Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 2 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 402,255All CVEsplus 19,142 rejected
- 298Last 24 hours3,294 in the last 7 days
- 16,892Last 30 days1,539 of them critical
- 1,769Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 6 | 25 | 13 | 6 | 0 | 50 | 61 |
| 2025 | 0 | 7 | 3 | 1 | 0 | 11 | 11 |
| Title | ||
|---|---|---|
| CVE-2026-90930 | File Browser through 2.63.23 Path Traversal via Symlink AliasPublic exploitfilebrowser · filebrowser | High7.6 |
| CVE-2026-90929 | File Browser 2.5.0 Directory Deletion via Upload Failure Cleanupfilebrowser · filebrowser | High7.2 |
| CVE-2026-90928 | File Browser through 2.63.23 Memory Exhaustion via subtitle endpointPublic exploitfilebrowser · filebrowser | High7.1 |
| CVE-2026-90927 | filebrowser through 2.63.23 Denial of Service via unbounded WebSocket messagePublic exploitfilebrowser · filebrowser | High7.1 |
| CVE-2026-82238 | filebrowser 2.24.0 Race Condition via TUS concurrent PATCH uploadsPublic exploitfilebrowser · filebrowser | Low2.3 |
| CVE-2026-82237 | filebrowser through 2.63.23 Stale Share Link via File RenamePublic exploitfilebrowser · filebrowser | Low2.3 |
| CVE-2026-82236 | File Browser 2.63.6 through 2.63.23 Share Link Exposure via File DeletionPublic exploitfilebrowser · filebrowser | Low2.3 |
| CVE-2026-82235 | filebrowser through 2.63.23 Denial of Service via named pipesfilebrowser · filebrowser | High8.2 |
| CVE-2026-62684 | File Browser: Share API exposes the password hash and bypass tokenfilebrowser · filebrowser | Low2.7 |
| CVE-2026-72838 | FileBrowser before 2.63.19 Disk Exhaustion via TUS Uploadfilebrowser · filebrowser | High7.1 |
| CVE-2026-72837 | File Browser before 2.63.20 Privilege Escalation via Proxy AuthenticationPublic exploitfilebrowser · filebrowser | High8.7 |
| CVE-2026-72836 | FileBrowser before 2.63.19 Case Sensitivity Authentication BypassPublic exploitfilebrowser · filebrowser | Critical9.2 |
| CVE-2026-72835 | filebrowser before v2.63.21 Access Rule Bypass via Path CanonicalizationPublic exploitfilebrowser · filebrowser | High7.6 |
| CVE-2026-72834 | filebrowser before 2.63.19 Permission Bypass via checksumfilebrowser · filebrowser | Medium5.3 |
| CVE-2026-72839 | filebrowser through 2.63.16 Privilege Escalation via SignupPublic exploitfilebrowser · filebrowser | Critical9.3 |
| CVE-2026-73613 | filebrowser before 2.63.19 Out-of-Scope File Deletion via Symlinkfilebrowser · filebrowser | High7.2 |
| CVE-2026-73612 | File Browser before v2.63.22 Authorization Bypass via Recursive OperationsPublic exploitfilebrowser · filebrowser | High8.6 |
| CVE-2026-73611 | File Browser 2.50.0 through 2.63.21 JWT Expiration BypassPublic exploitfilebrowser · filebrowser | High7.6 |
| CVE-2026-62685 | File Browser: Colliding username normalization gives two users the same home directoryPublic exploitfilebrowser · filebrowser | High8.1 |
| CVE-2026-62843 | File Browser: Archive builder turns backslash filenames into path traversal (zip-slip)Public exploitfilebrowser · filebrowser | Medium6.8 |
| CVE-2026-62683 | File Browser: Trailing-slash delete leaves a stale public share behindPublic exploitfilebrowser · filebrowser | Low3.1 |
| CVE-2026-61874 | filebrowser before 2.63.17 Stale Public Share via Trailing-Slash DeletePublic exploitfilebrowser · filebrowser | Low2.3 |
| CVE-2026-55668 | File Browser: ScopedFs follows a dangling symlink on write, letting a scoped user create files outside their scopePublic exploitfilebrowser · filebrowser | Medium6.3 |
| CVE-2026-54090 | File Browser: Command Allowlist Bypass via Shell Metacharacter InjectionPublic exploitfilebrowser · filebrowser | High8.7 |
| CVE-2026-54088 | File Browser: Command Injection via Authentication Hook Shell Substitution (Pre-Authentication RCE)Public exploitfilebrowser · filebrowser | Critical9.3 |
| CVE-2026-54089 | File Browser: Authentication Bypass via Proxy Auth Header ForgeryPublic exploitfilebrowser · filebrowser | Critical9.1 |
| CVE-2026-54091 | File Browser: Incorrect access control in public directory shares via rule path rebasingfilebrowser · filebrowser | High7.5 |
| CVE-2026-54092 | File Browser: DoS Vulnerability on Public Login APIPublic exploitfilebrowser · filebrowser | Medium6.5 |
| CVE-2026-54097 | File Browser: Cross-user unauthorized share-link deletion via unbounded prefix match in DeleteWithPathPrefixfilebrowser · filebrowser | High7.2 |
| CVE-2026-54093 | File Browser: Path traversal in download-as-zip/tar via Windows-style backslash separators in stored filenamesPublic exploitfilebrowser · filebrowser | Medium6.8 |
| CVE-2026-54094 | File Browser: Symlink following lets scoped users read, overwrite, and share files outside their filebrowser scopePublic exploitfilebrowser · filebrowser | High7.5 |
| CVE-2026-54096 | File Browser: Improper Access Control Occurs via Pre-Created Public Share for a Non-existent PathPublic exploitfilebrowser · filebrowser | High8.4 |
| CVE-2026-55667 | File Browser: Out-of-scope file deletion by a Create-only scoped user via symlink-following RemoveAll in upload failure-cleanupPublic exploitfilebrowser · filebrowser | High8.2 |
| CVE-2026-35607 | File Browser: Proxy auth auto-provisioned users inherit Execute permission and CommandsPublic exploitfilebrowser · filebrowser | High8.1 |
| CVE-2026-35606 | File Browser discloses text file content via /api/resources endpoint bypassing Perm.Download checkPublic exploitfilebrowser · filebrowser | Medium5.3 |
| CVE-2026-35605 | File Browser has an access rule bypass via HasPrefix without trailing separator in path matchingPublic exploitfilebrowser · filebrowser | Medium6.3 |
| CVE-2026-35604 | File Browser share links remain accessible after Share/Download permissions are revokedPublic exploitfilebrowser · filebrowser | High8.2 |
| CVE-2026-35585 | File Browser has a Command Injection via Hook RunnerPublic exploitfilebrowser · filebrowser | High7.5 |
| CVE-2026-34530 | File Browser is vulnerable to Stored Cross-Site Scripting via text/template branding injectionPublic exploitfilebrowser · filebrowser | Medium6.9 |
| CVE-2026-34528 | File Browser's Signup Grants Execution Permissions When Default Permissions Includes ExecutionPublic exploitfilebrowser · filebrowser | High8.1 |
| CVE-2026-34529 | File Browser is vulnerable to Stored Cross-site Scripting via crafted EPUB filePublic exploitfilebrowser · filebrowser | High7.6 |
| CVE-2026-32761 | File Browser has an Authorization Policy Bypass in its Public Share Download FlowPublic exploitfilebrowser · filebrowser | Medium6.5 |
| CVE-2026-32760 | File Browser Self Registration Grants Any User Admin Access When Default Permissions Include AdminPublic exploitfilebrowser · filebrowser | Critical10.0 |
| CVE-2026-32759 | File Browser TUS Negative Upload-Length Fires Post-Upload Hooks Prematurelyfilebrowser · filebrowser | Medium5.3 |
| CVE-2026-32758 | File Browser has an Access Rule Bypass via Path Traversal in Copy/Rename Destination ParameterPublic exploitfilebrowser · filebrowser | Medium6.5 |
| CVE-2026-28492 | File Browser: Path Traversal in Public Share Links Exposes Files Outside Shared DirectoryPublic exploitfilebrowser · filebrowser | High7.1 |
| CVE-2026-29188 | File Browser: TUS Delete Endpoint Bypasses Delete Permission CheckPublic exploitfilebrowser · filebrowser | Critical9.1 |
| CVE-2026-25890 | File Browser has a Path-Based Access Control Bypass via Multiple Leading Slashes in URLfilebrowser · filebrowser | High8.1 |
| CVE-2026-25889 | File Browser has an Authentication Bypass in User Password Updatefilebrowser · filebrowser | Medium5.4 |
| CVE-2026-23849 | File Browser vulnerable to Username Enumeration via Timing Attack in /api/loginfilebrowser · filebrowser | Medium5.3 |