Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 7 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 402,159All CVEsplus 19,142 rejected
- 204Last 24 hours3,229 in the last 7 days
- 16,874Last 30 days1,558 of them critical
- 1,769Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 0 | 0 | 0 | 0 | 0 | 0 | 91 |
| 2025 | 0 | 0 | 1 | 0 | 0 | 1 | 91 |
| 2024 | 0 | 2 | 0 | 0 | 0 | 2 | 90 |
| 2023 | 1 | 0 | 0 | 0 | 0 | 1 | 88 |
| 2022 | 0 | 0 | 0 | 0 | 0 | 0 | 87 |
| 2021 | 0 | 0 | 1 | 0 | 0 | 1 | 87 |
| 2020 | 7 | 9 | 14 | 1 | 0 | 31 | 86 |
| 2019 | 13 | 27 | 14 | 1 | 0 | 55 | 55 |
| Title | ||
|---|---|---|
| CVE-2025-58712 | Amq: privilege escalation via excessive /etc/passwd permissionsapache · activemq-artemis | Medium6.4 |
| CVE-2024-42362 | GHSL-2023-255: HertzBeat Authenticated (user role) RCE via unsafe deserialization in /api/monitors/importPublic exploitApache · HertzBeat | High8.8 |
| CVE-2024-42361 | GHSL-2023-256: HertzBeat Authenticated (guest role) SQL injection in /api/monitor/{monitorId}/metric/{metricFull}Public exploitApache · HertzBeat | High7.5 |
| CVE-2021-32824 | Regular expression Denial of Service in MooToolsPublic exploitApache · Dubbo | Critical9.8 |
| CVE-2021-25958 | Generation of Error Message Containing Sensitive Information in Apache OFBizapache · ofbiz-framework | Medium6.5 |
| CVE-2020-11996 | A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU…Apache · Apache Tomcat | High7.5 |
| CVE-2020-1956 | Apache Kylin 2.3.0, and releases up to 2.6.5 and 3.0.1 has some restful apis which will concatenate os command with the user input string, a user is likely to…ExploitedPublic exploitApache · Kylin | High8.8 |
| CVE-2019-0235 | Apache OFBiz 17.12.01 is vulnerable to some CSRF attacks.Apache · Apache OFBiz | High8.8 |
| CVE-2019-12425 | Apache OFBiz 17.12.01 is vulnerable to Host header injection by accepting arbitrary hostApache · Apache OFBiz | High7.5 |
| CVE-2020-9482 | If NiFi Registry 0.1.0 to 0.5.0 uses an authentication mechanism other than PKI, when the user clicks Log Out, NiFi Registry invalidates the authentication…Apache · Apache NiFi Registry | Medium6.5 |
| CVE-2020-9481 | Apache ATS 6.0.0 to 6.2.3, 7.0.0 to 7.1.9, and 8.0.0 to 8.0.6 is vulnerable to a HTTP/2 slow read attack.Apache · ATS | High7.5 |
| CVE-2020-1952 | An issue was found in Apache IoTDB .9.0 to 0.9.1 and 0.8.0 to 0.8.2. When starting IoTDB, the JMX port 31999 is exposed with no certification.Then, clients…Apache · IoTDB | Critical9.8 |
| CVE-2020-9488 | Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a…Apache · Apache Log4j | Low3.7 |
| CVE-2020-1927 | In Apache HTTP Server 2.4.0 to 2.4.41, redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and…Apache · Apache HTTP Server | Medium6.1 |
| CVE-2020-1958 | When LDAP authentication is enabled in Apache Druid 0.17.0, callers of Druid APIs with a valid set of LDAP credentials can bypass the…Apache · Apache Druid | Medium6.5 |
| CVE-2019-17564 | Unsafe deserialization occurs within a Dubbo application which has HTTP remoting enabled. An attacker may submit a POST request with a Java object in it to…Apache · Apache Dubbo | Critical9.8 |
| CVE-2018-11802 | In Apache Solr, the cluster can be partitioned into multiple collections and only a subset of nodes actually host any given collection. However, if a node…Apache · Apache Solr | Medium4.3 |
| CVE-2020-1954 | Apache CXF has the ability to integrate with JMX by registering an InstrumentationManager extension with the CXF bus. If the ‘createMBServerConnectorFactory‘…Apache · Apache CXF | Medium5.3 |
| CVE-2020-1934 | In Apache HTTP Server 2.4.0 to 2.4.41, mod_proxy_ftp may use uninitialized memory when proxying to a malicious FTP server.Apache · Apache HTTP Server | Medium5.3 |
| CVE-2020-1943 | Data sent with contentId to /control/stream is not sanitized, allowing XSS attacks in Apache OFBiz 16.11.01 to 16.11.07.Apache · Apache OFBiz | Medium6.1 |
| CVE-2020-1950 | A carefully crafted or corrupt PSD file can cause excessive memory usage in Apache Tika's PSDParser in versions 1.0-1.23.Apache · Apache Tika | Medium5.5 |
| CVE-2020-1953 | Apache Commons Configuration uses a third-party library to parse YAML files which by default allows the instantiation of classes if the YAML includes special…Apache · Apache Commons Configuration | Critical10.0 |
| CVE-2011-2487 | The implementations of PKCS#1 v1.5 key transport mechanism for XMLEncryption in JBossWS and Apache WSS4J before 1.6.5 is susceptible to a Bleichenbacher attack.Apache · WSS4J | Medium5.9 |
| CVE-2020-1938 | When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having…ExploitedPublic exploitApache · Apache Tomcat | Critical9.8 |
| CVE-2020-1935 | In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsing that allowed some…Apache · Apache Tomcat | Medium4.8 |
| CVE-2019-17569 | The refactoring present in Apache Tomcat 9.0.28 to 9.0.30, 8.5.48 to 8.5.50 and 7.0.98 to 7.0.99 introduced a regression. The result of the regression was that…Apache · Apache Tomcat | Medium4.8 |
| CVE-2020-1937 | Kylin has some restful apis which will concatenate SQLs with the user input string, a user is likely to be able to run malicious database queries.Apache · Apache Kylin | High8.8 |
| CVE-2014-4651 | It was found that the jclouds scriptbuilder Statements class wrote a temporary file to a predictable location. An attacker could use this flaw to access…Apache · Apache jclouds | Critical9.8 |
| CVE-2019-12426 | an unauthenticated user could get access to information of some backend screens by invoking setSessionLocale in Apache OFBiz 16.11.01 to 16.11.06Apache · Apache OFBiz | Medium5.3 |
| CVE-2019-17570 | An untrusted deserialization was found in the org.apache.xmlrpc.parser.XmlRpcResponseParser:addResult method of Apache XML-RPC (aka ws-xmlrpc) library. A…Apache · Apache XML-RPC | Critical9.8 |
| CVE-2019-17573 | By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses. This webpage is vulnerable to a reflected…Apache · CXF | Medium6.1 |
| CVE-2019-12423 | Apache CXF ships with a OpenId Connect JWK Keys service, which allows a client to obtain the public keys in JWK format, which can then be used to verify the…Apache · CXF | High7.5 |
| CVE-2020-1929 | The Apache Beam MongoDB connector in versions 2.10.0 to 2.16.0 has an option to disable SSL trust verification. However this configuration is not respected and…Apache · Beam | High7.5 |
| CVE-2019-12398 | In Apache Airflow before 1.10.5 when running with the "classic" UI, a malicious admin user could edit the state of objects in the Airflow metadata database to…Apache · Airflow | Medium4.8 |
| CVE-2019-12399 | When Connect workers in Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, or 2.3.0 are configured with one or more config providers, and a connector is…Apache · Kafka | High7.5 |
| CVE-2019-0219 | A website running in the InAppBrowser webview on Android could execute arbitrary JavaScript in the main application's webview using a specially crafted…Apache · Cordova | Critical9.8 |
| CVE-2019-12420 | In Apache SpamAssassin before 3.4.3, a message can be crafted in a way to use excessive resources. Upgrading to SA 3.4.3 as soon as possible is the recommended…Apache · Apache SpamAssassin | High7.5 |
| CVE-2018-11805 | In Apache SpamAssassin before 3.4.3, nefarious CF files can be configured to run system commands without any output or errors. With this, exploits can be…Apache · Apache SpamAssassin | Medium6.7 |
| CVE-2019-17555 | The AsyncResponseWrapperImpl class in Apache Olingo versions 4.0.0 to 4.6.0 reads the Retry-After header and passes it to the Thread.sleep() method without any…Apache · Olingo | High7.5 |
| CVE-2019-17556 | Apache Olingo versions 4.0.0 to 4.6.0 provide the AbstractService class, which is public API, uses ObjectInputStream and doesn't check classes being…Apache · Olingo | Critical9.8 |
| CVE-2019-17554 | The XML content type entity deserializer in Apache Olingo versions 4.0.0 to 4.6.0 is not configured to deny the resolution of external entities. Request with…Apache · Olingo | Medium5.5 |
| CVE-2019-12422 | Apache Shiro before 1.4.2, when using the default "remember me" configuration, cookies could be susceptible to a padding attack.Apache · Shiro | High7.5 |
| CVE-2019-12409 | The 8.1.1 and 8.2.0 releases of Apache Solr contain an insecure setting for the ENABLE_REMOTE_JMX_OPTS configuration option in the default solr.in.sh…Apache · Solr | Critical9.8 |
| CVE-2019-10070 | Apache Atlas versions 0.8.3 and 1.1.0 were found vulnerable to Stored Cross-Site Scripting in the search functionalityApache · Atlas | Medium6.1 |
| CVE-2019-12419 | Apache CXF before 3.3.4 and 3.2.11 provides all of the components that are required to build a fully fledged OpenId Connect service. There is a vulnerability…Apache · Apache CXF | Critical9.8 |
| CVE-2011-3923 | Apache Struts before 2.3.1.2 allows remote attackers to bypass security protections in the ParameterInterceptor class and execute arbitrary commands.Public exploitApache · Struts | Critical9.8 |
| CVE-2019-0205 | In Apache Thrift all versions up to and including 0.12.0, a server or client may run into an endless loop when feed with specific input data. Because the issue…Apache · Apache Thrift | High7.5 |
| CVE-2019-0210 | In Apache Thrift 0.9.3 to 0.12.0, a server implemented in Go using TJSONProtocol or TSimpleJSONProtocol may panic when feed with invalid input data.Apache · Apache Thrift | High7.5 |
| CVE-2019-10071 | The code which checks HMAC in form submissions used String.equals() for comparisons, which results in a timing side channel for the comparison of the HMAC…Apache · Apache Tapestry | Critical9.8 |
| CVE-2019-0207 | Tapestry processes assets `/assets/ctx` using classes chain `StaticFilesFilter -> AssetDispatcher -> ContextResource`, which doesn't filter the character `\`,…Apache · Apache Tapestry | High7.5 |