Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 9 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 406,598All CVEsplus 19,172 rejected
- 77Last 24 hours4,669 in the last 7 days
- 16,346Last 30 days1,441 of them critical
- 1,781Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 55 | 73 | 71 | 9 | 0 | 208 | 439 |
| 2025 | 21 | 21 | 41 | 11 | 0 | 94 | 231 |
| 2024 | 12 | 11 | 13 | 2 | 0 | 38 | 137 |
| 2023 | 4 | 20 | 7 | 1 | 0 | 32 | 99 |
| 2022 | 5 | 9 | 9 | 0 | 0 | 23 | 67 |
| 2021 | 3 | 6 | 4 | 0 | 0 | 13 | 44 |
| 2020 | 2 | 7 | 2 | 2 | 0 | 13 | 31 |
| 2019 | 1 | 1 | 4 | 0 | 0 | 6 | 18 |
| 2018 | 2 | 0 | 3 | 0 | 0 | 5 | 12 |
| 2017 | 2 | 1 | 1 | 0 | 0 | 4 | 7 |
| 2016 | 1 | 0 | 0 | 0 | 0 | 1 | 3 |
| 2015 | 1 | 0 | 1 | 0 | 0 | 2 | 2 |
| Title | ||
|---|---|---|
| CVE-2026-126797 | NextScan 1.1.0 through 1.2.0 Hardcoded JWT Key Authentication Bypass in ns-admintongcheng-security-team · NextScan | Critical9.3 |
| CVE-2026-64682 | AstroBlocks: Admin session tokens can be forged due to a hard-coded fallback JWT secret and a mismatched environment variable nameNauelG · astro-blocks | Critical9.8 |
| CVE-2026-0003 | Use of a per-part static key in the ASP Bootloader could allow an attacker to downgrade the Secure Encrypted Virtualization (SEV) firmware and exploit known…AMD · AMD EPYC™ 9004 Series Processors | Medium5.9 |
| CVE-2026-124602 | Hardcoded RSA Private Key and Public Key Exposure in GV-Access Android Application v1.6.1GeoVision Inc. · GV-Access | Medium6.2 |
| CVE-2026-124604 | Hardcoded RSA Private Key and Public Key Exposure in GV-Cloud Android Application v1.5.1GeoVision Inc. · GV-Cloud | Medium6.2 |
| CVE-2026-124599 | Hardcoded RSA Private Key and Public Key Exposure in GV-Face Android Application v2.2.1GeoVision Inc. · GV-Face | Medium6.2 |
| CVE-2026-124598 | Hardcoded API Key Discovered in GV-Face Android Application v2.2.1GeoVision Inc. · GV-Face | High7.5 |
| CVE-2026-125383 | INDOTALENT WHMS before 10.20261109 Hard-Coded JWT Signing Key Authentication Bypassgo2ismail · Asp.Net-Core-Inventory-Order-Management-System | Critical9.3 |
| CVE-2026-125370 | Kubero 3.0.0 through 3.1.1 Authentication Bypass via Hardcoded JWT SecretPublic exploitkubero-dev · kubero | Critical9.3 |
| CVE-2026-112164 | Hardcoded AES Key Enables Credential Disclosurelaservideo · lasergest | Medium6.6 |
| CVE-2026-118464 | AIS shared cryptographic services use fixed cryptographic secretsCompuGroup Medical · Infantia | Medium5.8 |
| CVE-2026-118460 | AIS embedded private keys enable practitioner impersonationCompuGroup Medical · Infantia | High8.0 |
| CVE-2026-17356 | Multiple Vulnerabilities in IBM API ConnectIBM · API Connect | High8.7 |
| CVE-2026-17310 | Multiple Vulnerabilities in IBM API ConnectIBM · API Connect | Medium6.5 |
| CVE-2026-115739 | Hard-coded Cryptographic Key vulnerability exists in the DLP on-prem extensions version 11.13.1 and earlier allows a remote attacker to decrypt credentials and…Trellix · DLP on-prem extensions | Medium6.0 |
| CVE-2026-105330 | Apache OFBiz: Use of Hard-coded Cryptographic Key in JWT Token Authentication Enables Unauthenticated Administrative AccessApache Software Foundation · Apache OFBiz | Critical9.8 |
| CVE-2026-92199 | Quest Foglight for Databases EncryptionUtil Hardcoded Encyption Key Local Privilege Escalation VulnerabilityQuest · Foglight for Databases | High7.8 |
| CVE-2026-82154 | Dell OS Recovery tool versions, prior to 2.4.4, contain a use of Hard-coded Cryptographic Key vulnerability. An unauthenticated attacker with physical access…Dell · OS Recovery tool | Low2.4 |
| CVE-2026-120209 | AJ-Report through 1.7.1 Authentication Bypass leading to RCE via Share-Tokenanji-plus · AJ-Report | Critical9.3 |
| CVE-2026-61737 | ng-antd-admin: Hardcoded JWT Secret allows Authentication Bypass in ng-antd-adminhuajian123 · ng-antd-admin | Critical9.8 |
| CVE-2026-91912 | Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Use of Hard-coded Cryptographic Key vulnerability. A low privileged attacker with local access…Dell · OpenManage Enterprise | High7.3 |
| CVE-2026-119597 | OpenDeepWiki through 2.0.6 Hard-coded JWT Signing Key Admin Token ForgeryPublic exploitAIDotNet · OpenDeepWiki | Critical9.3 |
| CVE-2025-62841 | Hard-coded Cryptographic Key #2QNAP Systems Inc. · HBS 3 Hybrid Backup Sync | High8.7 |
| CVE-2025-62839 | Hard-coded Cryptographic Key #1QNAP Systems Inc. · HBS 3 Hybrid Backup Sync | High8.7 |
| CVE-2026-86384 | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions…Dell · PowerProtect Data Domain | Critical9.8 |
| CVE-2026-102812 | Hardcoded AES-128 Key and Fixed IV in Configuration Backup Encryption in TP-Link RE305 and Archer C7TP-Link Systems Inc. · RE305 v3 | Medium6.9 |
| CVE-2026-117564 | nest-admin before 1.0.1 Authentication Bypass via Hardcoded JWT Secretbuqiyuan · nest-admin | Critical9.3 |
| CVE-2026-111460 | Static HTTPS private key and CA private key in firmware in OnCell G3150A-LTE SeriesMoxa · OnCell G3150A-LTE Series | High7.7 |
| CVE-2026-116747 | Kener 3.0.0 before 4.1.10 Authentication Bypass via Hardcoded Fallback JWT SecretPublic exploitrajnandan1 · kener | Critical9.2 |
| CVE-2014-125135 | OctoPrint Flask Secret Key hard-coded keyOctoPrint | Medium6.9 |
| CVE-2026-71456 | Use of hard-coded cryptographic key vulnerability in Johnson Controls Kantech Entrapass allows Padding Oracle Crypto Attack. This issue affects Kantech…Johnson Controls · Kantech Entrapass | High8.5 |
| CVE-2026-112345 | TTLock Android App < 9.8.260718 Hardcoded BLE Pairing Key ExposurePublic exploitSciener · TTLock | High8.6 |
| CVE-2026-110474 | Hardcoded API Key Vulnerability in CreditNirvana Agentic AI Call Centre applicationCreditNirvana · Agentic AI Call Centre | High8.7 |
| CVE-2026-76298 | Use of Hard-coded Cryptographic Key in the PostgreSQL Sidecar Service in Splunk EnterpriseSplunk · Splunk Enterprise | High8.8 |
| CVE-2026-89052 | Hardcoded AES encryption key in Archer C6TP-Link Systems Inc. · Archer C6 V2 | Medium5.9 |
| CVE-2026-82891 | IBM Guardium Data Protection is affected by a security vulnerabilityIBM · Guardium Data Protection | High8.1 |
| CVE-2026-113466 | MinIO Embedded Console common-main.go SessionTokenAuthenticate hard-coded keyPublic exploitMinIO | Medium6.9 |
| CVE-2026-112014 | LobsterAI before 2026.10.16 Hardcoded Password in Provider API Key Exportnetease-youdao · LobsterAI | Medium6.8 |
| CVE-2026-111696 | data-platform-open through commit efeacd3 Hardcoded AES Key for Datasource Passwordsshaiwz · data-platform-open | High7.1 |
| CVE-2026-111692 | DataBuff ai-apm-web through 0.1.10 Authentication Bypass via Hardcoded HMAC SecretPublic exploitdatabufflabs · databuff | Critical9.3 |
| CVE-2026-111690 | Simple Admin Core through 1.8.7 Hard-Coded JWT Secret Authentication BypassPublic exploitsuyuan32 · simple-admin-core | Critical9.3 |
| CVE-2026-111642 | FastapiAdmin through 3.0 Hard-Coded JWT Secret Privilege EscalationPublic exploitfastapiadmin · FastapiAdmin | High8.7 |
| CVE-2026-111636 | OpenBMB StaffDeck through 0.5.6 Authentication Bypass via Hard-Coded Session SecretOpenBMB · StaffDeck | Critical9.2 |
| CVE-2026-111633 | ZKEACMS through 4.4 Authentication Bypass via Hard-Coded JWT Signing KeyPublic exploitSeriaWei · ZKEACMS | High8.8 |
| CVE-2026-111612 | netdisk-fast-download through 0.4.8 Credential Disclosure via /v2/randomAuthPublic exploitqaiu · netdisk-fast-download | High8.7 |
| CVE-2026-109813 | Shared Hard-coded Root CA Private KeyMoxa · AIG-302 Series | High8.6 |
| CVE-2026-111347 | go-ldap-admin through 0.6.2 Hard-Coded RSA Private Key via /base/decryptpwdPublic exploitopsre · go-ldap-admin | High8.2 |
| CVE-2026-105035 | EnergizeLab FirmwareUpdater Universal Hard-Coded AES KeyEnergizeLab · FirmwareUpdater | High7.8 |
| CVE-2026-108336 | Token Signing Key Allows Unauthenticated Administrative AccessHitachi Vantara · Remot Ops Agent | Critical9.1 |
| CVE-2026-100413 | SeaweedFS: Hard-coded SSH host key can be presented by certain standalone SFTP Helm deploymentsPublic exploitseaweedfs · seaweedfs | High7.0 |