Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 3 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 406,521All CVEsplus 19,172 rejected
- 754Last 24 hours5,191 in the last 7 days
- 16,859Last 30 days1,479 of them critical
- 1,781Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 2 | 27 | 281 | 16 | 0 | 326 | 879 |
| 2025 | 0 | 44 | 102 | 15 | 0 | 161 | 553 |
| 2024 | 1 | 13 | 66 | 15 | 0 | 95 | 392 |
| 2023 | 1 | 9 | 52 | 20 | 0 | 82 | 297 |
| 2022 | 0 | 17 | 44 | 23 | 0 | 84 | 215 |
| 2021 | 0 | 8 | 10 | 0 | 0 | 18 | 131 |
| 2020 | 0 | 17 | 17 | 0 | 0 | 34 | 113 |
| 2019 | 0 | 15 | 5 | 0 | 0 | 20 | 79 |
| 2018 | 0 | 38 | 4 | 0 | 0 | 42 | 59 |
| 2017 | 0 | 9 | 6 | 0 | 0 | 15 | 17 |
| 2016 | 0 | 0 | 0 | 0 | 0 | 0 | 2 |
| 2015 | 0 | 1 | 0 | 0 | 0 | 1 | 2 |
| 2014 | 0 | 0 | 0 | 0 | 0 | 0 | 1 |
| 2013 | 0 | 0 | 0 | 0 | 0 | 0 | 1 |
| 2012 | 0 | 0 | 0 | 0 | 0 | 0 | 1 |
| 2011 | 0 | 0 | 0 | 0 | 0 | 0 | 1 |
| 2010 | 0 | 1 | 0 | 0 | 0 | 1 | 1 |
| Title | ||
|---|---|---|
| CVE-2026-127123 | Fragment with another data representation releases an Application RelationshipRT-Labs · P-Net | Medium6.0 |
| CVE-2026-128018 | FrankenPHP before 1.13.4 Pending Worker Request Denial of Servicephp · frankenphp | Medium6.3 |
| CVE-2026-33275 | Improper resource shutdown or release for some Intel(R) PROSet/Wireless Wi-Fi Software for Windows within Ring 3: User Applications may allow a denial of…Intel(R) PROSet/Wireless Wi-Fi Software for Windows | Medium6.8 |
| CVE-2026-123964 | OpenBMB Internet of Agents Collaboration Layer communication_layer.py launch_goal infinite loopPublic exploitOpenBMB · Internet of Agents | Medium5.3 |
| CVE-2026-123748 | chenyme grok2api WebSocket Proxy voice_ws_handler.go proxyVoiceWebSocket resource consumptionchenyme · grok2api | Medium5.3 |
| CVE-2026-122020 | NST Labs Tech Nstbrowser Local Agent Management Service stopAll stopAllBrowsers denial of servicePublic exploitNST Labs Tech · Nstbrowser | Medium5.3 |
| CVE-2026-121261 | phpMyAdmin ShapeFile SHP File loadFromFile infinite loopPublic exploitphpMyAdmin · ShapeFile | Medium5.3 |
| CVE-2026-120237 | ag-ui-protocol ag-ui Interrupt expiry index.ts isInterruptExpired resource consumptionPublic exploitag-ui-protocol · ag-ui | Medium5.3 |
| CVE-2026-120235 | ag-ui-protocol ag-ui SSE Parser sse.ts parseSSEStream resource consumptionPublic exploitag-ui-protocol · ag-ui | Medium5.3 |
| CVE-2026-120234 | ag-ui-protocol ag-ui HTTP Transport e.text resource consumptionPublic exploitag-ui-protocol · ag-ui | Medium5.3 |
| CVE-2026-118276 | a2ui-project a2ui Parser expression_parser.ts formatString resource consumptionPublic exploita2ui-project · a2ui | Medium5.1 |
| CVE-2026-118275 | a2ui-project a2ui Resolver data-context.ts DataContext.resolveSignal resource consumptionPublic exploita2ui-project · a2ui | Medium6.9 |
| CVE-2026-118274 | a2ui-project a2ui Binder generic-binder.ts resource consumptionPublic exploita2ui-project · a2ui | Medium5.3 |
| CVE-2026-118273 | a2ui-project a2ui data-model.ts DataModel.set resource consumptionPublic exploita2ui-project · a2ui | Medium5.3 |
| CVE-2026-118271 | a2ui-project a2ui data-context Resolver data-context.ts resource consumptionPublic exploita2ui-project · a2ui | Medium5.3 |
| CVE-2026-117506 | a2aproject a2a-java Push Notification Config Store JpaDatabasePushNotificationConfigStore.java InMemoryPushNotificationConfigStore.setInfo resource consumptiona2aproject · a2a-java | Medium5.3 |
| CVE-2026-117505 | a2aproject a2a-java ChildQueue queue.offer resource consumptiona2aproject · a2a-java | Medium5.3 |
| CVE-2026-117504 | a2aproject a2a-go Distributed Manager distributed_manager.go Cancel denial of servicea2aproject · a2a-go | Medium6.9 |
| CVE-2026-117503 | a2aproject a2a-go REST SSE handler rest.go resource consumptiona2aproject · a2a-go | Medium6.9 |
| CVE-2026-115971 | Travisun Opptrix preParsing handler webhook Buffer.concat denial of servicePublic exploitTravisun · Opptrix | Medium6.9 |
| CVE-2026-113872 | multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardownmulter · multer | High7.5 |
| CVE-2026-91427 | Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.9.…Oracle Corporation · Siebel CRM Deployment | Low2.3 |
| CVE-2026-91330 | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). Supported versions that are affected are…Oracle Corporation · JD Edwards EnterpriseOne Tools | Low3.3 |
| CVE-2026-91324 | Vulnerability in the Oracle Solaris product of Oracle Systems (component: Libraries). The supported version that is affected is 11.4. Difficult to exploit…Oracle Corporation · Oracle Solaris | Medium4.7 |
| CVE-2026-91302 | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC). Supported versions that are…Oracle Corporation · JD Edwards EnterpriseOne Tools | Low3.3 |
| CVE-2026-101402 | Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Email Marketing). Supported versions that are affected are 17.0-26.9.…Oracle Corporation · Siebel Apps - Marketing | Low3.7 |
| CVE-2026-101401 | Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing). Supported versions that are affected are 17.0-26.9. Difficult…Oracle Corporation · Siebel Apps - Marketing | Low2.9 |
| CVE-2026-101400 | Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing). Supported versions that are affected are 17.0-26.9. Difficult…Oracle Corporation · Siebel Apps - Marketing | Low2.9 |
| CVE-2026-112157 | MemTensor memmy-agent Memory Service http.ts requireAdminWrite resource consumptionPublic exploitMemTensor · memmy-agent | Low2.3 |
| CVE-2026-112083 | sgl-project SGLang Weight Exporter weight_exporter.py WeightExporter.send_weights_to_remote_instance denial of servicePublic exploitsgl-project · SGLang | Medium6.9 |
| CVE-2026-112082 | sgl-project SGLang Expert-Distribution Recording Endpoint expert_distribution.py Scheduler.expert_distribution_handle denial of servicePublic exploitsgl-project · SGLang | High8.7 |
| CVE-2026-110809 | sgl-project SGLang Session Cleanup session_controller.py Session.create_req denial of servicePublic exploitsgl-project · SGLang | Medium5.3 |
| CVE-2026-110807 | sgl-project SGLang generate Endpoint io_struct.py denial of servicePublic exploitsgl-project · SGLang | Medium5.3 |
| CVE-2026-49785 | UEFI Secure Boot Security Feature Bypass VulnerabilityMicrosoft · Windows 10 Version 1607 | High7.8 |
| CVE-2026-102700 | gnttab: cache-flush handling may cause page reference leakXen · Xen | Medium4.7 |
| CVE-2026-109144 | wbond certvalidator Certificate Path Builder resource consumptionwbond · certvalidator | Medium6.9 |
| CVE-2026-109107 | Wavlink WL-WN592AX6 upload.cgi main null pointer dereferencePublic exploitWavlink · WL-WN592AX6 | Medium6.9 |
| CVE-2026-109277 | ImageMagick before 7.1.2-32 Policy Bypass via -script OperationImageMagick · ImageMagick | Medium4.8 |
| CVE-2026-108769 | zhayujie CowAgent Markdown Rendering Markdown.tsx denial of servicePublic exploitzhayujie · CowAgent | Medium5.3 |
| CVE-2026-108682 | zhayujie CowAgent Web Console upload read denial of servicePublic exploitzhayujie · CowAgent | Medium5.3 |
| CVE-2026-108681 | zhayujie CowAgent Web Console web_channel.py denial of servicePublic exploitzhayujie · CowAgent | Medium5.3 |
| CVE-2026-108577 | Konstanty Bialkowski libmodplug ABC Music Format load_abc.cpp abc_add_gchord resource consumptionKonstanty Bialkowski · libmodplug | Medium5.3 |
| CVE-2026-105922 | vllm-project vLLM Penalty utils.py get_token_bin_counts_and_mask denial of servicePublic exploitvllm-project · vLLM | Medium5.3 |
| CVE-2026-105250 | vgmstream Microsoft IMA Decoder ima_decoder.c decode_ms_ima divide by zerovgmstream | Medium5.3 |
| CVE-2026-90440 | Apache Thrift: An exception escaping a libevent callback stops the D library's non-blocking server, allowing an unauthenticated remote attacker to deny serviceApache Software Foundation · Apache Thrift | High8.2 |
| CVE-2026-103241 | vllm-project vLLM Gemma4UnifiedParser gemma4.rs denial of servicePublic exploitvllm-project · vLLM | Medium6.9 |
| CVE-2026-47491 | NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an unprivileged user can cause improper release of memory…NVIDIA · GeForce | High7.8 |
| CVE-2026-103118 | GraphicsMagick WPG File wpg.c ExtractPostscript recursionGraphicsMagick | Medium5.3 |
| CVE-2026-101098 | ag-ui-protocol ag-ui HTTP JdkAgentHttpHandler.java readAllBytes resource consumptionag-ui-protocol · ag-ui | Medium5.3 |
| CVE-2026-101040 | Ricoh SP 330DN/SP 221/SP C252SF/Aficio SP 3500SF HTTP Multipart Form-Data denial of servicePublic exploitRicoh · SP 330DN | High7.1 |