Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 9 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 402,806All CVEsplus 19,156 rejected
- 515Last 24 hours3,393 in the last 7 days
- 17,038Last 30 days1,516 of them critical
- 1,773Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 61 | 500 | 709 | 94 | 2 | 1,366 | 12,061 |
| 2025 | 13 | 102 | 161 | 24 | 0 | 300 | 10,695 |
| 2024 | 6 | 116 | 166 | 18 | 0 | 306 | 10,395 |
| 2023 | 13 | 156 | 257 | 20 | 0 | 446 | 10,089 |
| 2022 | 27 | 268 | 318 | 14 | 0 | 627 | 9,643 |
| 2021 | 41 | 170 | 215 | 26 | 0 | 452 | 9,016 |
| 2020 | 51 | 206 | 274 | 36 | 0 | 567 | 8,564 |
| 2019 | 58 | 230 | 315 | 27 | 0 | 630 | 7,997 |
| 2018 | 35 | 170 | 319 | 38 | 0 | 562 | 7,367 |
| 2017 | 82 | 188 | 201 | 6 | 0 | 477 | 6,805 |
| 2016 | 62 | 192 | 271 | 12 | 0 | 537 | 6,328 |
| 2015 | 1 | 93 | 266 | 40 | 0 | 400 | 5,791 |
| 2014 | 0 | 152 | 664 | 134 | 0 | 950 | 5,391 |
| 2013 | 3 | 145 | 660 | 162 | 0 | 970 | 4,441 |
| 2012 | 3 | 187 | 768 | 198 | 0 | 1,156 | 3,471 |
| 2011 | 0 | 109 | 336 | 70 | 0 | 515 | 2,315 |
| 2010 | 3 | 103 | 294 | 64 | 0 | 464 | 1,800 |
| 2009 | 2 | 116 | 173 | 20 | 0 | 311 | 1,336 |
| 2008 | 3 | 108 | 143 | 18 | 0 | 272 | 1,025 |
| 2007 | 0 | 59 | 150 | 35 | 0 | 244 | 753 |
| 2006 | 1 | 102 | 134 | 33 | 0 | 270 | 509 |
| 2005 | 2 | 70 | 119 | 48 | 0 | 239 | 239 |
| Title | ||
|---|---|---|
| CVE-2026-125709 | Libstdc++: overflow leaves streambuf in inconsistent state on i/o error.Red Hat · Red Hat Enterprise Linux 10 | Medium4.2 |
| CVE-2026-125707 | Gst-plugins-bad: gst-plugins-bad: off-by-one write in mxf demuxer temporal offset tableRed Hat · Red Hat Enterprise Linux 10 | Medium6.1 |
| CVE-2026-125706 | Gst-plugins-bad: gst-plugins-bad: missing bounds checks in mpeg ps pes header parsingRed Hat · Red Hat Enterprise Linux 10 | Medium5.5 |
| CVE-2026-125712 | Gst-plugins-base: gst-plugins-base: missing bounds checks in rtcp sdes packet parsingRed Hat · Red Hat Enterprise Linux 10 | High8.2 |
| CVE-2026-125703 | Gst-plugins-bad: gst-plugins-bad: bounds check errors in mxf vanc packet handlingRed Hat · Red Hat Enterprise Linux 10 | Medium5.5 |
| CVE-2026-125672 | Cockpit: cockpit-storaged: tang keyserver address from an untrusted luks header clevis token reaches curl's argument vector as an optionRed Hat · Red Hat Enterprise Linux 10 | Medium6.6 |
| CVE-2026-125704 | Gstreamer: gstreamer: use-after-free in gstreamer core buffer value deserializationRed Hat · Red Hat Enterprise Linux 10 | High7.5 |
| CVE-2026-125652 | Keycloak-services: keycloak-services: client-level mandatory pkce bypass via login-actions entry pointRed Hat · Red Hat Build of Keycloak | Medium6.8 |
| CVE-2026-122056 | Openscap: one-byte heap buffer overflow in sds-compose may lead to denial-of-serviceRed Hat · Red Hat Enterprise Linux 10 | Medium5.9 |
| CVE-2026-112314 | Krb5: mit krb5 gss-rpc client memory leak on xid mismatch retriesPublic exploitRed Hat · Red Hat Enterprise Linux 10 | High7.5 |
| CVE-2026-112321 | Krb5: mit krb5 kadmind unauthenticated memory leak dos via auth_gssapi_init error pathsRed Hat · Red Hat Enterprise Linux 10 | High7.5 |
| CVE-2026-112320 | Krb5: mit krb5 kadmind unauthenticated memory leak dos via gss-rpc auth flavor switchingRed Hat · Red Hat Enterprise Linux 10 | High7.5 |
| CVE-2026-112319 | Krb5: mit krb5 kadmind authenticated memory exhaustion dos via unbounded rpc xdr allocationPublic exploitRed Hat · Red Hat Enterprise Linux 10 | Medium6.5 |
| CVE-2026-112318 | Krb5: mit krb5 kadmind authenticated dos exploiting dereference of null policy name pointersRed Hat · Red Hat Enterprise Linux 10 | Medium6.5 |
| CVE-2026-112316 | Krb5: mit krb5 kadmind authenticated memory leak dos in xdr_krb5_tl_data() decode failureRed Hat · Red Hat Enterprise Linux 10 | Medium6.5 |
| CVE-2026-112317 | Krb5: mit krb5 kdc unauthenticated memory leak dos in kdb keytab key decryption error pathRed Hat · Red Hat Enterprise Linux 10 | Medium5.3 |
| CVE-2026-112315 | Krb5: mit krb5 kadmind unauthenticated memory leak dos in rpcsec_gss buffer decode failureRed Hat · Red Hat Enterprise Linux 10 | Medium5.3 |
| CVE-2026-12977 | Org.wildfly.core/wildfly-server: wildfly: rbac bypass in wildfly deployment-operation handlers leads to privilege escalationRed Hat · Red Hat Fuse 7 | High8.8 |
| CVE-2026-119079 | Krb5: mit krb5 kdc unauthenticated cpu dos via quadratic asn.1 sequence of decodingRed Hat · Red Hat Enterprise Linux 10 | High7.5 |
| CVE-2026-112323 | Krb5: mit krb5 kadmind unauthenticated memory exhaustion via failed auth_gssapi_init requestsRed Hat · Red Hat Enterprise Linux 10 | High7.5 |
| CVE-2026-112322 | Krb5: mit krb5 kadmind unauthenticated cpu dos via auth_gssapi client states cleanupRed Hat · Red Hat Enterprise Linux 10 | High7.5 |
| CVE-2026-125041 | Gst-plugins-good: gst-plugins-good: qtdemux out-of-bounds heap read from invalid uncompressed video layoutRed Hat · Red Hat Enterprise Linux 10 | Medium5.5 |
| CVE-2026-125040 | Gst-plugins-base: gst-plugins-base: quadratic regex processing in srt/webvtt subtitle parser causes denial of serviceRed Hat · Red Hat Enterprise Linux 10 | Medium6.5 |
| CVE-2026-84503 | Ansible-core: ansible-core: ansible.builtin.git invokes git without a `--` separator, allowing argument injection via a `-`-leading repository url (e.g. --upload-pack) -> rceRed Hat · Migration Toolkit for Applications 8 | Medium6.7 |
| CVE-2026-125063 | Automation-controller: automation-controller: quadratic regex in schedule rrule validation allows an authenticated user to exhaust api web workers (denial of service)Red Hat · Red Hat Ansible Automation Platform 2 | Medium4.3 |
| CVE-2026-19706 | Openshift/installer: openshift installer: unconditional csr approval during agent-based installation (abi) bootstrapRed Hat · Assisted Installer for Red Hat OpenShift Container Platform 2 | High8.3 |
| CVE-2026-121611 | Gstreamer1-plugins-bad-free: gst-plugins-bad: use of uninitialized gsth265hrdparams in gst_h265_parse_vps() multi-hrd workaround loopRed Hat · Red Hat Enterprise Linux 10 | Medium6.5 |
| CVE-2026-121601 | Gstreamer1-plugins-bad-free: gstreamer1-plugins-bad-free: out-of-bounds read in mxfdemux via unchecked delta_id and slice indexRed Hat · Red Hat Enterprise Linux 10 | Medium6.1 |
| CVE-2026-119610 | Gstreamer1-plugins-good: gstreamer1-plugins-good: out-of-bounds heap read in mtap16/mtap24 h.264 rtp depayloader via signed/unsigned underflowRed Hat · Red Hat Enterprise Linux 10 | High8.2 |
| CVE-2026-121629 | Gst-plugins-good: gst-plugins-good: local file disclosure via unvalidated file:// uris in adaptivedemux2 manifest handlingRed Hat · Red Hat Enterprise Linux 10 | High7.5 |
| CVE-2026-120984 | Keycloak-services: keycloak-services: manage-clients to arbitrary code execution through inline javascript policy importRed Hat · Red Hat Build of Keycloak | Critical9.1 |
| CVE-2026-83495 | Trainer: trainer: trainjob env passthrough enables valuefrom.secretkeyref injection for namespace secret exfiltrationRed Hat · Red Hat OpenShift AI (RHOAI) | Not scored |
| CVE-2026-50240 | Pipelines-as-code: openshift-pipelines-operator-rh: pipelines-as-code: repository users can trigger namespace edit-equivalent execution via auto-provisioned pipeline serviceaccountpipelines-as-code | High8.8 |
| CVE-2026-123876 | Podman: containers-common: containers-common: default seccomp af_vsock/netlink_audit deny rules bypassable via 32-bit truncationRed Hat · Red Hat Enterprise Linux 10 | Medium4.4 |
| CVE-2026-120749 | Dbus: dbus-daemon: dbus-daemon aborts (reply_serial != 0) when a broadcast from the driver cannot be delivered to a monitored busRed Hat · Red Hat Enterprise Linux 10 | Medium6.2 |
| CVE-2026-83494 | Training-operator: pytorchjob validateupdate casts oldjob from newobj, bypassing managedby immutability (asvs v5.1.3; upstream bug)Red Hat · Red Hat OpenShift AI (RHOAI) | Not scored |
| CVE-2026-83493 | Distributed-workloads: github actions pinned by mutable tag/branch, including third-party snyk/actions/setup@masterRed Hat · Red Hat OpenShift AI (RHOAI) | Critical9.1 |
| CVE-2026-9797 | Keycloak: keycloak: privilege escalation via client authentication manipulation by an authenticated administratorRed Hat · Red Hat Build of Keycloak | Medium6.5 |
| CVE-2026-73473 | Gstreamer1-plugins-good: gstreamer: missing subindex entry count validation in avidemux leading to denial of serviceGStreamer · gst-plugins-good | Medium5.5 |
| CVE-2026-73472 | Gstreamer1-plugins-good: gstreamer: integer overflow in avidemux superindex/subindex parsing leading to out-of-bounds readGStreamer · gst-plugins-good | Medium6.1 |
| CVE-2026-73471 | Gstreamer1-plugins-good: gstreamer: out-of-bounds read in avidemux nikon metadata tag parsingGStreamer · gst-plugins-good | Medium6.1 |
| CVE-2026-97848 | Keycloak-services: keycloak-services: protocol mapper with jsontype=json bypasses token sanitizationRed Hat · Red Hat build of Keycloak 26.4 | Medium6.5 |
| CVE-2026-97367 | Keycloak-services: keycloak-services: dcr azp and sid claim substitution allows account rest session takeoverRed Hat · Red Hat build of Keycloak 26.4 | Medium6.4 |
| CVE-2026-96547 | Keycloak-services: keycloak-services: dcr registration-time claim-path gap allows forging realm_access.rolesRed Hat · Red Hat build of Keycloak 26.4 | Medium6.5 |
| CVE-2026-96460 | Keycloak-services: keycloak-services: indefinite access token renewal via standard token exchange v2Red Hat · Red Hat build of Keycloak 26.6 | Medium5.4 |
| CVE-2026-92856 | Keycloak-services: keycloak-services: saml broker ignores proxyrestriction delegation constraintsRed Hat · Red Hat build of Keycloak 26.6 | Medium4.9 |
| CVE-2026-19688 | Keycloak-services: keycloak-services: admin api missing audience checkRed Hat · Red Hat build of Keycloak 26.6 | Medium6.8 |
| CVE-2026-96447 | Keycloak-services: keycloak-services: stateless token preferred_username fallback enables identity rebindingRed Hat · Red Hat build of Keycloak 26.6 | Medium4.2 |
| CVE-2026-109081 | Keycloak-services: keycloak-services: injection of roles into realm default-roles via dcr endpointRed Hat · Red Hat build of Keycloak 26.6 | Medium6.8 |
| CVE-2026-107124 | Keycloak-services: keycloak-services: oidc logout endpoint session fixation via id_token_hint leading to account takeoverRed Hat · Red Hat build of Keycloak 26.6 | Medium6.4 |