Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 5 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 402,126All CVEsplus 19,141 rejected
- 319Last 24 hours3,315 in the last 7 days
- 16,921Last 30 days1,560 of them critical
- 1,769Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 1 | 9 | 11 | 3 | 0 | 24 | 25 |
| 2025 | 0 | 0 | 0 | 0 | 0 | 0 | 1 |
| 2024 | 1 | 0 | 0 | 0 | 0 | 1 | 1 |
| Title | ||
|---|---|---|
| CVE-2026-102740 | AsyncHttpClient: Resumable download index store is created world-readable and follows a planted symlinkAsyncHttpClient · async-http-client | Medium5.8 |
| CVE-2026-107226 | AsyncHttpClient: Cookies received over plaintext HTTP can plant, overwrite or delete Secure cookies set over HTTPSAsyncHttpClient · async-http-client | Medium6.8 |
| CVE-2026-107285 | AsyncHttpClient: WebSocket proxy credentials sent to the origin server over a CONNECT tunnelAsyncHttpClient · async-http-client | Medium5.9 |
| CVE-2026-107284 | AsyncHttpClient: WebSocket handshake continues after a failed Sec-WebSocket-Accept checkAsyncHttpClient · async-http-client | Low3.7 |
| CVE-2026-107283 | AsyncHttpClient: Digest authentication cnonce generated with a non-cryptographic random sourceAsyncHttpClient · async-http-client | Low3.7 |
| CVE-2026-107282 | AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new hostAsyncHttpClient · async-http-client | Critical9.4 |
| CVE-2026-107281 | AsyncHttpClient: Connection pool key omits the authenticated principal, so an NTLM or Negotiate connection is reused across identitiesAsyncHttpClient · async-http-client | High7.6 |
| CVE-2026-107280 | AsyncHttpClient: Cookie Domain attribute is not checked against the public suffix list, so a cookie can be set for co.ukAsyncHttpClient · async-http-client | Medium6.9 |
| CVE-2026-107279 | AsyncHttpClient: Digest mutual authentication is switched off by a peer offering qop=auth-intAsyncHttpClient · async-http-client | High8.8 |
| CVE-2026-107232 | AsyncHttpClient: Origin credentials sent in cleartext to a proxy that rejects the CONNECTAsyncHttpClient · async-http-client | High7.5 |
| CVE-2026-107231 | AsyncHttpClient: Digest challenge without a usable nonce downgrades to Basic and sends the password in cleartextAsyncHttpClient · async-http-client | High8.7 |
| CVE-2026-107230 | AsyncHttpClient: Pooled connections can still be shared across NTLM, Negotiate and proxy loginsAsyncHttpClient · async-http-client | High7.4 |
| CVE-2026-107229 | AsyncHttpClient: Incomplete origin checks in the default cookie store allow cookie tossing onto public-suffix and IP-address hostsAsyncHttpClient · async-http-client | Medium4.0 |
| CVE-2026-107228 | AsyncHttpClient CookieStore Silently Overrides Caller's Explicit Cookie Header via setHeader (Bypass of CVE-2024-53990 Fix)AsyncHttpClient · async-http-client | Medium6.8 |
| CVE-2026-107227 | AsyncHttpClient: Unbounded WebSocket permessage-deflate decompression enables a decompression-bomb denial of service when compression is enabledAsyncHttpClient · async-http-client | High7.5 |
| CVE-2026-85716 | AsyncHttpClient: SCRAM and Digest mutual-authentication responses are not verifiedAsyncHttpClient · async-http-client | Low3.7 |
| CVE-2026-85720 | AsyncHttpClient: Origin credentials sent to the proxy on the plaintext CONNECT requestAsyncHttpClient · async-http-client | Medium5.9 |
| CVE-2026-85718 | AsyncHttpClient: Connection permit leak on TLS handshake failure causes per-host denial of serviceAsyncHttpClient · async-http-client | Medium5.9 |
| CVE-2026-85721 | AsyncHttpClient: Unbounded HTTP/1.1 response decompression enables a decompression-bomb denial of serviceAsyncHttpClient · async-http-client | High7.5 |
| CVE-2026-85717 | AsyncHttpClient: Client-wide realm credentials re-sent to a cross-origin redirect targetAsyncHttpClient · async-http-client | Medium6.8 |
| CVE-2026-85719 | AsyncHttpClient: SOCKS proxy credentials sent to the origin server over plaintext HTTPAsyncHttpClient · async-http-client | High7.5 |
| CVE-2026-55688 | AsyncHttpClient: Cookie stored for an unrelated domain (cookie tossing) via ThreadSafeCookieStoreAsyncHttpClient · async-http-client | Medium4.0 |
| CVE-2026-45300 | async-http-client: Cookie header not stripped on cross-origin redirectPublic exploitAsyncHttpClient · async-http-client | High7.4 |
| CVE-2026-40490 | AsyncHttpClient leaks authorization credentials to untrusted domains on cross-origin redirectsAsyncHttpClient · async-http-client | Medium6.8 |
| CVE-2024-53990 | AsyncHttpClient (AHC) library's `CookieStore` replaces explicitly defined `Cookie`sPublic exploitAsyncHttpClient · async-http-client | Critical9.2 |