Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 1 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 405,136All CVEsplus 19,158 rejected
- 608Last 24 hours4,811 in the last 7 days
- 18,809Last 30 days1,601 of them critical
- 1,779Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 264 | 616 | 455 | 45 | 87 | 1,467 | 3,000 |
| 2025 | 30 | 90 | 93 | 5 | 0 | 218 | 1,533 |
| 2024 | 55 | 99 | 99 | 8 | 0 | 261 | 1,315 |
| 2023 | 56 | 99 | 100 | 3 | 1 | 259 | 1,054 |
| 2022 | 57 | 91 | 70 | 2 | 0 | 220 | 795 |
| 2021 | 50 | 72 | 50 | 0 | 0 | 172 | 575 |
| 2020 | 10 | 9 | 12 | 0 | 0 | 31 | 403 |
| 2019 | 6 | 26 | 15 | 0 | 0 | 47 | 372 |
| 2018 | 25 | 71 | 68 | 3 | 0 | 167 | 325 |
| 2017 | 34 | 82 | 41 | 0 | 0 | 157 | 158 |
| 2016 | 0 | 1 | 0 | 0 | 0 | 1 | 1 |
| Title | ||
|---|---|---|
| CVE-2026-89326 | Apache XML Graphics Batik: Check url protocol when loading documentApache Software Foundation · Apache XML Graphics Batik | Not scored |
| CVE-2026-106023 | Apache HTTP Server: mod_md NULL pointer dereference leads to child process crashApache Software Foundation · Apache HTTP Server | Not scored |
| CVE-2026-109163 | Apache HTTP Server: mod_vhost_alias 1 byte stack buffer overwrite (after CVE-2026-63292)Apache Software Foundation · Apache HTTP Server | Not scored |
| CVE-2026-119618 | Apache HTTP Server: mod_http2: heap corruption and RCE in assign_headersApache Software Foundation · Apache HTTP Server | Not scored |
| CVE-2026-71395 | Apache XML Graphics FOP: CWE-502 unsafe deserialization in hyphenation loadingApache Software Foundation · Apache XML Graphics FOP | Not scored |
| CVE-2026-44929 | SSRF Vulnerability in Apache BatikApache Software Foundation · Apache XML Graphics Batik | Not scored |
| CVE-2026-49236 | Apache XML Graphics Batik: SVG color-profile xml:base bypasses Batik external resource same-origin checksApache Software Foundation · Apache XML Graphics Batik | Not scored |
| CVE-2026-40853 | Apache XML Graphics Batik: Cross-Site Scripting via Unencoded Font Metadata in Apache Batik SVGFontApache Software Foundation · Apache XML Graphics Batik | Not scored |
| CVE-2026-123374 | Apache Roller: Deserialization of untrusted data in weblog update ping responsesApache Software Foundation · Apache Roller | Not scored |
| CVE-2026-122300 | Apache Roller: Limited weblog members can remove or change published entriesApache Software Foundation · Apache Roller | Not scored |
| CVE-2026-118414 | Apache Roller: Stored cross-site scripting through the weblog descriptionApache Software Foundation · Apache Roller | Medium5.4 |
| CVE-2026-118413 | Apache Roller: Stored cross-site scripting through imported blogroll linksApache Software Foundation · Apache Roller | Medium5.4 |
| CVE-2026-118412 | Apache Roller: Disabled accounts can sign in through OpenIDApache Software Foundation · Apache Roller | Low3.1 |
| CVE-2026-118411 | Apache Roller: Cross-site request forgery through GET requests to administrative actionsApache Software Foundation · Apache Roller | High8.8 |
| CVE-2026-118410 | Apache Roller: Unpublished entries remain readable through search after AtomPub unpublishApache Software Foundation · Apache Roller | Low3.7 |
| CVE-2026-118409 | Apache Roller: Commenter email addresses recoverable through public searchApache Software Foundation · Apache Roller | Medium5.3 |
| CVE-2026-118408 | Apache Roller: Unpublished entries of other weblogs readable through previewApache Software Foundation · Apache Roller | Low3.1 |
| CVE-2026-111824 | Apache Roller: Stored cross-site scripting through custom-theme resource URLsApache Software Foundation · Apache Roller | Not scored |
| CVE-2026-108338 | Apache Roller: Stored cross-site scripting through AtomPub entry tagsApache Software Foundation · Apache Roller | Not scored |
| CVE-2026-105154 | Apache Roller: Cross-site request forgery in Planet administration lets an attacker make the server fetch arbitrary URLsApache Software Foundation · Apache Roller | Medium6.1 |
| CVE-2026-105153 | Apache Roller: XML external entity processing in AtomPub entry parsingApache Software Foundation · Apache Roller | High7.7 |
| CVE-2026-105152 | Apache Roller: Weblog template access to wrapped objects exposes another user's password hashApache Software Foundation · Apache Roller | Medium4.3 |
| CVE-2026-118405 | Apache Roller: Exposure of other users' email addresses through the user searchApache Software Foundation · Apache Roller | Medium4.3 |
| CVE-2026-124496 | Apache Storm: DRPC HTTP doAsUser bypasses the impersonation authorizerApache Software Foundation · Apache Storm | Not scored |
| CVE-2026-124495 | Apache Storm: Logviewer follows worker symlinks across topology ACLsApache Software Foundation · Apache Storm | Not scored |
| CVE-2026-94125 | Apache Storm: Supervisor page discloses worker placement of other users' topologiesApache Software Foundation · Apache Storm | Not scored |
| CVE-2026-122096 | Apache DataSketches Java: Uncontrolled resource consumption when deserializing crafted sketch imagesApache Software Foundation · Apache DataSketches Java | Not scored |
| CVE-2026-126627 | Apache XML Graphics FOP: Temporary files on Unix-like systems are readable by other local usersApache Software Foundation · Apache XML Graphics FOP | Not scored |
| CVE-2026-111792 | Apache XML Graphics Batik: Denial of Service via SVG Element Reference ResolutionApache Software Foundation · Apache XML Graphics Batik | Not scored |
| CVE-2026-90993 | Apache XML Graphics Batik: Harden validation in SAXDocumentFactoryApache Software Foundation · Apache XML Graphics Batik | Not scored |
| CVE-2026-86336 | Apache TomEE: EJB method authorization is silently skipped on JDK 21+Apache Software Foundation · Apache TomEE | Not scored |
| CVE-2026-86531 | Apache TomEE: DoS via unbounded request body and multipart handling in embedded HTTP serverApache Software Foundation · Apache TomEE | Not scored |
| CVE-2026-87758 | Apache TomEE: Missing TLS hostname verification in ejbds client connectionsApache Software Foundation · Apache TomEE | Not scored |
| CVE-2026-97849 | Apache TomEE: Derby network service listens on all interfacesApache Software Foundation · Apache TomEE | Not scored |
| CVE-2026-97867 | Apache TomEE: Database credential disclosure via remote JNDI lookupApache Software Foundation · Apache TomEE | Not scored |
| CVE-2026-97870 | Apache TomEE: Missing authentication for Hessian endpoints in embedded HTTP serverApache Software Foundation · Apache TomEE | Not scored |
| CVE-2026-97872 | Apache TomEE: Authentication bypass of Hessian EJB endpoints due to ignored security settingsApache Software Foundation · Apache TomEE | Not scored |
| CVE-2026-97874 | Apache TomEE: Authentication bypass for Hessian endpoints in non-root web applicationsApache Software Foundation · Apache TomEE | Not scored |
| CVE-2026-97880 | Apache TomEE: Authentication bypass in the embedded HTTP server for endpoints protected by HTTP Basic authenticationApache Software Foundation · Apache TomEE | Not scored |
| CVE-2026-97881 | Apache TomEE: Path traversal in embedded HTTP server static resource handlingApache Software Foundation · Apache TomEE | Not scored |
| CVE-2026-97888 | Apache TomEE: Caller identity leaks across requests in embedded HTTP serverApache Software Foundation · Apache TomEE | Not scored |
| CVE-2026-97890 | Apache TomEE: Session fixation in embedded HTTP serverApache Software Foundation · Apache TomEE | Not scored |
| CVE-2026-111239 | Apache TomEE: Code execution by any authenticated user via the SSH administration shellApache Software Foundation · Apache TomEE | Not scored |
| CVE-2026-111240 | Apache TomEE: Authentication bypass for accounts without a stored password in SQL login moduleApache Software Foundation · Apache TomEE | Not scored |
| CVE-2026-111241 | Apache TomEE: Local code execution via predictable passivation files in the shared temporary directoryApache Software Foundation · Apache TomEE | Not scored |
| CVE-2026-111242 | Apache TomEE: Privilege escalation via leaked MicroProfile JWT run-as identityApache Software Foundation · Apache TomEE | Not scored |
| CVE-2026-111243 | Apache TomEE: Expired MicroProfile JWT tokens accepted with negative clock skewApache Software Foundation · Apache TomEE | Not scored |
| CVE-2026-111244 | Apache TomEE: Authorization bypass in MicroProfile JWT role checks for JAX-RS resourcesApache Software Foundation · Apache TomEE | Not scored |
| CVE-2026-111245 | Apache TomEE: Privilege escalation via WS-Security caller identity leaking between requestsApache Software Foundation · Apache TomEE | Not scored |
| CVE-2026-111246 | Apache TomEE: HTTP sessions shared across web applications in embedded HTTP serverApache Software Foundation · Apache TomEE | Not scored |