Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 8 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 406,611All CVEsplus 19,172 rejected
- 69Last 24 hours4,660 in the last 7 days
- 16,248Last 30 days1,433 of them critical
- 1,781Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 2 | 4 | 3 | 0 | 0 | 9 | 19 |
| 2025 | 0 | 0 | 3 | 0 | 0 | 3 | 10 |
| 2024 | 0 | 1 | 2 | 0 | 0 | 3 | 7 |
| 2023 | 0 | 0 | 3 | 0 | 0 | 3 | 4 |
| 2022 | 0 | 1 | 0 | 0 | 0 | 1 | 1 |
| Title | ||
|---|---|---|
| CVE-2026-114442 | Apache HertzBeat: incomplete XPath expression validation in aliasFieldsApache Software Foundation · Apache HertzBeat | Medium6.5 |
| CVE-2026-93434 | Fireware OS XPath Injection in SSH Authentication Allows Blind Extraction of Configuration SecretsWatchGuard · Fireware OS | High8.7 |
| CVE-2026-58395 | OPNsense: XPath injection in MVC safe-deletePublic exploitopnsense · core | Medium4.3 |
| CVE-2026-53582 | OPNsense: XPATH Injection can disclose any secret in config.xmlopnsense · core | High7.1 |
| CVE-2026-11864 | Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for August 2026.IBM · Cloud Pak for Business Automation | Medium6.5 |
| CVE-2026-9390 | XML::Sig versions before 0.71 for Perl allow XPath injection in ID lookupTIMLEGGE · XML::Sig | Critical9.1 |
| CVE-2026-44962 | Plesk contains an XPath injection vulnerability in the APS Application Catalog search functionality, where user-supplied input is interpolated into XPath…WebPros · Plesk | Critical9.9 |
| CVE-2026-40699 | BIG-IP Configuration utility vulnerabilityF5 · BIG-IP | High7.1 |
| CVE-2026-24343 | Apache HertzBeat: Uncontrolled Resource Consumption via Crafted XPath ExpressionsApache Software Foundation · Apache HertzBeat | High8.8 |
| CVE-2025-11844 | XPath Injection in Hugging Face Smolagents search_item_ctrl_f FunctionPublic exploithuggingface · huggingface/smolagents | Medium5.4 |
| CVE-2025-20218 | Cisco Secure Firepower Management Center Software XPATH Injection VulnerabilityCisco · Cisco Firepower Management Center | Medium4.9 |
| CVE-2022-43840 | IBM Aspera Console XPath injectionIBM · Aspera Console | Medium4.3 |
| CVE-2024-39565 | Junos OS: J-Web: An unauthenticated, network-based attacker can perform XPATH injection attack against a device.Juniper Networks, Inc. · Junos OS | High7.7 |
| CVE-2024-2648 | Netentsec NS-ASG Application Security Gateway naccheck.php xpath injectionPublic exploitNetentsec · NS-ASG Application Security Gateway | Medium4.3 |
| CVE-2024-2645 | Netentsec NS-ASG Application Security Gateway resetpwd.php xpath injectionPublic exploitNetentsec · NS-ASG Application Security Gateway | Medium4.3 |
| CVE-2023-36429 | Microsoft Dynamics 365 (On-Premises) Information Disclosure VulnerabilityMicrosoft · Microsoft Dynamics 365 (on-premises) version 9.0 | Medium6.5 |
| CVE-2023-36433 | Microsoft Dynamics 365 (On-Premises) Information Disclosure VulnerabilityMicrosoft · Microsoft Dynamics 365 (on-premises) version 9.0 | Medium6.5 |
| CVE-2023-24922 | Microsoft Dynamics 365 (On-Premises) Information Disclosure VulnerabilityMicrosoft · Microsoft Dynamics 365 (on-premises) version 9.0 | Medium6.5 |
| CVE-2020-25162 | B. Braun SpaceCom, Battery Pack SP with Wi-Fi, and Data module compactplusB. Braun Melsungen AG · SpaceCom | High7.5 |