Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 9 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 402,567All CVEsplus 19,144 rejected
- 443Last 24 hours3,275 in the last 7 days
- 16,951Last 30 days1,511 of them critical
- 1,769Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 1 | 7 | 20 | 3 | 0 | 31 | 43 |
| 2025 | 0 | 1 | 2 | 1 | 0 | 4 | 12 |
| 2024 | 0 | 3 | 1 | 0 | 0 | 4 | 8 |
| 2023 | 0 | 1 | 1 | 0 | 0 | 2 | 4 |
| 2022 | 0 | 0 | 2 | 0 | 0 | 2 | 2 |
| Title | ||
|---|---|---|
| CVE-2026-123808 | Nuxt UI: UAuthForm / UForm SSR markup omits `method`, leaking credentials via GET if submitted before hydrationnuxt · ui | Medium5.3 |
| CVE-2026-102650 | Nuxt Content: Unauthenticated SQLite Function DoS via Content Query APInuxt · content | High7.5 |
| CVE-2026-120309 | Nuxt 4.6.0 before 4.6.2 Route Param Confusion via getRouterParamnuxt · nuxt | Medium6.3 |
| CVE-2026-119201 | Nuxt dev server exposes generated appSecret through Vite file servingnuxt · nuxt | Medium4.8 |
| CVE-2026-119200 | Nuxt: Dot segments in the request path bypass `server/middleware` path checks and server route rules on page routesnuxt · nuxt | Medium6.5 |
| CVE-2026-119199 | Nuxt dev server exposes private runtime config through the Nitro dev bundlenuxt · nuxt | Medium5.9 |
| CVE-2026-119198 | Nuxt dev server arbitrary file read through client error reportsnuxt · nuxt | Medium5.9 |
| CVE-2026-114133 | Nuxt server islands render `useHeadSafe` input without sanitisationnuxt · nuxt | Medium5.4 |
| CVE-2026-114132 | Nuxt: Server-side route rules (`redirect`, `headers`, `proxy`, `ssr`) are skipped for case-variant paths when routing is case-insensitivenuxt · nuxt | Medium6.3 |
| CVE-2026-114131 | Nuxt: Route rules are matched against the raw request path, so a percent-encoded segment can bypass `appMiddleware` on dynamic and catch-all routesnuxt · nuxt | Medium6.5 |
| CVE-2026-114130 | Nuxt: Incomplete fix for GHSA-934w-87qh-qr26: a `javascript:` URL prefixed with an ASCII control character executes from `<NuxtLink>` when `pages` is disablednuxt · nuxt | Low2.3 |
| CVE-2026-72744 | Nuxt before 4.5.1 Information Disclosure via Chrome DevToolsnuxt · nuxt | Medium6.9 |
| CVE-2026-71321 | Nuxt: Unauthenticated CPU exhaustion parsing and hashing the Nuxt island endpoint body before hash validationnuxt · nuxt | High7.5 |
| CVE-2026-71320 | Nuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island Propsnuxt · nuxt | High8.1 |
| CVE-2026-71319 | Nuxt.js Unauthenticated WebSocket RPC Call Leading to Remote Code Executionnuxt · devtools | Critical9.6 |
| CVE-2026-71318 | Nuxt: Unauthorized Component Instantiation via Server Island Propsnuxt · nuxt | Medium4.8 |
| CVE-2026-71316 | Nuxt runtime payload cache discloses another user's SSR data across users and to unauthenticated clientsnuxt · nuxt | High7.5 |
| CVE-2026-71315 | Nuxt route rules silently dropped for mixed-case paths, bypassing appMiddleware auth gates (incomplete fix for CVE-2026-53721)nuxt · nuxt | High8.2 |
| CVE-2026-71314 | Nuxt: Unauthenticated out-of-memory crash via unbounded v-for expansion in island renderingnuxt · nuxt | High7.5 |
| CVE-2026-56301 | Nuxt - Arbitrary File Read via World-Connectable vite-node IPC Socket on LinuxNuxt · Nuxt | Medium6.8 |
| CVE-2026-56698 | Nuxt - Cross-Site Scripting via navigateTo open OptionNuxt · Nuxt | Medium5.3 |
| CVE-2026-56697 | Nuxt - Open Redirect via Protocol-Relative Paths in reloadNuxtAppNuxt · Nuxt | Medium5.3 |
| CVE-2026-56326 | Nuxt - Server-Side Open Redirect via Path-Normalization Bypass in navigateToNuxt · Nuxt | Medium5.3 |
| CVE-2026-56317 | Nuxt - Cross-Site Scripting via NoScript Component Slot ContentNuxt · Nuxt | Low2.3 |
| CVE-2026-53722 | Nuxt: Reflected XSS in `<NuxtLink>` via unsanitised `javascript:` or `data:` URLnuxt · nuxt | Medium5.1 |
| CVE-2026-53721 | Nuxt: Route-rule middleware bypass via case-sensitivity mismatch between vue-router and the routeRules matchernuxt · nuxt | High8.8 |
| CVE-2026-47200 | Nuxt: Route middleware not enforced when rendering `.server.vue` pages via `/__nuxt_island/page_*`Public exploitnuxt · nuxt | Medium6.3 |
| CVE-2026-49993 | @nuxt/webpack-builder and @nuxt/rspack-builder dev server same-origin check bypassed when Sec-Fetch-Site, Origin, and Referer are all absent (incomplete fix for GHSA-6m52-m754-pw2g)Public exploitnuxt · nuxt | Medium5.9 |
| CVE-2026-45669 | Nuxt: Reflected XSS in `navigateTo()` external redirectPublic exploitnuxt · nuxt | Medium5.3 |
| CVE-2026-45670 | Nuxt: Dev server exposes built source over LAN to malicious sites (incomplete fix for GHSA-4gf7-ff8x-hq99)Public exploitnuxt · nuxt | Medium5.9 |
| CVE-2026-46342 | Nuxt: `__nuxt_island` endpoint does not bind responses to request props, enabling shared-cache poisoningnuxt · nuxt | Low2.3 |
| CVE-2025-59414 | Nuxt Client-Side Path Traversal in Nuxt Island Payload Revivalnuxt · nuxt | Low3.1 |
| CVE-2025-27415 | Nuxt allows DOS via cache poisoning with payload rendering responsenuxt · nuxt | High7.5 |
| CVE-2025-24361 | Opening a malicious website while running a Nuxt dev server could allow read-only access to codePublic exploitnuxt · nuxt | Medium5.3 |
| CVE-2025-24360 | Opening a malicious website while running a Nuxt dev server could allow read-only access to codePublic exploitnuxt · nuxt | Medium5.3 |
| CVE-2024-42352 | Server-Side Request Forgery (SSRF) in nuxt-iconPublic exploitnuxt · icon | High8.6 |
| CVE-2024-34344 | Remote code execution via the browser when running the test locally in nuxtPublic exploitnuxt · nuxt | High8.8 |
| CVE-2024-34343 | Cross-site Scripting (XSS) in navigateTo if used after SSR in nuxtPublic exploitnuxt · nuxt | Medium6.3 |
| CVE-2024-23657 | Path Traversal: '../filedir' in Nuxt Devtoolsnuxt · nuxt | High8.8 |
| CVE-2023-3224 | Code Injection in nuxt/nuxtPublic exploitnuxt · nuxt/nuxt | High8.1 |
| CVE-2023-0878 | Cross-site Scripting (XSS) - Generic in nuxt/frameworkPublic exploitnuxt · nuxt/framework | Medium6.1 |
| CVE-2022-4414 | Cross-site Scripting (XSS) - DOM in nuxt/frameworkPublic exploitnuxt · nuxt/framework | Medium6.1 |
| CVE-2022-4413 | Cross-site Scripting (XSS) - Reflected in nuxt/frameworkPublic exploitnuxt · nuxt/framework | Medium6.1 |