Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 5 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 406,568All CVEsplus 19,172 rejected
- 377Last 24 hours4,810 in the last 7 days
- 16,733Last 30 days1,466 of them critical
- 1,781Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 0 | 0 | 8 | 1 | 0 | 9 | 27 |
| 2025 | 0 | 0 | 6 | 0 | 0 | 6 | 18 |
| 2024 | 0 | 2 | 1 | 0 | 0 | 3 | 12 |
| 2023 | 0 | 0 | 4 | 0 | 0 | 4 | 9 |
| 2022 | 0 | 1 | 4 | 0 | 0 | 5 | 5 |
| Title | ||
|---|---|---|
| CVE-2026-61709 | OpenFGA: ListUsers returns a deliberately-excluded user (authorization-decision over-inclusion) when a `but not` exclusion under a type-bound wildcard is intersected (`and`) with another relation that also grants that useropenfga · openfga | Medium5.3 |
| CVE-2026-55689 | OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unsetopenfga · openfga | Medium6.8 |
| CVE-2026-55170 | OpenFGA MySQL backend: case-insensitive collation on identifier columns causes incorrect authorization decisionsopenfga · openfga | Low2.1 |
| CVE-2026-48096 | OpenFGA: Cache-key delimiter injection in openfga/openfga shared-iterator and v2 iterator caches enables intra-store authorization-decision poisoningopenfga · openfga | Medium5.0 |
| CVE-2026-41131 | OpenFGA has Improper Policy Enforcementopenfga · openfga | Medium5.0 |
| CVE-2026-40293 | OpenFGA Playground Preshared Key Exposureopenfga · openfga | Medium6.5 |
| CVE-2026-34972 | OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collisionopenfga · openfga | Medium5.0 |
| CVE-2026-33729 | OpenFGA has an Authorization Bypass through cached keysopenfga · openfga | Medium5.8 |
| CVE-2026-24851 | OpenFGA Improper Policy Enforcementopenfga · openfga | Medium5.8 |
| CVE-2025-64751 | OpenFGA Improper Policy Enforcementopenfga · openfga | Medium5.8 |
| CVE-2025-55213 | OpenFGA Authorization Bypass (Check)openfga · openfga | Medium5.8 |
| CVE-2025-48371 | OpenFGA Authorization Bypassopenfga · openfga | Medium5.8 |
| CVE-2025-46331 | OpenFGA Authorization Bypassopenfga · openfga | Medium5.8 |
| CVE-2025-25196 | OpenFGA Authorization Bypassopenfga · openfga | Medium5.8 |
| CVE-2024-56323 | OpenFGA Authorization Bypassopenfga · openfga | Medium5.8 |
| CVE-2024-42473 | OpenFGA Authorization Bypassopenfga · openfga | High7.5 |
| CVE-2024-31452 | OpenFGA Authorization Bypassopenfga · openfga | High8.1 |
| CVE-2024-23820 | OpenFGA DoSopenfga · openfga | Medium5.3 |
| CVE-2023-45810 | OpenFGA denial of serviceopenfga · openfga | Medium5.3 |
| CVE-2023-43645 | Denial of service from circular relationship definitions in OpenFGAopenfga · openfga | Medium5.9 |
| CVE-2023-40579 | OpenFGA Authorization Bypassopenfga · openfga | Medium6.5 |
| CVE-2023-35933 | OpenFGA denial of service die to circular relationshipPublic exploitopenfga · openfga | Medium5.9 |
| CVE-2022-23542 | OpenFGA Authorization Bypassopenfga · openfga | High7.7 |
| CVE-2022-39352 | OpenFGA Authorization Bypassopenfga · openfga | Medium4.8 |
| CVE-2022-39342 | OpenFGA Authorization Bypassopenfga · openfga | Medium5.9 |
| CVE-2022-39341 | OpenFGA Authorization Bypassopenfga · openfga | Medium5.9 |
| CVE-2022-39340 | OpenFGA Information Disclosureopenfga · openfga | Medium5.3 |