Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 9 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 404,826All CVEsplus 19,157 rejected
- 2,073Last 24 hours4,688 in the last 7 days
- 18,896Last 30 days1,622 of them critical
- 1,779Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 17 | 36 | 16 | 1 | 0 | 70 | 90 |
| 2025 | 0 | 4 | 4 | 1 | 0 | 9 | 20 |
| 2024 | 0 | 2 | 6 | 3 | 0 | 11 | 11 |
| Title | ||
|---|---|---|
| CVE-2026-107929 | local interface connection reuse mixupPublic exploitcurl · curl | High8.1 |
| CVE-2026-107928 | info leak uploading over WebSockets with GnuTLSPublic exploitcurl · curl | High8.1 |
| CVE-2026-94266 | password leak in CURLINFO_EFFECTIVE_URLPublic exploitcurl · curl | High7.5 |
| CVE-2026-94265 | Authorization: Negotiate sent to foreign originPublic exploitcurl · curl | Critical9.1 |
| CVE-2026-92391 | curl_mime_free stack overflow by recursionPublic exploitcurl · curl | High7.5 |
| CVE-2026-92390 | -J no-clobber guarantee bypassed with 103 early hintsPublic exploitcurl · curl | High7.5 |
| CVE-2026-92389 | TFTP direction confusionPublic exploitcurl · curl | High8.1 |
| CVE-2026-92388 | FTP wildcard write callback mixupPublic exploitcurl · curl | Critical9.1 |
| CVE-2026-92387 | never-ending loop via server response omissionPublic exploitcurl · curl | High8.1 |
| CVE-2026-92386 | server-set cookie aborts cookie jar loadPublic exploitcurl · curl | High8.1 |
| CVE-2026-87866 | wolfSSL public-key pinning bypassPublic exploitcurl · curl | Critical9.1 |
| CVE-2026-87865 | knownhost callback mismatches key as missingPublic exploitcurl · curl | High7.4 |
| CVE-2026-87863 | HSTS response erases persisted entriesPublic exploitcurl · curl | High8.1 |
| CVE-2026-87864 | IMAP APPEND plus CRLF conversion command injectionPublic exploitcurl · curl | High8.1 |
| CVE-2026-87862 | HSTS cache import drops longer-lived childPublic exploitcurl · curl | High8.1 |
| CVE-2026-87861 | cross-origin reuse of a Negotiate connectionPublic exploitcurl · curl | Critical9.1 |
| CVE-2026-86415 | auto client cert connection reuse mixupcurl · curl | High7.5 |
| CVE-2026-86414 | leaking host credentials to HTTP proxyPublic exploitcurl · curl | Critical9.1 |
| CVE-2026-86413 | Negotiate credentials sent to redirected originPublic exploitcurl · curl | Critical9.1 |
| CVE-2026-86412 | server-set cookie erases cookie jarPublic exploitcurl · curl | High8.1 |
| CVE-2026-86411 | FTP connection reuse inherits client-certificatePublic exploitcurl · curl | Critical9.1 |
| CVE-2026-86410 | redirect to SFTP or SCP bypasses host verificationPublic exploitcurl · curl | High8.1 |
| CVE-2026-86409 | stale SigV4 headers sent unintendedPublic exploitcurl · curl | High8.1 |
| CVE-2026-92392 | HTTP/2 upload Use-After-FreePublic exploitcurl · curl | High8.1 |
| CVE-2026-82209 | domain-scoped PSL domain cookiePublic exploitcurl · curl | High8.2 |
| CVE-2026-82208 | wolfSSL CA-cache hit overrides callbackPublic exploitcurl · curl | High7.5 |
| CVE-2026-80255 | secure cookie attribute bypass with tabPublic exploitcurl · curl | High7.5 |
| CVE-2026-80231 | native CA store conn reusePublic exploitcurl · curl | High7.5 |
| CVE-2026-80230 | OpenSSL pinning bypassPublic exploitcurl · curl | High7.5 |
| CVE-2026-80229 | OpenSSL provider use-after-freecurl · curl | High7.5 |
| CVE-2026-19931 | Negotiate ambient user conn reusePublic exploitcurl · curl | Critical9.8 |
| CVE-2026-18924 | HTTP/2 server push UAFPublic exploitcurl · curl | Critical9.1 |
| CVE-2026-13608 | OpenLDAP SASL authentication bypassPublic exploitcurl · curl | High7.4 |
| CVE-2026-9547 | SSH improper host validationPublic exploitcurl · curl | High7.4 |
| CVE-2026-9546 | sending old refererPublic exploitcurl · curl | High7.5 |
| CVE-2026-9545 | exposing HTTP/3 early dataPublic exploitcurl · curl | High7.5 |
| CVE-2026-9080 | UAF after pause in socket callbackPublic exploitcurl · curl | High7.3 |
| CVE-2026-9079 | stale proxy password leakPublic exploitcurl · curl | Critical9.8 |
| CVE-2026-8932 | incomplete mTLS config matching in conn reusePublic exploitcurl · curl | High7.5 |
| CVE-2026-8927 | env-set cross-proxy Digest auth state leakPublic exploitcurl · curl | Critical9.1 |
| CVE-2026-8926 | password leak with netrc and user in URLPublic exploitcurl · curl | Critical9.1 |
| CVE-2026-8925 | SASL double-freePublic exploitcurl · curl | Critical9.8 |
| CVE-2026-8924 | trailing dot domain super cookiePublic exploitcurl · curl | Critical9.1 |
| CVE-2026-8458 | wrong reuse for different servicesPublic exploitcurl · curl | Medium6.5 |
| CVE-2026-8286 | wrong STARTTLS connection reusePublic exploitcurl · curl | High8.1 |
| CVE-2026-12064 | proto-default skips SSH verificationPublic exploitcurl · curl | High7.5 |
| CVE-2026-11856 | cross-origin Digest auth state leakPublic exploitcurl · curl | Critical9.8 |
| CVE-2026-11586 | WS Auto-PONG memory exhaustioncurl · curl | High7.5 |
| CVE-2026-11564 | Native CA trust persistPublic exploitcurl · curl | Critical9.1 |
| CVE-2026-11352 | QUIC zero-length UDP datagrams busy-loopPublic exploitcurl · curl | High7.5 |