Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 1 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 405,790All CVEsplus 19,170 rejected
- 385Last 24 hours4,901 in the last 7 days
- 16,937Last 30 days1,493 of them critical
- 1,779Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 0 | 1 | 9 | 0 | 0 | 10 | 12 |
| 2025 | 0 | 0 | 1 | 0 | 0 | 1 | 2 |
| 2024 | 0 | 1 | 0 | 0 | 0 | 1 | 1 |
| Title | ||
|---|---|---|
| CVE-2026-54738 | Lemmy: Rate limit bypass via X-Forwarded-For header spoofing in actix-web ConnectionInfoLemmyNet · lemmy | Medium6.5 |
| CVE-2026-54743 | Lemmy: Stored XSS via markdown image alt-text in lemmy-ui html5-embedPublic exploitLemmyNet · lemmy | Medium6.4 |
| CVE-2026-54739 | Lemmy: Login Endpoint User Enumeration via HTTP Response Code DifferentialLemmyNet · lemmy | Medium6.9 |
| CVE-2026-54740 | Lemmy: Lower-ranked federated moderator can remove higher-ranked moderatorsPublic exploitLemmyNet · lemmy | Medium6.5 |
| CVE-2026-54741 | Lemmy: Blocked users can edit private messages sent before the blockPublic exploitLemmyNet · lemmy | Medium5.3 |
| CVE-2026-54742 | Lemmy: `CollectionAdd::Featured` does not check the post is in the communityPublic exploitLemmyNet · lemmy | Medium5.1 |
| CVE-2026-42180 | Lemmy: SSRF in /api/v3/post via Webmention dispatchPublic exploitLemmyNet · lemmy | Medium6.3 |
| CVE-2026-42181 | Lemmy: SSRF and internal image disclosure in post link metadata via unvalidated og:imagePublic exploitLemmyNet · lemmy | Medium6.5 |
| CVE-2026-33693 | Lemmy's Activitypub-Federation has SSRF via 0.0.0.0 bypass in activitypub-federation-rust v4_is_invalid()Public exploitLemmyNet · lemmy | Medium6.5 |
| CVE-2026-29178 | Lemmy: Unauthenticated SSRF via file_type query parameter injection in image endpointPublic exploitLemmyNet · lemmy | High7.7 |
| CVE-2025-25194 | Server-Side Request Forgery (SSRF) in activitypub_federationPublic exploitLemmyNet · lemmy | Medium4.0 |
| CVE-2024-23649 | Any authenticated user may obtain private message details from other users on the same instanceLemmyNet · lemmy | High7.5 |