Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 5 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 404,843All CVEsplus 19,157 rejected
- 2,087Last 24 hours4,693 in the last 7 days
- 18,902Last 30 days1,622 of them critical
- 1,779Known exploitedin the CISA KEV catalog
CVEs published per day
In the last 7 days, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 11 Nov 2026 | 0 | 0 | 0 | 0 | 0 | 0 | 3,194 |
| 10 Nov 2026 | 0 | 0 | 0 | 0 | 38 | 38 | 3,194 |
| 9 Nov 2026 | 0 | 2 | 1 | 0 | 27 | 30 | 3,156 |
| 8 Nov 2026 | 0 | 0 | 0 | 0 | 0 | 0 | 3,126 |
| 7 Nov 2026 | 0 | 0 | 0 | 0 | 0 | 0 | 3,126 |
| 6 Nov 2026 | 4 | 3 | 0 | 0 | 1 | 8 | 3,126 |
| 5 Nov 2026 | 13 | 21 | 23 | 1 | 0 | 58 | 3,118 |
| 4 Nov 2026 | 0 | 14 | 6 | 2 | 1 | 23 | 3,060 |
| Title | ||
|---|---|---|
| CVE-2026-86336 | Apache TomEE: EJB method authorization is silently skipped on JDK 21+Apache Software Foundation · Apache TomEE | Not scored |
| CVE-2026-86531 | Apache TomEE: DoS via unbounded request body and multipart handling in embedded HTTP serverApache Software Foundation · Apache TomEE | Not scored |
| CVE-2026-87758 | Apache TomEE: Missing TLS hostname verification in ejbds client connectionsApache Software Foundation · Apache TomEE | Not scored |
| CVE-2026-97849 | Apache TomEE: Derby network service listens on all interfacesApache Software Foundation · Apache TomEE | Not scored |
| CVE-2026-97867 | Apache TomEE: Database credential disclosure via remote JNDI lookupApache Software Foundation · Apache TomEE | Not scored |
| CVE-2026-97870 | Apache TomEE: Missing authentication for Hessian endpoints in embedded HTTP serverApache Software Foundation · Apache TomEE | Not scored |
| CVE-2026-97872 | Apache TomEE: Authentication bypass of Hessian EJB endpoints due to ignored security settingsApache Software Foundation · Apache TomEE | Not scored |
| CVE-2026-97874 | Apache TomEE: Authentication bypass for Hessian endpoints in non-root web applicationsApache Software Foundation · Apache TomEE | Not scored |
| CVE-2026-97880 | Apache TomEE: Authentication bypass in the embedded HTTP server for endpoints protected by HTTP Basic authenticationApache Software Foundation · Apache TomEE | Not scored |
| CVE-2026-97881 | Apache TomEE: Path traversal in embedded HTTP server static resource handlingApache Software Foundation · Apache TomEE | Not scored |
| CVE-2026-97888 | Apache TomEE: Caller identity leaks across requests in embedded HTTP serverApache Software Foundation · Apache TomEE | Not scored |
| CVE-2026-97890 | Apache TomEE: Session fixation in embedded HTTP serverApache Software Foundation · Apache TomEE | Not scored |
| CVE-2026-111239 | Apache TomEE: Code execution by any authenticated user via the SSH administration shellApache Software Foundation · Apache TomEE | Not scored |
| CVE-2026-111240 | Apache TomEE: Authentication bypass for accounts without a stored password in SQL login moduleApache Software Foundation · Apache TomEE | Not scored |
| CVE-2026-111241 | Apache TomEE: Local code execution via predictable passivation files in the shared temporary directoryApache Software Foundation · Apache TomEE | Not scored |
| CVE-2026-111242 | Apache TomEE: Privilege escalation via leaked MicroProfile JWT run-as identityApache Software Foundation · Apache TomEE | Not scored |
| CVE-2026-111243 | Apache TomEE: Expired MicroProfile JWT tokens accepted with negative clock skewApache Software Foundation · Apache TomEE | Not scored |
| CVE-2026-111244 | Apache TomEE: Authorization bypass in MicroProfile JWT role checks for JAX-RS resourcesApache Software Foundation · Apache TomEE | Not scored |
| CVE-2026-111245 | Apache TomEE: Privilege escalation via WS-Security caller identity leaking between requestsApache Software Foundation · Apache TomEE | Not scored |
| CVE-2026-111246 | Apache TomEE: HTTP sessions shared across web applications in embedded HTTP serverApache Software Foundation · Apache TomEE | Not scored |
| CVE-2026-111247 | Apache TomEE: Privilege escalation via user name matching a role nameApache Software Foundation · Apache TomEE | Not scored |
| CVE-2026-111248 | Apache TomEE: Authentication with the stored password digest in Tomcat user identity storeApache Software Foundation · Apache TomEE | Not scored |
| CVE-2026-111249 | Apache TomEE: Unauthenticated LiveReload endpoint reachable from the networkApache Software Foundation · Apache TomEE | Not scored |
| CVE-2026-111250 | Apache TomEE: Authentication bypass via programmatic authentication in embedded HTTP serverApache Software Foundation · Apache TomEE | Not scored |
| CVE-2026-111251 | Apache TomEE: Unauthenticated server shutdown via the admin portApache Software Foundation · Apache TomEE | Not scored |
| CVE-2026-111256 | Apache TomEE: Missing authentication for web service endpoints in embedded HTTP serverApache Software Foundation · Apache TomEE | Not scored |
| CVE-2026-111257 | Apache TomEE: Well-known administrative credentials created at startupApache Software Foundation · Apache TomEE | Not scored |
| CVE-2026-111258 | Apache TomEE: Security constraint bypass via request routingApache Software Foundation · Apache TomEE | Not scored |
| CVE-2026-111259 | Apache TomEE: Predictable HTTP session identifiers in embedded serverApache Software Foundation · Apache TomEE | Not scored |
| CVE-2026-111260 | Apache TomEE: Predictable OpenID Connect state and nonce valuesApache Software Foundation · Apache TomEE | Not scored |
| CVE-2026-111261 | Apache TomEE: Authentication bypass with empty password in LDAP identity storeApache Software Foundation · Apache TomEE | Not scored |
| CVE-2026-111262 | Apache TomEE: LDAP injection in LDAP identity storeApache Software Foundation · Apache TomEE | Not scored |
| CVE-2026-111263 | Apache TomEE: Missing authentication on EJB web service endpoints deployed in a web applicationApache Software Foundation · Apache TomEE | Not scored |
| CVE-2026-111264 | Apache TomEE: Authentication bypass on EJB web service endpoints via HTTP methodApache Software Foundation · Apache TomEE | Not scored |
| CVE-2026-87756 | Apache TomEE: Missing authorization on internal deployer EJBs in default profileApache Software Foundation · Apache TomEE | Not scored |
| CVE-2026-87755 | Apache TomEE: Stateful session bean hijacking via predictable session identifiersApache Software Foundation · Apache TomEE | Not scored |
| CVE-2026-86811 | Apache TomEE: Path traversal via stateful EJB passivationApache Software Foundation · Apache TomEE | Not scored |
| CVE-2026-86532 | Apache TomEE: Username enumeration and timing side channel in JAAS login modulesApache Software Foundation · Apache TomEE | Not scored |
| CVE-2026-119078 | Apache Commons Codec: Blake3 doFinalize is stateless; the documented KDF example derives identical keysApache Software Foundation · Apache Commons Codec | Not scored |
| CVE-2026-124077 | Apache Commons Codec: NUL bytes in tree entry names cause Git/SWHID identifier collisions (GitIdentifiers class)Apache Software Foundation · Apache Commons Codec | Not scored |
| CVE-2026-120367 | Apache Axis2/Java: unbounded JSON request body bufferingApache Software Foundation · Apache Axis2/Java | High7.5 |
| CVE-2026-123779 | Apache Axis2/Java: exposeServiceMetadata not enforced on all metadata routesApache Software Foundation · Apache Axis2/Java | Not scored |
| CVE-2026-123753 | Apache Axis2/Java: SSRF via WS-Addressing ReplyTo and FaultTo endpointsApache Software Foundation · Apache Axis2/Java | Not scored |
| CVE-2026-123766 | Apache Axis2/Java: Cross-site scripting in the OpenAPI module's Swagger UI pageApache Software Foundation · Apache Axis2/Java | Not scored |
| CVE-2026-123770 | Apache Axis2/Java: Unbounded multipart and form-encoded request bodiesApache Software Foundation · Apache Axis2/Java | Not scored |
| CVE-2026-120761 | Apache Axis2/Java: XML External Entity (XXE) injection via imported WSDL/XSD documentsApache Software Foundation · Apache Axis2/Java | Not scored |
| CVE-2026-120832 | Apache Axis2/Java: SSRF via WSDL/XSD schema import resolutionApache Software Foundation · Apache Axis2/Java | Not scored |
| CVE-2026-118196 | Apache Allura: OAuth1 rebindingApache Software Foundation · Apache Allura | Not scored |
| CVE-2026-82436 | Apache Storm Client: Deserialization of Untrusted Data from the State StoreApache Software Foundation · Apache Storm Client | Not scored |
| CVE-2026-82440 | Apache Storm Nimbus: Submitter-Controlled Class Instantiation in Nimbus via a Fail-Open Scheduler Strategy AllowlistApache Software Foundation · Apache Storm Nimbus | Not scored |