Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 1 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 403,148All CVEsplus 19,156 rejected
- 778Last 24 hours3,527 in the last 7 days
- 17,312Last 30 days1,549 of them critical
- 1,773Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 1 | 49 | 31 | 2 | 0 | 83 | 103 |
| 2025 | 0 | 2 | 5 | 1 | 0 | 8 | 20 |
| 2024 | 0 | 1 | 3 | 0 | 0 | 4 | 12 |
| 2023 | 0 | 0 | 1 | 0 | 0 | 1 | 8 |
| 2022 | 0 | 0 | 3 | 0 | 0 | 3 | 7 |
| 2021 | 0 | 0 | 4 | 0 | 0 | 4 | 4 |
| Title | ||
|---|---|---|
| CVE-2026-116542 | Netty netty-tcnative before 2.0.84.Final SNI Hostname Spoofing via Modified UTF-8 DecodingPublic exploitnetty · netty-tcnative | Medium6.9 |
| CVE-2026-116541 | netty-tcnative before 2.0.84.Final Denial of Service via BIO Write Overcountnetty · netty-tcnative | High8.2 |
| CVE-2026-116540 | netty-tcnative 2.0.66.Final before 2.0.84.Final Use-After-Free in Session Ticket Callbacknetty · netty-tcnative | High8.2 |
| CVE-2026-116539 | Netty netty-tcnative before 2.0.84.Final Heap Buffer Overflow via OpenSSL BIOPublic exploitnetty · netty-tcnative | High8.2 |
| CVE-2026-100666 | Netty 4.2.0 through 4.2.16 Response Desynchronization via HttpServerCodecPublic exploitnetty · netty | Medium6.9 |
| CVE-2026-100665 | Netty 4.2.11 through 4.2.17 QUIC Hostname Verification BypassPublic exploitnetty · netty | High8.7 |
| CVE-2026-100664 | Netty 4.2.2 through 4.2.17 HTTP/1 Host Header Authority Confusionnetty · netty | High8.7 |
| CVE-2026-100663 | Netty HTTP/1 CONNECT authority-form mistranslated to malformed HTTP/3Public exploitnetty · netty | High8.7 |
| CVE-2026-100662 | Netty HTTP/3 QPACK encoder-stream unbounded memory exhaustion DoSPublic exploitnetty · netty | High8.7 |
| CVE-2026-100661 | Netty HTTP/3 QPACK Prefixed Integer DoS via Unbounded Accumulationnetty · netty | High8.7 |
| CVE-2026-100660 | Netty before 4.2.18.Final QpackEncoder Unbounded Memory RetentionPublic exploitnetty · netty | High8.7 |
| CVE-2026-100659 | Netty 4.2.0 through 4.2.17 HTTP/3 Request Routing Bypassnetty · netty | Medium6.9 |
| CVE-2026-54251 | netty-incubator-codec-ohttp: [OHttpServerCodec] Native Direct-Memory Leak on AEAD Decryption Failure Leads to Gateway Denial of Servicenetty · netty-incubator-codec-ohttp | High8.7 |
| CVE-2026-89044 | Netty 4.1.133.Final through 4.1.137.Final and 4.2.13.Final through 4.2.17.Final HTTP Request Smuggling via Transfer-Encodingnetty · netty | Medium6.9 |
| CVE-2026-76816 | Netty: MQTT Topic Name and Client ID Validation Bypassnetty · netty | Low3.5 |
| CVE-2026-62380 | Netty before 4.2.16.Final SOCKS Proxy Null Byte Injectionnetty · netty | Medium6.3 |
| CVE-2026-62243 | Netty 4.2.0 through 4.2.16 TLS Hostname Verification Bypassnetty · netty | High8.7 |
| CVE-2026-75595 | Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContextnetty · netty | Critical9.1 |
| CVE-2026-75596 | Netty: Fragmented ClientHello records trigger quadratic pre-handshake reassembly in default SNI parsingnetty · netty | High8.7 |
| CVE-2026-59903 | Netty: Cache Poisoning and Information Disclosure via CORS Vary Header Overwritenetty · netty | Medium6.5 |
| CVE-2026-59902 | Netty: Memory Exhaustion in SctpMessageCompletionHandlernetty · netty | High7.5 |
| CVE-2026-73508 | Netty: Memory Leak in DNS Record Decoder via Malformed Domain Namesnetty · netty | Medium5.3 |
| CVE-2026-73507 | Netty: Denial of Service in XmlFrameDecoder via CPU Exhaustionnetty · netty | High7.5 |
| CVE-2026-56818 | Netty: RedisArrayAggregator max-elements failure leaves retained partial aggregate statePublic exploitnetty · netty | Medium6.5 |
| CVE-2026-59898 | Netty: WebSockets V07/V08 handshaker missing Connection/Upgrade validationnetty · netty | Medium6.3 |
| CVE-2026-59899 | Netty HttpContentEncoder: Unbounded Per-Connection Queue Growth via HTTP/1.1 Pipelining Leads to Denial of Servicenetty · netty | Medium6.9 |
| CVE-2026-59900 | Netty codec-http2: Lack of Host Header Deduplication in HTTP/2→HTTP/1.x Translation Leads to Request Routing Bypassnetty · netty | Medium6.9 |
| CVE-2026-59901 | Netty Bzip2Decoder: Infinite Loop in RLE State Machine Leads to Event-Loop Thread Hangnetty · netty | High8.7 |
| CVE-2026-59919 | Netty: HAProxy V1 Protocol CRLF Injection via AF_UNIX AddressPublic exploitnetty · netty | Medium5.5 |
| CVE-2026-59920 | Netty: STOMP CONNECT Frame Header InjectionPublic exploitnetty · netty | Medium6.5 |
| CVE-2026-56822 | Netty: TOCTOU in OcspServerCertificateValidatorPublic exploitnetty · netty | High7.4 |
| CVE-2026-56821 | Netty: Out-of-date OCSP Responses Accepted by OcspServerCertificateValidatorPublic exploitnetty · netty | High7.4 |
| CVE-2026-59921 | Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoderPublic exploitnetty · netty | Medium5.7 |
| CVE-2026-56820 | Netty: Missing CertificateID Validation in OCSP Response Allows Replay AttacksPublic exploitnetty · netty | High7.4 |
| CVE-2026-56819 | Netty: HTTP/2 decompression leaks ByteBuf reference count when the decompressor channel is already closed (Direct memory leak / OOM DoS)Public exploitnetty · netty | High7.5 |
| CVE-2026-56817 | Netty: XML External Entity (XXE) injection via unconfigured XML factory when DTD and entity processing are enablednetty · netty | High8.3 |
| CVE-2026-56816 | Netty: Memory Exhaustion via HTTP/3 Reserved Frame Typesnetty · netty | High7.5 |
| CVE-2026-56746 | Netty has a Security Control Bypass via CORS Short-Circuit Failurenetty · netty | Medium6.5 |
| CVE-2026-56745 | Netty SpdyHttpDecoder: ByteBuf Reference Leak on RST_STREAM Leads to Native Memory Exhaustionnetty · netty | High8.7 |
| CVE-2026-55851 | Netty codec-haproxy: Signed-Byte Sentinel Collision in HAProxyMessageDecoder Leads to Unbounded Memory Exhaustionnetty · netty | High8.7 |
| CVE-2026-55833 | Netty SPDY zlib header block continues decoded expansion after maxHeaderSize truncationnetty · netty | High7.5 |
| CVE-2026-55831 | Netty SPDY SETTINGS frame count materializes unbounded settings mapPublic exploitnetty · netty | High7.5 |
| CVE-2026-44891 | Netty: Denial of Service via Unbounded Headers in StompSubframeDecoderPublic exploitnetty · netty | High7.5 |
| CVE-2026-50560 | Netty susceptible to HTTP/2 Reset Attack with different on-the-wire signaturenetty · netty | Medium6.9 |
| CVE-2026-50020 | Netty's HttpObjectDecoder skips arbitrary initial control characters when only initial CRLF characters are permittedPublic exploitnetty · netty | Medium5.3 |
| CVE-2026-50011 | Netty has unbounded pre-allocation in RedisArrayAggregator from RESP array lengthnetty · netty | High7.5 |
| CVE-2026-50010 | Netty's wrapping plain trust manager silently disables hostname verificationnetty · netty | High7.5 |
| CVE-2026-50009 | Netty QUIC stateless reset token material exposed through header-visible connection IDsnetty · netty | Medium4.8 |
| CVE-2026-48748 | Netty HTTP/3 QPACK Blocked Streams Memory Exhaustionnetty · netty | High7.5 |
| CVE-2026-48059 | Netty HAProxy: Unbalanced Reference Count in Nested PP2_TYPE_SSL TLV Parsing Leads to Memory Exhaustionnetty · netty | High8.7 |