Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 4 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 404,688All CVEsplus 19,156 rejected
- 2,104Last 24 hours4,704 in the last 7 days
- 18,845Last 30 days1,617 of them critical
- 1,773Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 1 | 2 | 0 | 0 | 0 | 3 | 16 |
| 2025 | 3 | 0 | 5 | 1 | 0 | 9 | 13 |
| 2024 | 0 | 2 | 2 | 0 | 0 | 4 | 4 |
| Title | ||
|---|---|---|
| CVE-2026-42566 | Meshtastic: Malformed UTF-8 in User.long_name broadcast over LoRa causes mesh-wide client decode failuremeshtastic · firmware | High7.5 |
| CVE-2026-44359 | Meshtastic GitHub repo vulnerable to Arbitrary Code Execution via pull_request_target Fork Checkout in CI Workflowmeshtastic · firmware | Critical10.0 |
| CVE-2025-55292 | In Meshtastic, an attacker can spoof licensed amateur flag for a nodePublic exploitmeshtastic · firmware | High8.2 |
| CVE-2025-53627 | Meshtastic firmware allows forged DMs with no PKC to show up as encryptedPublic exploitmeshtastic · firmware | Medium5.3 |
| CVE-2025-55293 | Meshtastic allows crafting of specific NodeInfo packets that overwrite any publicKey saved in the NodeDBPublic exploitmeshtastic · firmware | Critical9.4 |
| CVE-2024-47065 | Traceroute_APP responses are not rate-limited.Public exploitmeshtastic · firmware | Low2.7 |
| CVE-2025-53637 | Meshtastic allows Command Injection in GitHub ActionPublic exploitmeshtastic · firmware | Medium4.1 |
| CVE-2025-24798 | Meshtastic crashes via an unimplemented routing module replyPublic exploitmeshtastic · firmware | Medium4.3 |
| CVE-2025-52883 | Meshtastic-Android vulnerable to forged DMs with no PKC showing up as encryptedPublic exploitmeshtastic · Meshtastic-Android | Medium5.3 |
| CVE-2025-52464 | Meshtastic Repeated Public and Private Keypairsmeshtastic · firmware | Critical9.5 |
| CVE-2025-24797 | Meshtastic incorrectly hands malformed packets leads to controlled buffer overflowmeshtastic · firmware | Critical9.4 |
| CVE-2025-21608 | Forged packets over MQTT can show up in direct messages in Meshtastic firmwaremeshtastic · firmware | Medium5.3 |
| CVE-2024-51500 | Failure to check for packets from the broadcast address allows potential DDoS amplification attack in Meshtastic firmwarePublic exploitmeshtastic · firmware | Medium5.3 |
| CVE-2024-47079 | Unauthorized usage of remote hardware module because of missing channel verificationmeshtastic · firmware | Medium6.4 |
| CVE-2024-47078 | Meshtastic firmware Authentication/Authorization Bypass via MQTTmeshtastic · firmware | High8.1 |
| CVE-2024-45038 | Device crash via malformed MQTT packet when downlink is enabled in Meshtastic device firmwaremeshtastic · firmware | High7.5 |