125357 | Munin munin-httpd through 2.999.18 Path Traversal via Static File Handlermunin-monitoring · munin | Medium6.9 |