Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 6 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 406,521All CVEsplus 19,172 rejected
- 772Last 24 hours5,192 in the last 7 days
- 16,876Last 30 days1,480 of them critical
- 1,781Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 19 | 234 | 200 | 45 | 0 | 498 | 993 |
| 2025 | 5 | 54 | 42 | 9 | 0 | 110 | 495 |
| 2024 | 7 | 57 | 26 | 3 | 0 | 93 | 385 |
| 2023 | 2 | 61 | 36 | 3 | 0 | 102 | 292 |
| 2022 | 6 | 36 | 32 | 2 | 0 | 76 | 190 |
| 2021 | 1 | 19 | 8 | 0 | 0 | 28 | 114 |
| 2020 | 0 | 25 | 20 | 2 | 0 | 47 | 86 |
| 2019 | 2 | 12 | 7 | 0 | 0 | 21 | 39 |
| 2018 | 0 | 1 | 2 | 3 | 0 | 6 | 18 |
| 2017 | 0 | 4 | 2 | 0 | 0 | 6 | 12 |
| 2016 | 0 | 0 | 0 | 0 | 0 | 0 | 6 |
| 2015 | 0 | 1 | 1 | 0 | 0 | 2 | 6 |
| 2014 | 0 | 0 | 0 | 0 | 0 | 0 | 4 |
| 2013 | 0 | 1 | 0 | 0 | 0 | 1 | 4 |
| 2012 | 0 | 0 | 0 | 0 | 0 | 0 | 3 |
| 2011 | 0 | 0 | 0 | 0 | 0 | 0 | 3 |
| 2010 | 0 | 0 | 0 | 0 | 0 | 0 | 3 |
| 2009 | 0 | 0 | 0 | 0 | 0 | 0 | 3 |
| 2008 | 0 | 0 | 0 | 0 | 0 | 0 | 3 |
| 2007 | 0 | 0 | 0 | 0 | 0 | 0 | 3 |
| 2006 | 0 | 0 | 0 | 0 | 0 | 0 | 3 |
| 2005 | 0 | 0 | 1 | 0 | 0 | 1 | 3 |
| 2004 | 0 | 0 | 1 | 0 | 0 | 1 | 2 |
| 2003 | 0 | 0 | 1 | 0 | 0 | 1 | 1 |
| Title | ||
|---|---|---|
| CVE-2026-128088 | russh try_sign: asynchronous confirmation can sign after agent lockEugeny · russh | Low2.2 |
| CVE-2026-128079 | envd: Host file disclosure through requirements path traversal and TOCTOUtensorchord · envd | Medium6.8 |
| CVE-2026-129092 | CCC Attestation SIG attested-tls-poc through commit 731ca82 TOCTOU via Handshake-Only AttestationCCC-Attestation · attested-tls-poc | High7.0 |
| CVE-2026-95518 | TOCTOU Race Condition in TÜBİTAK BİLGEM's Pardus Package InstallerTÜBİTAK BİLGEM Yazılım Teknolojileri Araştırma Enstitüsü · Pardus Package Installer | High7.0 |
| CVE-2026-126410 | Wasmtime 48.0.0 before 48.0.8 TOCTOU UDP Send Policy Bypass via wasip3 Socketsbytecodealliance · wasmtime | Medium5.3 |
| CVE-2026-126936 | Zipline before 4.7.0 Race Condition in Invite and Quota Limitsdiced · zipline | Medium6.0 |
| CVE-2026-126937 | Zipline before 4.6.5 TOCTOU Race Condition via /api/setupdiced · zipline | Critical9.2 |
| CVE-2026-126935 | Zipline before 4.8.0 maxViews Limit Bypass via Race ConditionPublic exploitdiced · zipline | Medium6.3 |
| CVE-2026-126906 | Race condition in Extensions in Google Chrome on on Mac prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to obtain…Google · Chrome | Medium5.9 |
| CVE-2026-111521 | Dell Display and Peripheral Manager (DDPM Windows), versions prior to 2.4.0.17, contain a Time-of-check Time-of-use (TOCTOU) Condition vulnerability. A low…Dell · Display and Peripheral Manager (DDPM Windows) | High7.0 |
| CVE-2025-54506 | A time-of-check to time-of-use (TOCTOU) race condition in the AMD SEV Secure Encrypted Virtualization (SEV) firmware could allow an attacker with…AMD · AMD EPYC™ 9005 Series Processors | Medium4.0 |
| CVE-2026-50079 | Vulnerabilities in the QNX Virtual Machine (QVM) affect QNX Hypervisor and QNX Hypervisor for SafetyBlackBerry Ltd · QNX Hypervisor | Low3.3 |
| CVE-2026-56916 | In _vqueue_get_avail_buf_locked of trusty/kernel/lib/trusty/vqueue.c, there is a possible Double-read / TOCTOU due to a race condition. This could lead to…Google · Android | High7.8 |
| CVE-2026-0193 | In handle_rx_msg of tipc_virtio_dev, there is a possible Double Fetch TOCTOU due to Double Fetch. This could lead to local information disclosure with…Google · Android | Low3.3 |
| CVE-2026-122474 | Windows Security Account Manager Remote Protocol Security Feature Bypass VulnerabilityMicrosoft · Windows 10 Version 1607 | Medium5.9 |
| CVE-2026-119974 | Windows Cloud Files Mini Filter Driver Elevation of Privilege VulnerabilityMicrosoft · Windows 10 Version 1809 | High7.0 |
| CVE-2026-119931 | Windows Text Services Framework Elevation of Privilege VulnerabilityMicrosoft · Windows 10 Version 1607 | High7.0 |
| CVE-2026-119910 | Win32k Information Disclosure VulnerabilityMicrosoft · Windows 10 Version 1607 | Medium4.7 |
| CVE-2026-119851 | Windows Storage Spaces Controller Elevation of Privilege VulnerabilityMicrosoft · Windows 10 Version 1607 | High7.0 |
| CVE-2026-119399 | Windows Installer Elevation of Privilege VulnerabilityMicrosoft · Windows 10 Version 1607 | High7.0 |
| CVE-2026-119398 | Windows Installer Elevation of Privilege VulnerabilityMicrosoft · Windows 10 Version 1607 | High7.8 |
| CVE-2026-114155 | .NET Elevation of Privilege VulnerabilityMicrosoft · .NET 10.0 installed on Linux | High7.5 |
| CVE-2026-113865 | Windows Hyper-V Elevation of Privilege VulnerabilityMicrosoft · Windows 10 Version 21H2 | High7.8 |
| CVE-2026-105562 | Windows Container Manager Service Information Disclosure VulnerabilityMicrosoft · Windows 10 Version 21H2 | Medium4.7 |
| CVE-2026-113772 | Windows Redirected Drive Buffering Information Disclosure VulnerabilityMicrosoft · Windows 10 Version 1607 | Medium4.7 |
| CVE-2026-113764 | Windows Projected File System Information Disclosure VulnerabilityMicrosoft · Windows 10 Version 1809 | Medium4.7 |
| CVE-2026-112980 | Windows Print Spooler Components Elevation of Privilege VulnerabilityMicrosoft · Windows 10 Version 1607 | Medium6.7 |
| CVE-2026-112810 | Windows Cloud Files Mini Filter Driver Elevation of Privilege VulnerabilityMicrosoft · Windows 10 Version 1809 | High7.0 |
| CVE-2026-112791 | Windows Print Spooler Components Elevation of Privilege VulnerabilityMicrosoft · Windows 10 Version 1607 | High7.0 |
| CVE-2026-88216 | Windows DHCP Server Remote Code Execution VulnerabilityMicrosoft · Windows Server 2016 | High7.5 |
| CVE-2026-102200 | Windows NTFS Tampering VulnerabilityMicrosoft · Windows 10 Version 1809 | Medium4.7 |
| CVE-2026-49036 | Time-of-check time-of-use race condition in the MigTD shared memory for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hypervisor may allow a…Intel(R) TDX Migration Trust Domain (MigTD) | Medium5.7 |
| CVE-2026-102803 | Joomla Extension - j2commerce.com - Gift voucher and single-use coupon could pay for more than one order in J2Store 6.0.0 - 6.6.5j2commerce.com · J2Store extension for Joomla | Medium6.0 |
| CVE-2026-34016 | Time-of-check time-of-use race condition for the Intel(R) VTune(TM) Profiler software before version 2026.0.0 within Ring 1: Device Drivers may allow an…Intel(R) VTune(TM) Profiler software | High8.5 |
| CVE-2026-32670 | Time-of-check time-of-use race condition for the Intel(R) VTune(TM) Profiler software within Ring 1: Device Drivers may allow an escalation of privilege.…Intel(R) VTune(TM) Profiler software | High8.5 |
| CVE-2026-114594 | Time-of-check time-of-use (TOCTOU) race condition in Sandisk Dashboard InstallerSandisk · Sandisk Dashboard | Medium5.4 |
| CVE-2026-124622 | olivier-ls PHP-FTS Storage.php open toctouolivier-ls · PHP-FTS | Medium4.8 |
| CVE-2026-92606 | TOCTOU Race Condition in TÜBİTAK BİLGEM's Pardus MyComputerTÜBİTAK BİLGEM Software Technologies Research Institute · Pardus MyComputer | Medium6.0 |
| CVE-2026-63440 | 2FAuth: Authenticated SSRF via DNS rebinding in the otpauth image= icon fetch (validate-then-fetch TOCTOU)Public exploitBubka · 2FAuth | Medium5.9 |
| CVE-2026-123835 | In JetBrains Datalore before 2026.4 code execution was possible in another user's computation via an init script upload race conditionJetBrains · Datalore | Medium5.9 |
| CVE-2026-123486 | WWBN AVideo 29.0 through 29.4.0 Race Condition in PayPal IPN Deduplication via ipn.phpPublic exploitWWBN · AVideo | Medium6.0 |
| CVE-2026-112913 | filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its databasePublic exploittox-dev · filelock | Low3.3 |
| CVE-2026-123207 | LibreTV before v2.21.2 SSRF Protection Bypass via DNS RebindingLibreSpark · LibreTV | Low2.3 |
| CVE-2026-112110 | Privileged file deletion in SafeNet Authentication Client SACSrvThalesgroup · Safenet Authentication Client Service | Medium5.8 |
| CVE-2026-119345 | Cocos AI Intra-handshake attested TLS implementation is vulnerable to TOCTOU Attacksultravioletrs · cocos | High7.2 |
| CVE-2026-123119 | Symfony: NoPrivateNetworkHttpClient Does Not Pin the Checked IP of Cached Hosts, Letting DNS Rebinding Enumerate Internal Ports (Incomplete Fix for CVE-2024-50342)sensiolabs · symfony | Low2.3 |
| CVE-2026-122321 | Kyverno 1.18.0 before 1.19.2 verifyImages Cache Signature Verification Bypasskyverno · kyverno | High8.5 |
| CVE-2026-109518 | APT RCE via hard link reuseDebian · APT | High7.7 |
| CVE-2026-100235 | Apache ZooKeeper: ACL enforcement bypass allows unauthorized operations to commit after an ACL revocationApache Software Foundation · Apache ZooKeeper | Medium6.0 |
| CVE-2026-87038 | Time-of-check/time-of-use double fetch in the Zephyr i3c_transfer() syscall handler allows kernel-mode control-flow hijack from user modezephyrproject · zephyr | High7.0 |