Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 8 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 402,147All CVEsplus 19,142 rejected
- 214Last 24 hours3,231 in the last 7 days
- 16,929Last 30 days1,558 of them critical
- 1,769Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 5 | 7 | 0 | 0 | 0 | 12 | 15 |
| 2025 | 0 | 1 | 2 | 0 | 0 | 3 | 3 |
| Title | ||
|---|---|---|
| CVE-2026-119706 | LMDeploy 0.9.0 through 0.18.0 Unauthenticated RCE via /update_weights Pickle DeserializationPublic exploitInternLM · lmdeploy | Critical9.3 |
| CVE-2026-105135 | InternLM MindSearch Planner Agent graph.py ExecutionAction.run code injectionPublic exploitInternLM · MindSearch | Critical10.0 |
| CVE-2026-33625 | LMDeploy vulnerable to arbitrary code execution via eval() of untrusted quant_dtype in model config loadingPublic exploitInternLM · lmdeploy | High8.8 |
| CVE-2025-66455 | LMDeploy has Remote Code Execution by Pickle Deserialization via handle_zmq_recv in lmdeploy/lmdeploy/pytorch/disagg/conn/engine_conn.pyInternLM · lmdeploy | Critical9.8 |
| CVE-2026-92983 | InternLM LMDeploy through 0.17.0 Memory Exhaustion via Session ID MismatchPublic exploitInternLM · lmdeploy | High8.7 |
| CVE-2026-92971 | InternLM LMDeploy through 0.17.0 Assertion Denial of ServicePublic exploitInternLM · lmdeploy | High8.7 |
| CVE-2025-59953 | LMdeploy has Remote Code Execution by Pickle Deserialization via zmq_rpc.call_and_response() in InterLM/lmdeployPublic exploitInternLM · lmdeploy | Critical9.8 |
| CVE-2026-76850 | LMDeploy Remote Code Execution via Unsafe Pickle Deserialization in the Disaggregated Serving Peer ConnectorPublic exploitInternLM · lmdeploy | Critical9.3 |
| CVE-2026-63764 | LMDeploy Server-Side Request Forgery via HTTP Redirect BypassPublic exploitInternLM · lmdeploy | High7.7 |
| CVE-2026-46517 | LMDeploy: Hardcoded trust_remote_code=True is an implicit unsafe remote-code load path with no user opt-outInternLM · lmdeploy | High7.8 |
| CVE-2026-46432 | LMDeploy: Arbitrary code execution via hardcoded trust_remote_code=True in lmdeploy model initializationPublic exploitInternLM · lmdeploy | High7.8 |
| CVE-2026-33626 | LMDeploy Vulnerable to Server-Side Request Forgery (SSRF) via Vision-Language Image LoadingPublic exploitInternLM · lmdeploy | High7.5 |
| CVE-2025-67729 | lmdeploy vulnerable to Arbitrary Code Execution via Insecure Deserialization in torch.load()Public exploitInternLM · lmdeploy | High8.8 |
| CVE-2025-3163 | InternLM LMDeploy conf.py open code injectionPublic exploitInternLM · LMDeploy | Medium4.8 |
| CVE-2025-3162 | InternLM LMDeploy PT File utils.py load_weight_ckpt deserializationPublic exploitInternLM · LMDeploy | Medium4.8 |