Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 5 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 402,126All CVEsplus 19,141 rejected
- 319Last 24 hours3,315 in the last 7 days
- 16,921Last 30 days1,560 of them critical
- 1,769Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 10 | 71 | 102 | 23 | 0 | 206 | 247 |
| 2025 | 2 | 2 | 2 | 1 | 0 | 7 | 41 |
| 2024 | 2 | 6 | 5 | 2 | 0 | 15 | 34 |
| 2023 | 0 | 0 | 6 | 1 | 0 | 7 | 19 |
| 2022 | 0 | 0 | 0 | 0 | 0 | 0 | 12 |
| 2021 | 0 | 0 | 0 | 0 | 0 | 0 | 12 |
| 2020 | 0 | 1 | 1 | 0 | 0 | 2 | 12 |
| 2019 | 3 | 1 | 3 | 3 | 0 | 10 | 10 |
| Title | ||
|---|---|---|
| CVE-2026-59324 | fluxTransform shared RequestMessageHolder causes cross-message header leakage under async fluxFunctionSpring · Spring Integration | High8.2 |
| CVE-2026-59322 | EmbeddedHeadersJsonMessageMapper default gives wire peer full control of MessageHeadersSpring · Spring Integration | Medium6.3 |
| CVE-2026-59321 | Shared JSR-223 ScriptEngine evaluated concurrently without THREADING checkSpring · Spring Integration | Medium4.2 |
| CVE-2026-59320 | In Spring AMQP the link credit never replenished on listener exception pathSpring · Spring AMQP | Medium6.5 |
| CVE-2026-59319 | RediSearch Tag Injection in RedisChatMemoryRepository Allows Cross-Conversation Data ExposureSpring · Spring AI | Medium4.3 |
| CVE-2026-59317 | In Spring for Apache Kafka, missing header validation in DeadLetterPublishingRecovererFactory enables denial of service via a poison-pill loopSpring · Spring for Apache Kafka | Medium6.5 |
| CVE-2026-59316 | Spring Authorization Server Default Consent Page is vulnerable to Cross-Site Scripting (XSS)Spring · Spring Authorization Server | High8.2 |
| CVE-2026-59315 | Spring Cloud Config Monitor Denial of ServiceSpring · Spring Cloud Config | Medium5.3 |
| CVE-2026-59314 | Spring Framework response splitting in ContentDispositionSpring · Spring Framework | Low3.7 |
| CVE-2026-59311 | Fixed predictable /tmp/ziptransformer work directory enables symlink pre-creationSpring · Spring Integration | Medium6.8 |
| CVE-2026-59306 | Potential for deserialization of untrusted types in Spring Cloud StreamSpring · Spring Cloud Stream | Low3.1 |
| CVE-2026-59313 | Server Sent Event stream corruption in Spring MVC functional web frameworkSpring · Spring Framework | Critical9.8 |
| CVE-2026-59307 | Deserialization allow-list silently bypassed: setBeanClassLoader replaces deserializer but mapper keeps stale referenceSpring · Spring Integration | High8.0 |
| CVE-2026-59305 | Partition interceptor may be improperly added while sending messageSpring · Spring Cloud Stream | Low3.1 |
| CVE-2026-59304 | Improper caching of the original content type in Spring Cloud Stream AvroSpring · Spring Cloud Stream | Low3.1 |
| CVE-2026-59303 | Dynamic destination cache size is not properly bound in Spring Cloud StreamSpring · Spring Cloud Stream | Low3.1 |
| CVE-2026-59302 | Potential for logging sensitive data in Spring Cloud StreamSpring · Spring Cloud Stream | Low3.1 |
| CVE-2026-59301 | Potential for logging sensitive data in Spring Cloud Function AzureSpring · Spring Cloud Function | Low3.1 |
| CVE-2026-59300 | Potential for logging sensitive data in Spring Cloud Function AWSSpring · Spring Cloud Function | Low3.1 |
| CVE-2026-59299 | Composition lookup can potentially poison base function in Spring Cloud FunctionSpring · Spring Cloud Function | Low3.1 |
| CVE-2026-59298 | Potential for improper filtering of HTTP headers in Spring Cloud FunctionSpring · Spring Cloud Function | Low3.1 |
| CVE-2026-59297 | Spring Cloud Function can incorrectly determine if URI is secureSpring · Spring Cloud Function | Low3.1 |
| CVE-2026-59294 | Arbitrary File Write via Path Traversal in ResourceCacheServiceSpring · Spring AI | Medium5.9 |
| CVE-2026-59293 | SMB minimum protocol dialect defaults to SMB1Spring · Spring Integration | Medium6.6 |
| CVE-2026-59292 | World-readable metadata file in PropertiesPersistingMetadataStore (insecure temp-file permissions)Spring · Spring Integration | Low3.2 |
| CVE-2026-59291 | Potential arbitrary file read and SSRF vulnerability in Spring Cloud FunctionSpring · Spring Cloud Function | Low2.0 |
| CVE-2026-59289 | Spring for GraphQL Denial of Service via pagination supportSpring · Spring for GraphQL | High7.5 |
| CVE-2026-59288 | Spring for GraphQL Information Exposure in GraphiQL supportSpring · Spring for GraphQL | High7.5 |
| CVE-2026-59287 | Spring for GraphQL WebSocket Client Denial of ServiceSpring · Spring for GraphQL | Medium5.9 |
| CVE-2026-59286 | Spring for GraphQL loads Untrusted Resources in GraphiQL supportSpring · Spring for GraphQL | High8.1 |
| CVE-2026-59285 | Spring for GraphQL Unsafe Deserialization in pagination supportSpring · Spring for GraphQL | High8.1 |
| CVE-2026-59284 | Spring Cloud Commons no allow list for writable env actuator endpointSpring · Spring Cloud Commons | Medium6.6 |
| CVE-2026-59283 | Spring Framework Safety Guard Bypass via SpEL Expression CompilationSpring · Spring Framework | Critical9.1 |
| CVE-2026-59282 | Spring Framework Denial of Service via Unbounded List Growth in Data BindingSpring · Spring Framework | High7.5 |
| CVE-2026-59281 | Spring Framework Cross-site Scripting via EscapedErrorsSpring · Spring Framework | Medium6.1 |
| CVE-2026-59277 | Spring Security InetAddressMatchers Incomplete Internal Network ClassificationSpring · Spring Security | Low3.7 |
| CVE-2026-59276 | Timing Attack via Non-Constant-Time Comparison of Sensitive ValuesSpring · Spring Security | Medium5.9 |
| CVE-2026-59280 | Spring Framework Path Traversal via Backslash in SpringTemplateLoaderSpring · Spring Framework | Medium4.3 |
| CVE-2026-59272 | Log4j2 AmqpAppender disables TLS hostname verification by defaultSpring · Spring AMQP | Medium6.8 |
| CVE-2026-47893 | Spring Framework Request Headers Included in Exception Reasons in HandshakeWebsocketServiceSpring · Spring Framework | High7.5 |
| CVE-2026-47892 | Spring Framework Header Predicate Bypass in WebFlux Functional EndpointsSpring · Spring Framework | Critical9.8 |
| CVE-2026-47891 | Spring Framework maxInMemorySize Bypassed in Jaxb2DecoderSpring · Spring Framework | Critical9.8 |
| CVE-2026-47890 | Spring Framework Server Sent Event stream corruption while rendering fragmentsSpring · Spring Framework | Critical9.8 |
| CVE-2026-47889 | Spring Framework sameSite Attribute Dropped in JettyCoreServerHttpResponseSpring · Spring Framework | High7.5 |
| CVE-2026-47888 | Spring Framework Memory Leak via SETUP Frame in RSocketMessageHandlerSpring · Spring Framework | High7.5 |
| CVE-2026-47887 | Spring Framework Open Redirect in UrlFileNameViewControllerSpring · Spring Framework | Medium6.1 |
| CVE-2026-47886 | Spring Framework Denial of Service via Unbounded Exponentiation in SpEL ExpressionsSpring · Spring Framework | High7.5 |
| CVE-2026-47885 | Spring Framework maxPartSize Ignored in PartEventHttpMessageReaderSpring · Spring Framework | High7.5 |
| CVE-2026-47884 | Spring Framework Improper Path Limitation in XsltViewSpring · Spring Framework | Critical9.8 |
| CVE-2026-47883 | Spring Framework Open Redirect in UrlHandlerFilterSpring · Spring Framework | Medium6.1 |