Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 3 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 405,435All CVEsplus 19,159 rejected
- 677Last 24 hours4,923 in the last 7 days
- 18,820Last 30 days1,597 of them critical
- 1,779Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 4 | 6 | 8 | 1 | 0 | 19 | 68 |
| 2025 | 1 | 4 | 3 | 0 | 0 | 8 | 49 |
| 2024 | 3 | 5 | 8 | 0 | 0 | 16 | 41 |
| 2023 | 1 | 8 | 14 | 1 | 0 | 24 | 25 |
| 2022 | 1 | 0 | 0 | 0 | 0 | 1 | 1 |
| Title | ||
|---|---|---|
| CVE-2026-49442 | Cacti: User Enumeration via Error MessagesPublic exploitCacti · cacti | Medium5.3 |
| CVE-2026-39902 | Cacti: Authenticated RCE on Data InputCacti · cacti | High7.2 |
| CVE-2026-46531 | Cacti: Authenticated Stored 2nd-Order SQL Injection in automation_tree_rule_items.field (incomplete-fix variant of CVE-2024-31460 / CVE-2025-24368)Public exploitCacti · cacti | Medium5.5 |
| CVE-2026-71287 | Cacti sanitize_sql_column() Regex Allowlist Permits SQL Time-Delay Functions Leading to Blind SQL InjectionCacti · cacti | High8.8 |
| CVE-2026-40941 | Cacti: Package Import Signature Validation Bypass Allows Self-Signed PackagesCacti · cacti | High7.1 |
| CVE-2026-40084 | Cacti: Arbitrary File Read via Path Traversal in Report `format_file` ParameterPublic exploitCacti · cacti | Medium6.5 |
| CVE-2026-40083 | Cacti: SQL Injection in managers.phpPublic exploitCacti · cacti | High7.2 |
| CVE-2026-40082 | Cacti: Session Fixation via missing session_regenerate_id() after loginCacti · cacti | Medium5.4 |
| CVE-2026-40080 | Cacti: Open Redirect via HTTP_REFERER substring check in auth_login_redirectPublic exploitCacti · cacti | Medium6.1 |
| CVE-2026-40079 | Cacti: Command Injection via escape_command() no-op in RRDtool executionCacti · cacti | High8.6 |
| CVE-2026-39951 | Cacti: Stored SQL Injection via graph_name_regexp in Reports featureCacti · cacti | High7.6 |
| CVE-2026-39948 | Cacti has SQL Injection via rfilter parameter in RLIKE clausesCacti · cacti | Critical9.3 |
| CVE-2026-39955 | Cacti has Pre-Authentication SQL Injection via unanchored FILTER_VALIDATE_REGEXP in graph_view.phpCacti · cacti | Critical9.8 |
| CVE-2026-39938 | Cacti: Unauthenticated RCE on Graph ImageCacti · cacti | Critical9.8 |
| CVE-2026-39900 | Cacti: Reflected XSS via tab parameter in auth_profile.php JavaScript contextCacti · cacti | Medium5.3 |
| CVE-2026-39899 | Cacti: Path Traversal via filename parameter in package_import.phpCacti · cacti | Medium6.9 |
| CVE-2026-39897 | Cacti has a Reflected XSS Vulnerability via html_auth_footerCacti · cacti | Medium5.3 |
| CVE-2026-39894 | Cacti: RRDtool metric shift via LC_NUMERIC locale comma decimal formattingCacti · cacti | Low2.9 |
| CVE-2026-39893 | Cacti: Pre-authentication SQL injection via rfilter RLIKE clause in graph_view.phpCacti · cacti | Critical9.8 |
| CVE-2025-66399 | SNMP Command Injection leads to RCE in CactiPublic exploitCacti · cacti | High7.4 |
| CVE-2025-26520 | Cacti through 1.2.29 allows SQL injection in the template function in host_templates.php via the graph_template parameter. NOTE: this issue exists because of…Cacti · Cacti | High7.6 |
| CVE-2025-24368 | Cacti has a SQL Injection vulnerability when using tree rules through Automation APIPublic exploitCacti · cacti | Medium6.9 |
| CVE-2025-24367 | Cacti allows Arbitrary File Creation leading to RCEPublic exploitCacti · cacti | High8.7 |
| CVE-2025-22604 | Cacti has Authenticated RCE via multi-line SNMP responsesPublic exploitCacti · cacti | Critical9.1 |
| CVE-2024-54145 | Cacti has a SQL Injection vulnerability when request automation devicesPublic exploitCacti · cacti | Medium6.3 |
| CVE-2024-54146 | Cacti has a SQL Injection vulnerability when view host templateCacti · cacti | High7.6 |
| CVE-2024-45598 | Cacti has a Local File Inclusion (LFI) Vulnerability via Poller Standard Error Log PathCacti · cacti | Medium6.0 |
| CVE-2024-43363 | Remote code execution via Log Poisoning in CactiPublic exploitCacti · cacti | High7.2 |
| CVE-2024-43365 | Stored Cross-site Scripting (XSS) when creating external links in CactiPublic exploitCacti · cacti | Medium5.7 |
| CVE-2024-43364 | Stored Cross-site Scripting (XSS) when creating external links in CactiPublic exploitCacti · cacti | Medium5.7 |
| CVE-2024-43362 | Stored Cross-site Scripting (XSS) when creating external links in CactiPublic exploitCacti · cacti | High7.3 |
| CVE-2024-34340 | Authentication Bypass when using using older password hashesPublic exploitCacti · cacti | Critical9.1 |
| CVE-2024-31460 | Cacti SQL Injection vulnerability in lib/api_automation.php caused by reading dirty data stored in databaseCacti · cacti | Medium6.5 |
| CVE-2024-31459 | Cacti RCE vulnerability by file include in lib/plugin.phpPublic exploitCacti · cacti | High8.1 |
| CVE-2024-31458 | Cacti SQL Injection vulnerability in lib/html_form_templates.php by reading dirty data stored in databaseCacti · cacti | Medium4.6 |
| CVE-2024-31445 | SQL Injection vulnerability in automation_get_new_graphs_sqlPublic exploitCacti · cacti | High8.8 |
| CVE-2024-31444 | Cacti XSS vulnerability in lib/html.php by reading dirty data stored in databaseCacti · cacti | Medium4.6 |
| CVE-2024-31443 | Cacti XSS vulnerability in lib/html_tree.php by reading dirty data stored in databaseCacti · cacti | Medium5.7 |
| CVE-2024-30268 | Cacti XSS vulnerability in display_settingsPublic exploitCacti · cacti | Medium6.1 |
| CVE-2024-29895 | Cacti command injection in cmd_realtime.phpPublic exploitCacti · cacti | Critical10.0 |
| CVE-2024-29894 | Cacti Cross-site Scripting vulnerability when using JavaScript based messaging APICacti · cacti | Medium5.4 |
| CVE-2024-27082 | Cacti Cross-site Scripting vulnerability when managing treesPublic exploitCacti · cacti | High7.6 |
| CVE-2024-25641 | Cacti RCE vulnerability when importing packagesPublic exploitCacti · cacti | Critical9.1 |
| CVE-2023-51448 | SQL Injection vulnerability when managing SNMP Notification ReceiversCacti · cacti | High8.8 |
| CVE-2023-50250 | Cross-Site Scripting vulnerability when Import xml template fileCacti · cacti | Medium5.4 |
| CVE-2023-49088 | Cacti has incomplete fix for CVE-2023-39515Public exploitCacti · cacti | Medium6.1 |
| CVE-2023-49085 | Cacti SQL Injection vulnerabilityPublic exploitCacti · cacti | High8.8 |
| CVE-2023-49086 | Cacti is vulnerable to cross-Site scripting (XSS) DOMCacti · cacti | Medium5.4 |
| CVE-2023-49084 | Local File Inclusion (RCE) in CactiPublic exploitCacti · cacti | High8.1 |
| CVE-2023-39511 | Stored Cross-Site-Scripting on reports_admin.php device name in CactiPublic exploitCacti · cacti | Medium6.1 |