Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 1 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 403,044All CVEsplus 19,156 rejected
- 707Last 24 hours3,468 in the last 7 days
- 17,220Last 30 days1,542 of them critical
- 1,773Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 15 | 27 | 19 | 0 | 0 | 61 | 413 |
| 2025 | 14 | 52 | 39 | 0 | 0 | 105 | 352 |
| 2024 | 41 | 111 | 24 | 0 | 0 | 176 | 247 |
| 2023 | 29 | 31 | 9 | 0 | 0 | 69 | 71 |
| 2022 | 0 | 0 | 0 | 0 | 0 | 0 | 2 |
| 2021 | 0 | 0 | 2 | 0 | 0 | 2 | 2 |
| Title | ||
|---|---|---|
| CVE-2026-83528 | Exposure of PII in Ivanti EPMM before version 12.10.0.1, 12.9.0.3, and 12.8.0.5 allows a remote authenticated attacker with admin privileges to leak GDPR…Ivanti · Endpoint Manager Mobile | Medium4.9 |
| CVE-2026-107405 | An exposed dangerous function in Ivanti EPMM before version 12.10.0.1, 12.9.0.3, and 12.8.0.5 allows a local authenticated attacker to trigger a denial of…Ivanti · Endpoint Manager Mobile | Medium5.5 |
| CVE-2026-107404 | Argument injection in Ivanti EPMM before version 12.10.0.1, 12.9.0.3, and 12.8.0.5 allows a remote authenticated attacker with admin privileges to delete…Ivanti · Endpoint Manager Mobile | Medium4.9 |
| CVE-2026-105427 | Improper input validation in Ivanti EPMM before version 12.10.0.1, 12.9.0.3, and 12.8.0.5 allows a remote authenticated attacker with admin privileges to…Ivanti · Endpoint Manager Mobile | Medium4.9 |
| CVE-2026-105426 | Improper input validation in Ivanti EPMM before version 12.10.0.1, 12.9.0.3, and 12.8.0.5 allows a remote authenticated attacker with admin privileges to set…Ivanti · Endpoint Manager Mobile | Medium6.7 |
| CVE-2026-123181 | A path traversal vulnerability in Ivanti Sentry before versions 10.7.4 and 10.8.3 allows a remote authenticated attacker with administrative privileges to…Ivanti · Sentry | Medium5.5 |
| CVE-2026-123179 | An insecure default initialization of resource in the Tomcat shutdown listener of Ivanti Ivanti Sentry before versions 10.7.4 and 10.8.3 allows a local…Ivanti · Sentry | Medium5.5 |
| CVE-2026-105669 | Argument injection in Ivanti Sentry before version 10.8.3 and 10.7.4 allows a remote authenticated attacker with admin privileges to execute arbitrary on-disk…Ivanti · Sentry | Medium6.7 |
| CVE-2026-105425 | OS command injection in Ivanti Sentry before versions 10.7.4, 10.8.3, and 11.0.0 as well as in Ivanti EPMM before version 12.10.0.1, 12.9.0.3, and 12.8.0.5…Ivanti · Sentry | High7.2 |
| CVE-2026-121683 | Missing authentication in Ivanti Cloud Services Application version 5.0.8 allows a remote unauthenticated attacker to add and delete arbitrary trusted EPM Core…Ivanti · Cloud Services Application | Critical9.4 |
| CVE-2026-18128 | Cleartext transmission of sensitive information in the Agent of Ivanti Endpoint Manager before version 2024 SU8 allows a remote unauthenticated attacker to in…ivanti · Endpoint Manager | Medium6.8 |
| CVE-2026-121653 | SQL injection in the Core of Ivanti Endpoint Manager before version 2024 SU8 allows a remote unauthenticated attacker to achieve remote code execution.ivanti · Endpoint Manager | Critical9.8 |
| CVE-2026-105813 | Cleartext storage of sensitive information in Ivanti UWM before version 2026.4 allows a local authenticated attacker to retrieve another local user's session…Ivanti · User Workspace Manager | Medium6.3 |
| CVE-2026-118527 | Use of predictable filenames in Ivanti Connect Secure before versions 25.1.1.3 and 22.8R2.6 allows a remote authenticated attacker to upload files with…ExploitedPublic exploitIvanti · Connect Secure | Medium4.3 |
| CVE-2026-111357 | Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root,…ExploitedPublic exploitIvanti · Connect Secure | High7.0 |
| CVE-2026-109412 | An exposed dangerous endpoint in Ivanti Neurons Patch for Intune allows a remote authenticated attacker to leak sensitive authentication information.Ivanti · Neurons Patch for Intune | Critical9.9 |
| CVE-2026-106047 | A Path Traversal vulnerability in the template export functionality of Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to read…Ivanti · Xtraction | High7.7 |
| CVE-2026-106043 | A Missing Authentication for Critical Function vulnerability in Ivanti Xtraction before version 2026.4 allows a remote unauthenticated attacker to create,…Ivanti · Xtraction | High7.5 |
| CVE-2026-106042 | An External Control of File Name or Path vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to redirect…Ivanti · Xtraction | Critical9.9 |
| CVE-2026-106035 | An Information Exposure Through Log Files vulnerability in Ivanti Xtraction Cloud Sync before version 2026.4 allows a remote authenticated attacker to disclose…Ivanti · Xtraction | Medium5.5 |
| CVE-2026-106034 | A Path Traversal vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to create, modify, arbitrary directories the…Ivanti · Xtraction | Medium5.0 |
| CVE-2026-104935 | Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact…ExploitedPublic exploitIvanti · Connect Secure | High8.6 |
| CVE-2026-12647 | A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.Ivanti · Ivanti Neurons for ITSM | Critical9.9 |
| CVE-2026-12646 | A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.Ivanti · Ivanti Neurons for ITSM | Critical9.9 |
| CVE-2026-12645 | A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.Ivanti · Ivanti Neurons for ITSM | Critical9.9 |
| CVE-2026-83527 | An Authentication Bypass vulnerability in Sentry before R10.8.2, R10.7.3 and R10.6.4 allows a remote unauthenticated attacker to gain administrative level…Ivanti · Sentry | High8.1 |
| CVE-2026-12648 | A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on…Ivanti · Neurons for ITSM | High8.8 |
| CVE-2026-12650 | A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on…Ivanti · Neurons for ITSM | Critical9.9 |
| CVE-2026-12651 | A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on…Ivanti · Neurons for ITSM | High8.8 |
| CVE-2026-12745 | A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote unauthenticated attacker to execute arbitrary code…Ivanti · Neurons for ITSM | Critical9.8 |
| CVE-2026-12744 | A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote unauthenticated attacker to execute arbitrary code…Ivanti · Neurons for ITSM | Critical9.8 |
| CVE-2026-18851 | Missing authorization in Ivanti Endpoint Manager Mobile before version 12.10.0.0, 12.9.0.2, and 12.8.0.4 allows a remote authenticated attacker to escalate…Ivanti · Endpoint Manager Mobile | High8.8 |
| CVE-2026-18129 | Cleartext transmission of sensitive information in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a remote unauthenticated attacker in a…Ivanti · Endpoint Manager | High8.1 |
| CVE-2026-18127 | External control of a filename in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a remote authenticated attacker full write control over an…Ivanti · Endpoint Manager | High7.7 |
| CVE-2026-18125 | An out-of-bounds read in the Agent of Ivanti Endpoint Manager before version 2024 SU7 allows a remote unauthenticated attacker to crash an agent service.Ivanti · Endpoint Manager | High7.5 |
| CVE-2026-14903 | Path traversal in Ivanti Xtraction before version 2026.2.1 allows a remote authenticated attacker to read arbitrary files outside the web root.ivanti · Xtraction | High7.7 |
| CVE-2026-14902 | An open redirect in Ivanti Xtraction before version 2026.2.1 allows a remote unauthenticated attacker to redirect users to arbitrary external URLs.ivanti · Xtraction | Medium4.0 |
| CVE-2026-10727 | An OS command injection vulnerability in Ivanti EPMM before 12.9.0.1, 12.8.0.3 and 12.7.0.2 versions allows a remote authenticated attacker to execute…Ivanti · Endpoint Manager Mobile | High7.2 |
| CVE-2026-10523 | An Authentication Bypass vulnerability (CWE-288) in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated attacker to…ivanti · Sentry | Critical9.9 |
| CVE-2026-10520 | An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated user to achieve…ExploitedPublic exploitivanti · Sentry | Critical10.0 |
| CVE-2026-9614 | An Improper Access Control vulnerability in Ivanti Neurons for ITSM (cloud and on-premises) allows a remote authenticated attacker to gain administrative…Ivanti · Neurons for ITSM (On-Premises) | High8.8 |
| CVE-2026-8992 | An improper certificate validation vulnerability in Ivanti Secure Access Client before 22.8R6 allows a remote unauthenticated attacker to execute arbitrary…ivanti · Secure Access Client | High8.8 |
| CVE-2026-8111 | SQL injection in the web console of Ivanti Endpoint Manager before version 2024 SU6 allows a remote authenticated attacker to achieve remote code execution.ivanti · Endpoint Manager | High8.8 |
| CVE-2026-8110 | Incorrect permissions assignment in the agent of Ivanti Endpoint Manager before version 2024 SU6 allows a local authenticated attacker to escalate their…ivanti · Endpoint Manager | High7.8 |
| CVE-2026-8109 | An exposed dangerous method on the Core Server of Ivanti Endpoint Manager before version 2024 SU6 allows a remote authenticated attacker to leak access…ivanti · Endpoint Manager | Medium6.5 |
| CVE-2026-8051 | OS command injection in Ivanti Virtual Traffic Manager before version 22.9r4 allows a remote authenticated attacker with admin privileges to achieve remote…ivanti · Virtual Traffic Manager | High7.2 |
| CVE-2026-7432 | A race condition in Ivanti Secure Access Client before 22.8R6 allows a locally authenticated user to escalate privileges to SYSTEMivanti · Secure Access Client | High7.8 |
| CVE-2026-7431 | An incorrect permission assignment for critical resource of Ivanti Secure Access Client before 22.8R6 allows a local authenticated user to read or modify…ivanti · Secure Access Client | Medium4.4 |
| CVE-2026-8043 | External control of a file name in Ivanti Xtraction before version 2026.2 allows a remote authenticated attacker to read sensitive files and write arbitrary…ivanti · Xtraction | Critical9.6 |
| CVE-2026-5787 | An Improper Certificate Validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote unauthenticated attacker to impersonate…Ivanti · Endpoint Manager Mobile | High8.9 |