Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 4 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 402,139All CVEsplus 19,141 rejected
- 207Last 24 hours3,286 in the last 7 days
- 16,933Last 30 days1,560 of them critical
- 1,769Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 257 | 595 | 427 | 41 | 49 | 1,369 | 3,126 |
| 2025 | 30 | 90 | 93 | 5 | 0 | 218 | 1,757 |
| 2024 | 55 | 99 | 99 | 8 | 0 | 261 | 1,539 |
| 2023 | 56 | 99 | 100 | 3 | 1 | 259 | 1,278 |
| 2022 | 57 | 91 | 72 | 2 | 0 | 222 | 1,019 |
| 2021 | 51 | 81 | 53 | 0 | 0 | 185 | 797 |
| 2020 | 46 | 48 | 52 | 2 | 0 | 148 | 612 |
| 2019 | 21 | 68 | 48 | 0 | 0 | 137 | 464 |
| 2018 | 26 | 70 | 67 | 3 | 0 | 166 | 327 |
| 2017 | 35 | 83 | 42 | 0 | 0 | 160 | 161 |
| 2016 | 0 | 1 | 0 | 0 | 0 | 1 | 1 |
| Title | ||
|---|---|---|
| CVE-2026-90436 | Apache Axis 1.x (EOL): unauthenticated remote class instantiation via SOAP fault exceptionNameApache Software Foundation · Apache Axis 1.x (EOL) | Not scored |
| CVE-2026-85111 | Apache James: Denial of service upon MIME parsingApache Software Foundation · Apache James | High8.7 |
| CVE-2026-85108 | Apache James MIME4J: Denial of service due to Allocation of Resources Without Limits or ThrottlingApache Software Foundation · Apache James Mime4J Core | Not scored |
| CVE-2026-76168 | Apache James: ManageSieve file implementation cross-user path traversalApache Software Foundation · Apache James | Not scored |
| CVE-2026-74756 | Apache James: WebAdmin exposed without authentication on official Docker defaultApache Software Foundation · Apache James | Not scored |
| CVE-2026-76171 | Apache James: SSRF filter bypass in the JMAP PushSubscription web-push clientApache Software Foundation · Apache James | Not scored |
| CVE-2026-49939 | Apache James: Negative IMAP ACL administer authorization bypass through JMAP protocolApache Software Foundation · Apache James | Not scored |
| CVE-2025-66621 | Apache James: SASL OAUTHBEARER do not validate aud in JWT payload if misconfigredApache Software Foundation · Apache James | Not scored |
| CVE-2026-66903 | Apache OFBiz: Authenticated Path Traversal in Catalog Image ManagementApache Software Foundation · Apache OFBiz | Medium6.5 |
| CVE-2026-71901 | Apache OFBiz: Dispatch arbitrary internal services on SFA componentApache Software Foundation · Apache OFBiz | High8.1 |
| CVE-2026-68524 | Apache OFBiz: Pre-Authentication Remote Code Execution via Attacker-Controlled Screen Definition LoadingApache Software Foundation · Apache OFBiz | Not scored |
| CVE-2026-73577 | Apache OFBiz: Unauthenticated path-suffix view authorization bypassApache Software Foundation · Apache OFBiz | Not scored |
| CVE-2026-73578 | Apache OFBiz: Unauthenticated saved-view authorization bypass with RCE impactApache Software Foundation · Apache OFBiz | Not scored |
| CVE-2026-73580 | Apache OFBiz: Unauthenticated HR organization and employee disclosureApache Software Foundation · Apache OFBiz | Not scored |
| CVE-2026-74841 | Apache OFBiz: Denial of Service via unauthenticated userTenantId in multitenant modeApache Software Foundation · Apache OFBiz | Not scored |
| CVE-2026-76150 | Apache OFBiz: Authenticated path traversal and missing authorization check in replaceImageToExistImageApache Software Foundation · Apache OFBiz | Not scored |
| CVE-2026-81734 | Apache OFBiz: Missing authorization - catalog quick-admin product writesApache Software Foundation · Apache OFBiz | Not scored |
| CVE-2026-76152 | Apache OFBiz: Authenticated path traversal and missing authorization check in imageCrop and imageRotate servicesApache Software Foundation · Apache OFBiz | Not scored |
| CVE-2026-81744 | Apache OFBiz: Authorization bypass - self-grant content OWNERApache Software Foundation · Apache OFBiz | Not scored |
| CVE-2026-81808 | Apache OFBiz: Missing authorization - search-result bulk catalog mutationApache Software Foundation · Apache OFBiz | Not scored |
| CVE-2026-81815 | Apache OFBiz: SQL injection - performFind ignore-case values, MySQL/MariaDBApache Software Foundation · Apache OFBiz | Not scored |
| CVE-2026-81816 | Apache OFBiz: XML external entity injection (XXE)Apache Software Foundation · Apache OFBiz | Not scored |
| CVE-2026-81828 | Apache OFBiz: Server-side request forgery in SurveyWrapperApache Software Foundation · Apache OFBiz | Not scored |
| CVE-2026-82894 | Apache OFBiz: Content renderer runs a service name stored on the rowApache Software Foundation · Apache OFBiz | Not scored |
| CVE-2026-82902 | Apache OFBiz: Unfiltered server-side URL fetch in webtools viewdatafileApache Software Foundation · Apache OFBiz | Medium4.3 |
| CVE-2026-82904 | Apache OFBiz: Unbounded multi-form row count from a parameter nameApache Software Foundation · Apache OFBiz | High7.5 |
| CVE-2026-82907 | Apache OFBiz: externalLoginKey honoured pre-auth, reusable and unboundApache Software Foundation · Apache OFBiz | Critical9.8 |
| CVE-2026-82910 | Apache OFBiz: renderLink compiles link parameters as FreeMarker sourceApache Software Foundation · Apache OFBiz | High8.8 |
| CVE-2026-82912 | Apache OFBiz: Unsandboxed Groovy compiled from a service parameterApache Software Foundation · Apache OFBiz | High8.8 |
| CVE-2026-82916 | Apache OFBiz: webtools xmldsdump exports any entity to any pathApache Software Foundation · Apache OFBiz | High7.1 |
| CVE-2026-82960 | Apache OFBiz: Widget use-when Expression Injection Bypasses Groovy Sandbox for authenticated RCEApache Software Foundation · Apache OFBiz | High8.8 |
| CVE-2026-83538 | Apache OFBiz: Unauthenticated disclosure through HR, Catalog, and Order Manager helpersApache Software Foundation · Apache OFBiz | Not scored |
| CVE-2026-83542 | Apache OFBiz: Unauthenticated RCE via login-page widget injectionApache Software Foundation · Apache OFBiz | Critical9.8 |
| CVE-2026-84183 | Apache OFBiz: Content Manager VIEW-only RCE in updateLayoutApache Software Foundation · Apache OFBiz | High8.8 |
| CVE-2026-84728 | Apache OFBiz: Cross-tenant authorization bypass in mapped-domain loginApache Software Foundation · Apache OFBiz | Medium5.4 |
| CVE-2026-85627 | Apache OFBiz: Authenticated Code Execution VulnerabilityApache Software Foundation · Apache OFBiz | High8.8 |
| CVE-2026-92887 | Apache OFBiz: REST API authentication bypassed by default when the auth attribute is omitted from a .rest.xml operationApache Software Foundation · Apache OFBiz | Not scored |
| CVE-2026-97355 | Apache OFBiz: Hard-coded Credentials in AdminServer Enable Unauthenticated Denial of ServiceApache Software Foundation · Apache OFBiz | Not scored |
| CVE-2026-97356 | Apache OFBiz: Insufficiently Protected Credentials in ViewFile Enable Authentication BypassApache Software Foundation · Apache OFBiz | Not scored |
| CVE-2026-100168 | Apache OFBiz: Missing Authorization vulnerabilityApache Software Foundation · Apache OFBiz | Not scored |
| CVE-2026-100228 | Apache OFBiz: Improper Input Validation in Order Returns Enables Unauthorized Refund Price ManipulationApache Software Foundation · Apache OFBiz | Not scored |
| CVE-2026-105325 | Apache OFBiz: Missing authorization in payment application services allows view-only users to modify payment allocationsApache Software Foundation · Apache OFBiz | Not scored |
| CVE-2026-105330 | Apache OFBiz: Use of Hard-coded Cryptographic Key in JWT Token Authentication Enables Unauthenticated Administrative AccessApache Software Foundation · Apache OFBiz | Not scored |
| CVE-2026-105461 | Apache OFBiz: Missing authorization in updateOrderItems allows view-only users to modify order prices and quantitiesApache Software Foundation · Apache OFBiz | Not scored |
| CVE-2026-109129 | Apache OFBiz: Authorization Bypass Through User-Controlled Key in OrderServices Enables Unauthorized Payment Preference ModificationApache Software Foundation · Apache OFBiz | Not scored |
| CVE-2026-109837 | Apache OFBiz: Authorization Bypass Through User-Controlled Key in Order Returns Enables Cross-Party OrderItem AssociationApache Software Foundation · Apache OFBiz | Not scored |
| CVE-2026-109856 | Apache OFBiz: Missing Authorization in Financial Account Services Enables Unauthorized Balance ManipulationApache Software Foundation · Apache OFBiz | Not scored |
| CVE-2026-109928 | Apache OFBiz: Incorrect Authentication Algorithm Implementation in Password Reset Enables Full Account TakeoverApache Software Foundation · Apache OFBiz | Not scored |
| CVE-2026-114229 | Apache OFBiz: Reflected Cross-site Scripting in Catalog Image Viewer Enables Script Execution in a User SessionApache Software Foundation · Apache OFBiz | Not scored |
| CVE-2026-114233 | Apache OFBiz: Incorrect Privilege Assignment in Order Manager Enables Unauthorized Modification of Approved OrdersApache Software Foundation · Apache OFBiz | Not scored |