Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 4 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 406,457All CVEsplus 19,171 rejected
- 786Last 24 hours5,187 in the last 7 days
- 16,914Last 30 days1,486 of them critical
- 1,779Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 8 | 71 | 278 | 14 | 0 | 371 | 509 |
| 2025 | 2 | 2 | 61 | 7 | 0 | 72 | 138 |
| 2024 | 1 | 11 | 20 | 2 | 0 | 34 | 66 |
| 2023 | 0 | 0 | 5 | 0 | 0 | 5 | 32 |
| 2022 | 0 | 2 | 11 | 1 | 0 | 14 | 27 |
| 2021 | 0 | 1 | 1 | 0 | 0 | 2 | 13 |
| 2020 | 0 | 0 | 6 | 0 | 0 | 6 | 11 |
| 2019 | 0 | 0 | 0 | 0 | 0 | 0 | 5 |
| 2018 | 0 | 0 | 0 | 0 | 0 | 0 | 5 |
| 2017 | 0 | 0 | 5 | 0 | 0 | 5 | 5 |
| Title | ||
|---|---|---|
| CVE-2026-82174 | Dell PowerStore contains a content-injection vulnerability. An unauthenticated attacker could exploit this vulnerability to display misleading text on the…Dell · PowerStore 500T | Medium4.3 |
| CVE-2026-126349 | Addressable display_uri can show misleading hosts containing bidi and invisible characterssporkmonger · addressable | Low3.1 |
| CVE-2026-114171 | Visual Studio Code Security Feature Bypass VulnerabilityMicrosoft · Visual Studio Code | High8.8 |
| CVE-2026-123995 | Hisense VIDAA Smart TV SSRF via SetAVTransportURI CurrentURIPublic exploitHisense · VIDAA | Medium4.8 |
| CVE-2026-121045 | UI misrepresentation in Browser in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements…Google · Chrome | Medium5.4 |
| CVE-2026-121162 | UI misrepresentation in Notifications in Google Chrome on on Windows prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI…Google · Chrome | Medium5.4 |
| CVE-2026-121081 | UI misrepresentation in Passwords in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to obtain sensitive…Google · Chrome | Medium5.9 |
| CVE-2026-121121 | UI misrepresentation in PageInfo in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium…Google · Chrome | Medium5.4 |
| CVE-2026-121206 | UI misrepresentation in Isolated in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a…Google · Chrome | Medium5.4 |
| CVE-2026-121165 | UI misrepresentation in Mobile in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI…Google · Chrome | Medium5.4 |
| CVE-2026-121043 | UI misrepresentation in Payments in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a…Google · Chrome | Medium5.4 |
| CVE-2026-121190 | UI misrepresentation in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a…Google · Chrome | Medium4.3 |
| CVE-2026-121053 | UI misrepresentation in Transactions Platform in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to…Google · Chrome | Medium5.4 |
| CVE-2026-121209 | UI misrepresentation in Input in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium…Google · Chrome | Medium4.3 |
| CVE-2026-121110 | UI misrepresentation in Shopping in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to spoof UI elements via a crafted HTML page.…Google · Chrome | Medium5.4 |
| CVE-2026-121216 | UI misrepresentation in UI in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted…Google · Chrome | Medium5.4 |
| CVE-2026-121186 | UI misrepresentation in Passwords in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI…Google · Chrome | Medium5.4 |
| CVE-2026-121215 | UI misrepresentation in Bluetooth in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium…Google · Chrome | Medium5.4 |
| CVE-2026-121067 | UI misrepresentation in PermissionElement in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements…Google · Chrome | Medium5.4 |
| CVE-2026-121122 | UI misrepresentation in Prompts in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a…Google · Chrome | Medium5.4 |
| CVE-2026-121177 | UI misrepresentation in PageInfo in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker to spoof UI elements via a crafted HTML page.…Google · Chrome | Medium5.4 |
| CVE-2026-121244 | UI misrepresentation in FileAPI in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a…Google · Chrome | Medium5.4 |
| CVE-2026-121051 | UI misrepresentation in iOSWeb in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker to spoof address bar via a crafted HTML page.…Google · Chrome | Medium6.5 |
| CVE-2026-58930 | An unprivileged application can exploit a lack of package/signature validation in SystemUI's `RemoteQCController` when resolving a hardcoded `content://` URI.…Google · Android | High7.8 |
| CVE-2026-59006 | In getTouchOcclusionMode of WindowState.java, there is a possible tapjacking issue due to a tapjacking/overlay attack. This could lead to local information…Google · Android | Medium4.0 |
| CVE-2026-58886 | In updateInputWindows of InputMonitor.java, there is a possible tapjacking issue due to a logic error in the code. This could lead to local escalation of…Google · Android | High7.8 |
| CVE-2026-55287 | In onCreate of GrantCredentialsPermissionActivity.java, there is a possible way to trick the user into granting account credentials due to misleading or…Google · Android | High8.4 |
| CVE-2026-55263 | In multiple functions of AllowBindAppWidgetActivity.java, there is a possible misunderstanding of reject/consent actions due to misleading or insufficient UI.…Google · Android | High8.4 |
| CVE-2026-55257 | In UsbDialogHelper of UsbDialogHelper.java, there is a possible UI confusion due to misleading or insufficient UI. This could lead to local escalation of…Google · Android | High8.4 |
| CVE-2026-49923 | In onResult of AccountManagerService.java, there is a possible untrusted/misleading UI issue due to a logic error in the code. This could lead to local…Google · Android | High8.4 |
| CVE-2025-26433 | In multiple locations, there is a possible way to trick a user into accepting a permission due to a tapjacking/overlay attack. This could lead to local…Google · Android | High8.4 |
| CVE-2025-22436 | In multiple locations, there is a possible way to trick a user into disclosing Autofill contents due to a tapjacking/overlay attack. This could lead to local…Google · Android | High8.4 |
| CVE-2026-119730 | Maxthon Browser for Android < 7.5.8.103 Fullscreen Address Bar SpoofingMaxthon Technology Limited · Maxthon Browser for Android | Medium5.1 |
| CVE-2026-118027 | Frame poisoning in the Layout componentMozilla · Firefox | Critical9.1 |
| CVE-2026-118018 | Spoofing issue in the Downloads component in Firefox for AndroidMozilla · Firefox | High8.8 |
| CVE-2026-118011 | Frame poisoning in the CSS Parsing and Computation componentMozilla · Firefox | High8.8 |
| CVE-2026-117960 | Spoofing issue in the DOM: Core & HTML componentMozilla · Firefox | Medium4.7 |
| CVE-2026-116631 | External protocol handler (tel:) address bar spoofMozilla · Firefox for iOS | Medium5.4 |
| CVE-2026-116632 | Facetime protocol handler enabled spoofingMozilla · Firefox for iOS | Medium5.4 |
| CVE-2026-113088 | UI misrepresentation in Mobile in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a crafted HTML page.…Google · Chrome | High8.8 |
| CVE-2026-113067 | UI misrepresentation in Chromoting in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to spoof UI elements via…Google · Chrome | High8.8 |
| CVE-2026-113046 | UI misrepresentation in Passwords in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium…Google · Chrome | High8.8 |
| CVE-2026-113182 | UI misrepresentation in Passwords in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to spoof UI elements via a…Google · Chrome | High8.8 |
| CVE-2026-112994 | UI misrepresentation in Browser in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to spoof UI elements via a…Google · Chrome | High8.8 |
| CVE-2026-113169 | UI misrepresentation in WebAppInstalls in Google Chrome on on Android prior to 156.0.8078.47 allowed a local attacker leveraging social engineering to spoof UI…Google · Chrome | Critical9.6 |
| CVE-2026-113173 | UI misrepresentation in UI in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to spoof UI elements…Google · Chrome | High8.8 |
| CVE-2026-113156 | UI misrepresentation in Messages in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a crafted HTML page.…Google · Chrome | High8.8 |
| CVE-2026-113292 | UI misrepresentation in Omnibox in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to spoof address bar via a crafted HTML page.…Google · Chrome | High8.8 |
| CVE-2026-113145 | UI misrepresentation in Messages in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a crafted HTML page.…Google · Chrome | High8.8 |
| CVE-2026-113080 | UI misrepresentation in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to spoof address bar via a crafted Chrome extension.…Google · Chrome | High8.8 |