Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 2 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 406,571All CVEsplus 19,172 rejected
- 275Last 24 hours4,783 in the last 7 days
- 16,684Last 30 days1,461 of them critical
- 1,781Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 0 | 8 | 8 | 1 | 0 | 17 | 17 |
| Title | ||
|---|---|---|
| CVE-2026-55458 | Caddy: RFC 7230 §6.1 compliance issue / Hop-by-hop headers that leak throughPublic exploitcaddyserver · caddy | Low2.9 |
| CVE-2026-92700 | Caddy: fileHidden() case-sensitive pattern bypass — exposes "hidden" files via case variationPublic exploitcaddyserver · caddy | Medium6.3 |
| CVE-2026-92284 | Caddy: Unbounded body buffer via {http.request.body} placeholder — memory exhaustion DoSPublic exploitcaddyserver · caddy | Medium6.9 |
| CVE-2026-77281 | Caddy: rewrite placeholder re-expansioncaddyserver · caddy | Medium6.5 |
| CVE-2026-45135 | Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP FilesPublic exploitcaddyserver · caddy | High8.1 |
| CVE-2026-45692 | Caddy: Remote Admin Authorization Bypass in `/config` API via Array Index NormalizationPublic exploitcaddyserver · caddy | Medium5.4 |
| CVE-2026-52845 | Caddy: FastCGI header normalization bypass in `forward_auth copy_headers`Public exploitcaddyserver · caddy | High8.1 |
| CVE-2026-52844 | Caddy: Windows `file_server` path authorization bypass via encoded backslashPublic exploitcaddyserver · caddy | High7.5 |
| CVE-2026-52846 | Caddy: stripHTML template function bypassPublic exploitcaddyserver · caddy | Medium4.2 |
| CVE-2026-30851 | Caddy forward_auth copy_headers Does Not Strip Client-Supplied Headers, Allowing Identity Injection and Privilege EscalationPublic exploitcaddyserver · caddy | High8.1 |
| CVE-2026-30852 | Caddy: vars_regexp double-expands user input, leaking env vars and filesPublic exploitcaddyserver · caddy | Medium5.5 |
| CVE-2026-27590 | Caddy: Unicode case-folding length expansion causes incorrect split_path index (SCRIPT_NAME/PATH_INFO confusion) in FastCGI transportPublic exploitcaddyserver · caddy | High8.9 |
| CVE-2026-27589 | Caddy vulnerable to cross-origin config application via local admin API /load (caddy)Public exploitcaddyserver · caddy | Medium6.9 |
| CVE-2026-27588 | Caddy: MatchHost becomes case-sensitive for large host lists (>100), enabling host-based route/auth bypassPublic exploitcaddyserver · caddy | High7.7 |
| CVE-2026-27587 | Caddy: MatchPath %xx (escaped-path) branch skips case normalization, enabling path-based route/auth bypassPublic exploitcaddyserver · caddy | High7.7 |
| CVE-2026-27586 | Caddy's mTLS client authentication silently fails open when CA certificate file is missing or malformedPublic exploitcaddyserver · caddy | High8.8 |
| CVE-2026-27585 | Caddy's improper sanitization of glob characters in file matcher may lead to bypassing security protectionsPublic exploitcaddyserver · caddy | Medium6.9 |