Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 3 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 405,830All CVEsplus 19,170 rejected
- 358Last 24 hours4,874 in the last 7 days
- 16,869Last 30 days1,488 of them critical
- 1,779Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 28 | 72 | 142 | 35 | 1 | 278 | 717 |
| 2025 | 5 | 31 | 44 | 11 | 0 | 91 | 439 |
| 2024 | 8 | 16 | 39 | 10 | 0 | 73 | 348 |
| 2023 | 2 | 21 | 36 | 6 | 0 | 65 | 275 |
| 2022 | 7 | 13 | 24 | 8 | 0 | 52 | 210 |
| 2021 | 9 | 21 | 21 | 3 | 0 | 54 | 158 |
| 2020 | 6 | 17 | 21 | 7 | 0 | 51 | 104 |
| 2019 | 4 | 10 | 8 | 0 | 0 | 22 | 53 |
| 2018 | 1 | 6 | 9 | 0 | 0 | 16 | 31 |
| 2017 | 2 | 4 | 7 | 0 | 0 | 13 | 15 |
| 2016 | 0 | 0 | 0 | 0 | 0 | 0 | 2 |
| 2015 | 0 | 0 | 0 | 0 | 0 | 0 | 2 |
| 2014 | 0 | 0 | 1 | 0 | 0 | 1 | 2 |
| 2013 | 0 | 1 | 0 | 0 | 0 | 1 | 1 |
| Title | ||
|---|---|---|
| CVE-2026-126658 | ByteStash 1.5.10 before 1.6.2 Insufficient Session Expiration via API Keysjordan-dalby · ByteStash | Medium5.3 |
| CVE-2026-126076 | Action Pack: Possible restoration of destroyed sessions in Action Dispatch CacheStorerails · rails | Medium4.2 |
| CVE-2026-111243 | Apache TomEE: Expired MicroProfile JWT tokens accepted with negative clock skewApache Software Foundation · Apache TomEE | Not scored |
| CVE-2026-123813 | pyLoad: Privilege revocation and password change through the REST API do not invalidate the user's sessionpyload · pyload | High7.5 |
| CVE-2026-123804 | SuperTokens Core: A session created concurrently with account unlink survives the unlinksupertokens · supertokens-core | Medium6.8 |
| CVE-2026-123799 | SuperTokens Core: Dashboard session tokens are never checked for expiry: `isValidUserSession` ignores the stored `expiry`, so a long-expired admin session still authenticatessupertokens · supertokens-core | High7.4 |
| CVE-2026-106466 | JWT Auth <= 3.0.2 - Unauthenticated Account Access Persistence via Insufficient Refresh Token RevocationPublic exploitUnknown · JWT Auth | High7.5 |
| CVE-2026-113508 | Apache Airflow: Logout token revocation fails open; errors silently swallowedApache Software Foundation · Apache Airflow | High7.5 |
| CVE-2026-123598 | Hickory DNS 0.25.0 through 0.26.0-alpha.1 DNSSEC Bogus Answer Cache Poisoninghickory-dns · hickory-dns | Medium6.3 |
| CVE-2026-123597 | Hickory DNS DNSSEC Validation Cache Poisoning via Transient DS-Fetch Errorshickory-dns · hickory-dns | Medium6.3 |
| CVE-2026-123528 | Vikunja before 2.7.1 Insufficient Session Expiration via HTTP Token MiddlewarePublic exploitgo-vikunja · vikunja | High7.6 |
| CVE-2026-123493 | Vikunja from 2.4.0 before 2.7.1 Authentication Bypass via Bot API Tokensgo-vikunja · vikunja | Medium5.3 |
| CVE-2026-66986 | HCL AION is affected by multiple security vulnerabilities.HCL Software · HCL AION | Low3.3 |
| CVE-2026-123292 | In JetBrains Datalore before 2026.4 aPI tokens and sessions of removed or banned users remained validJetBrains · Datalore | Low2.7 |
| CVE-2026-84155 | Session Token Remains Valid After Logout in Multi-Worker DeploymentsPublic exploitEricsson · CodeChecker | Medium5.3 |
| CVE-2026-82907 | Apache OFBiz: externalLoginKey honoured pre-auth, reusable and unboundApache Software Foundation · Apache OFBiz | Critical9.8 |
| CVE-2026-54375 | VitaFit Android < 2.8.1.0 Long-Lived Session Token ExposurePublic exploitShenzhen Shine Industrial Co., Ltd. · VitaFit | High8.6 |
| CVE-2026-121735 | blueprintUE Self-Hosted Edition before 4.3.4 Non-Expiring Account Confirmation Tokensblueprintue · blueprintue-self-hosted-edition | Medium6.3 |
| CVE-2026-95762 | Authenticated Insufficient Session Expiration Vulnerability in the API of HPE Networking Fabric ComposerHewlett Packard Enterprise (HPE) · Fabric Composer | Medium5.9 |
| CVE-2024-9517 | Improper Token Renewal in Refresh Token Grant in Multiple WSO2 Products Allows Unauthorized Access to Blocked AccountsWSO2 · WSO2 API Manager | Medium4.9 |
| CVE-2026-120340 | mathurvishal CloudClassroom-PHP-Project Global Session session expirationPublic exploitmathurvishal · CloudClassroom-PHP-Project | Medium6.3 |
| CVE-2026-82559 | Apache Wicket: WebSocket messages are processed against an HTTP session snapshot that survives invalidationApache Software Foundation · Apache Wicket | Low2.3 |
| CVE-2026-63400 | Coop sessions are not invalidated on password resetroostorg · coop | Low2.3 |
| CVE-2026-116251 | pgAdmin 4: A user's other sessions survive a change of their passwordpgadmin.org · pgAdmin 4 | Low2.3 |
| CVE-2026-119577 | ArcadeDB before 26.10.2 Improper Session Revocation in Wire-Protocol ConnectionsArcadeData · arcadedb | High7.6 |
| CVE-2025-49602 | An issue was discovered in Keyfactor EJBCA 9. When an administrator is removed from its administrator role while having a valid TLS session, EJBCA may, in… | Critical9.8 |
| CVE-2026-118665 | GraphQL Tools: Per-request connection parameters persist into later users' WebSocket authenticationsPublic exploitardatan · graphql-tools | High8.2 |
| CVE-2026-6647 | Incomplete OAuth Token Revocation via Case Mismatch in WSO2 Identity Server Allows Continued Access After Lifecycle EventsWSO2 · WSO2 Identity Server | High7.4 |
| CVE-2026-3583 | Improper Token Revocation via OAuth2 Scope Enforcement in Multiple WSO2 Products [Disrupted Authentication Flows]WSO2 · WSO2 API Manager | Low3.1 |
| CVE-2026-117499 | @fastify/session vulnerable to session revocation bypass via a logout race condition@fastify/session · @fastify/session | Low3.7 |
| CVE-2026-116894 | REDAXO before 5.21.5 Insufficient Session Expiration on Password Changeredaxo · core | Low2.3 |
| CVE-2026-107146 | Insufficient session expiration in twofactor_gauthenticatoralexandregz · twofactor_gauthenticator | Medium6.3 |
| CVE-2026-95663 | Apache Camel: Camel-Keycloak Security Policy Accepts Expired Access Tokens Because Cached Token Introspection Results Are Not Bounded by the Token ExpiryApache Software Foundation · Apache Camel | Medium4.8 |
| CVE-2026-96616 | Kiloview E3 NDI Encoder Insufficient Session ExpirationKiloview · E3 Firmware | High8.3 |
| CVE-2026-115362 | OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Expired AppRole SecretID Authentication Bypassopenbao · openbao | Low2.1 |
| CVE-2026-115356 | OpenBao before 2.6.4 and 2.7.0 before 2.7.1 Kubernetes Auth Method Token Renewal After Revocationopenbao · openbao | Medium5.3 |
| CVE-2026-54238 | Supabase Realtime: Expired JWTs with string exp are accepted by REST broadcast authorizationsupabase · realtime | Low3.1 |
| CVE-2026-114137 | Django REST framework: TokenProxy.delete() reports success and revokes nothingencode · django-rest-framework | High7.4 |
| CVE-2026-89035 | MikroTik RouterOS 7.24.5 WebFig Session Token Replay Authentication BypassMikroTik · RouterOS | Critical9.1 |
| CVE-2025-0326 | Improper Token Revocation in WSO2 Identity Server Allows Unauthorized AccessWSO2 · WSO2 Identity Server | High7.4 |
| CVE-2025-36069 | TS4500 Tape Library Insufficient Session ExpirationIBM · Storage TS4500 Library | Medium5.5 |
| CVE-2025-36252 | TS4500 Tape Library Insufficient Session ExpirationIBM · Storage TS4500 Library | Medium6.3 |
| CVE-2025-13173 | Improper Token Revocation via Session-Bound Token Flow in Multiple WSO2 Products Allows Unauthorized Access After Session TerminationWSO2 · WSO2 API Control Plane | Medium6.5 |
| CVE-2026-12254 | Netskope Client Captive Portal WebView Persistence allowing SWG bypass issueNetskope Inc. · Netskope Client | Medium6.4 |
| CVE-2026-110008 | @fastify/oauth2 vulnerable to Login CSRF via OAuth state cookie not cleared after callback@fastify/oauth2 · @fastify/oauth2 | Medium4.2 |
| CVE-2026-79624 | Apache Answer: Stale Visit Tokens Retain Access to Private Uploads After Session RevocationApache Software Foundation · Apache Answer | Critical9.8 |
| CVE-2026-110024 | @fastify/jwt vulnerable to missing token expiration when per-call options drop global defaults@fastify/jwt · @fastify/jwt | Medium6.8 |
| CVE-2026-111919 | Vikunja 0.22.0 before 2.7.0 Improper Access Revocation via WebhooksPublic exploitgo-vikunja · vikunja | High7.1 |
| CVE-2026-111917 | Vikunja 2.3.0 before 2.7.0 WebSocket Authentication Ignores Session RevocationPublic exploitgo-vikunja · vikunja | High7.1 |
| CVE-2025-71435 | Coder before 2.23.0 Session Expiration Bypass via OIDC Without Refresh Tokencoder · coder | Low2.3 |