Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read just now.
At a glance
Published CVEs; rejected ones are not counted.
- 402,137All CVEsplus 19,141 rejected
- 330Last 24 hours3,295 in the last 7 days
- 16,931Last 30 days1,560 of them critical
- 1,769Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 0 | 2 | 0 | 0 | 0 | 2 | 22 |
| 2025 | 1 | 5 | 11 | 1 | 0 | 18 | 20 |
| 2024 | 0 | 0 | 0 | 0 | 0 | 0 | 2 |
| 2023 | 0 | 0 | 1 | 0 | 0 | 1 | 2 |
| 2022 | 0 | 0 | 1 | 0 | 0 | 1 | 1 |
| Title | ||
|---|---|---|
| CVE-2025-68402 | FreshRSS has an authentication bypass due to truncated bcrypt hash [edge branch]FreshRSS · FreshRSS | High8.2 |
| CVE-2025-62166 | FreshRSS has an IDOR which allows for viewing feeds of any user and leaking tokensPublic exploitFreshRSS · FreshRSS | High7.5 |
| CVE-2025-68148 | FreshRSS globally denies access to feed via proxy modifying to 429 Retry-AfterPublic exploitFreshRSS · FreshRSS | Medium4.3 |
| CVE-2025-68932 | FreshRSS has weak cryptographic randomness in remember-me token and nonce generationPublic exploitFreshRSS · FreshRSS | Low2.9 |
| CVE-2025-59949 | FreshRSS has Logout CSRF that Leads to DoS via <track src>Public exploitFreshRSS · FreshRSS | Medium5.3 |
| CVE-2025-58173 | FreshRSS vulnerable to authenticated RCE via path traversal inside include()Public exploitFreshRSS · FreshRSS | High7.4 |
| CVE-2025-59950 | FreshRSS: Double clickjacking can lead to privilege escalationPublic exploitFreshRSS · FreshRSS | Medium6.7 |
| CVE-2025-61586 | FreshRSS is vulnerable to directory enumeration by setting path in its theme fieldPublic exploitFreshRSS · FreshRSS | Medium6.9 |
| CVE-2025-59948 | FreshRSS is vulnerable to XSS due to lack of CSP on HTML query pagePublic exploitFreshRSS · FreshRSS | Medium6.7 |
| CVE-2025-57769 | FressRSS: Clickjacking can lead to XSS and/or privilege escalationPublic exploitFreshRSS · FreshRSS | Medium5.3 |
| CVE-2025-54875 | FreshRSS: Unauthorized creation of admin user when registration is enabledPublic exploitFreshRSS · FreshRSS | Critical9.8 |
| CVE-2025-54592 | FreshRSS has Incomplete Session Termination on LogoutPublic exploitFreshRSS · FreshRSS | High8.8 |
| CVE-2025-54591 | FreshRSS: Unauthenticated users can view default user's informationPublic exploitFreshRSS · FreshRSS | High7.5 |
| CVE-2025-54593 | FreshRSS is vulnerable to RCE attacks by authenticated adminPublic exploitFreshRSS · FreshRSS | High7.2 |
| CVE-2025-46341 | Privilege escalation via SSRF when using HTTP authPublic exploitFreshRSS · FreshRSS | High7.1 |
| CVE-2025-46339 | FreshRSS vulnerable to favicon cache poisoning via proxyPublic exploitFreshRSS · FreshRSS | Medium4.3 |
| CVE-2025-32015 | FreshRSS vulnerable to Cross-site Scripting by embedding <script> tag inside <iframe srcdoc>Public exploitFreshRSS · FreshRSS | Medium6.7 |
| CVE-2025-31482 | FreshRSS vulnerable to DoS by malicious feed entry loading logout URLPublic exploitFreshRSS · FreshRSS | Medium4.3 |
| CVE-2025-31136 | FreshRSS vulnerable to Cross-site Scripting by <iframe>'ing a vulnerable same-origin page in a feed entryPublic exploitFreshRSS · FreshRSS | Medium6.7 |
| CVE-2025-31134 | FreshRSS vulnerable to directory enumeration via ext.phpPublic exploitFreshRSS · FreshRSS | Medium5.5 |
| CVE-2023-22481 | Sensitive information exposure in the logs of greader API in FreshRSSFreshRSS · FreshRSS | Medium4.0 |
| CVE-2022-23497 | Insecure file access in FreshRSSFreshRSS · FreshRSS | Medium6.5 |