Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 9 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 402,126All CVEsplus 19,141 rejected
- 319Last 24 hours3,306 in the last 7 days
- 16,921Last 30 days1,560 of them critical
- 1,769Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 1 | 3 | 7 | 0 | 0 | 11 | 15 |
| 2025 | 0 | 1 | 0 | 0 | 0 | 1 | 4 |
| 2024 | 0 | 0 | 1 | 0 | 0 | 1 | 3 |
| 2023 | 0 | 0 | 1 | 0 | 0 | 1 | 2 |
| 2022 | 0 | 0 | 0 | 0 | 0 | 0 | 1 |
| 2021 | 0 | 0 | 0 | 0 | 0 | 0 | 1 |
| 2020 | 0 | 0 | 0 | 0 | 0 | 0 | 1 |
| 2019 | 0 | 0 | 0 | 1 | 0 | 1 | 1 |
| Title | ||
|---|---|---|
| CVE-2026-41001 | Predictable Temp Directory in Artemis Auto-configurationSpring · Spring Boot | Medium5.3 |
| CVE-2026-40992 | Mail Auto-Configuration Does Not Enable SSL Hostname VerificationSpring · Spring Boot | Medium5.0 |
| CVE-2026-40977 | When an application is configured to use `ApplicationPidFileWriter`, a local attacker with write access to the PID file's location can corrupt one file on the…Spring · Spring Boot | Medium4.7 |
| CVE-2026-40976 | In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to all endpoints. For an application to be vulnerable,…Spring · Spring Boot | Critical9.1 |
| CVE-2026-40975 | Values produced by ${random.value} are not suitable for use as secrets. ${random.uuid} is not affected. ${random.int} and ${random.long} should never be used…Spring · Spring Boot | Medium4.8 |
| CVE-2026-40974 | Spring Boot's Cassandra auto-configuration does not perform hostname verification when establishing an SSL connection to Cassandra. Affected: Spring Boot…Spring · Spring Boot | Medium5.0 |
| CVE-2026-40973 | A local attacker on the same host as the application may be able to take control of the directory used by `ApplicationTemp`. When…Spring · Spring Boot | High7.0 |
| CVE-2026-40972 | An attacker on the same network as the remote application may be able to utilize a timing attack to discover information about the remote secret. In extreme…Spring · Spring Boot | High7.5 |
| CVE-2026-40971 | When configured to use an SSL bundle, Spring Boot's RabbitMQ auto-configuration does not perform hostname verification when connecting to the RabbitMQ broker.…Spring · Spring Boot | Medium5.0 |
| CVE-2026-40970 | When configured to use an SSL bundle, Spring Boot's Elasticsearch auto-configuration does not perform hostname verification when connecting to the…Spring · Spring Boot | Medium5.0 |
| CVE-2026-22731 | Authentication Bypass under Actuator Health groups pathsSpring · Spring Boot | High8.2 |
| CVE-2025-22235 | Spring Boot EndpointRequest.to() creates wrong matcher if actuator endpoint is not exposedSpring · Spring Boot | High7.3 |
| CVE-2024-38807 | CVE-2024-38807: Signature Forgery Vulnerability in Spring Boot's LoaderSpring · Spring Boot | Medium6.3 |
| CVE-2023-34055 | Spring Boot server Web Observations DoS VulnerabilitySpring · Spring Boot | Medium5.3 |
| CVE-2019-3797 | Additional information exposure with Spring Data JPA derived queriesSpring · Spring Boot | Low3.5 |