Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 1 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 402,282All CVEsplus 19,142 rejected
- 324Last 24 hours3,318 in the last 7 days
- 16,919Last 30 days1,540 of them critical
- 1,769Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 3 | 10 | 5 | 2 | 0 | 20 | 20 |
| Title | ||
|---|---|---|
| CVE-2026-124436 | OpenRemote before 1.32.2 Improper Authorization Allows Realm Admins to Modify Global Resourcesopenremote · core | High8.6 |
| CVE-2026-124435 | OpenRemote before 1.32.2 Stored XSS via Manager Configuration Image Uploadopenremote · core | Medium4.6 |
| CVE-2026-63224 | OpenRemote has authenticated SQL injection in crosstab datapoint exportsPublic exploitopenremote · openremote | High7.2 |
| CVE-2026-116186 | OpenRemote before 1.31.0 Gateway Authorization Bypass via Reversible mapAssetIdPublic exploitopenremote · core | Low2.3 |
| CVE-2026-116185 | OpenRemote before 1.31.0 Cross-Realm Information Disclosure via getGatewayActiveTunnelInfosPublic exploitopenremote · core | Medium5.3 |
| CVE-2026-116184 | OpenRemote before 1.31.0 Cross-Realm Gateway Impersonation via Websocketopenremote · core | Low2.1 |
| CVE-2026-114661 | OpenRemote 1.2.0 before 1.31.0 Missing Authorization in Gateway Tunnel EndpointsPublic exploitopenremote · openremote | Critical9.0 |
| CVE-2026-54641 | OpenRemote: Cross-Realm User Information Disclosure in UserResourceImplPublic exploitopenremote · openremote | High7.7 |
| CVE-2026-54640 | OpenRemote: XXE in KNXProtocol.startAssetImport() allows arbitrary file read via unprotected XMLInputFactoryopenremote · openremote | High7.6 |
| CVE-2026-49439 | OpenRemote read-only asset users can write predicted datapointsopenremote · openremote | Medium4.3 |
| CVE-2026-81679 | OpenRemote before 1.28.0 Cross-Realm Information Disclosure via Notification APIopenremote · openremote | High8.3 |
| CVE-2026-73616 | OpenRemote Notification Delete Cross-Realm Insecure Direct Object ReferencePublic exploitopenremote · openremote | High7.1 |
| CVE-2026-67310 | openremote before 1.27.0 Cross-Tenant IDOR via setAssetLinksopenremote · openremote | Medium5.3 |
| CVE-2026-66013 | OpenRemote before 1.26.2 Authentication Bypass via Console RegistrationPublic exploitopenremote · openremote | Critical9.3 |
| CVE-2026-65009 | OpenRemote before 1.26.2 Information Disclosure via Syslog REST APIPublic exploitopenremote · openremote | Medium5.3 |
| CVE-2026-62238 | OpenRemote < 1.26.0 SQL Injection via Crosstab ExportPublic exploitopenremote · openremote | High7.2 |
| CVE-2026-56784 | OpenRemote < 1.25.0 IDOR via Bulk Alarm Deletion EndpointPublic exploitopenremote · openremote | High8.6 |
| CVE-2026-40882 | OpenRemote has XXE in Velbus Asset ImportPublic exploitopenremote · openremote | High7.6 |
| CVE-2026-41166 | OpenRemote has Improper Access Control via updateUserRealmRoles functionPublic exploitopenremote · openremote | High7.0 |
| CVE-2026-39842 | OpenRemote is Vulnerable to Expression InjectionPublic exploitopenremote · openremote | Critical10.0 |