Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 6 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 405,672All CVEsplus 19,170 rejected
- 542Last 24 hours4,866 in the last 7 days
- 17,071Last 30 days1,505 of them critical
- 1,779Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 0 | 6 | 4 | 1 | 0 | 11 | 16 |
| 2025 | 0 | 3 | 2 | 0 | 0 | 5 | 5 |
| Title | ||
|---|---|---|
| CVE-2026-61812 | ModSecurity: HTML decoder missing entities, leading to evasionowasp-modsecurity · ModSecurity | Medium6.3 |
| CVE-2026-73857 | ModSecurity v3 XML Request Body Processor Uninitialized Pointer Dereference Vulnerabilityowasp-modsecurity · ModSecurity | High7.5 |
| CVE-2026-104259 | ModSecurity: removeComments Transformation Fails to Strip Adjacent Comments, Enabling WAF Rule Bypassowasp-modsecurity · ModSecurity | Medium5.4 |
| CVE-2026-104269 | ModSecurity: RFC 2231 `filename*` Parameter Bypasses Multipart Filename Rules on RFC-Compliant Backends (Go, Python, Node, Java)Public exploitowasp-modsecurity · ModSecurity | High8.6 |
| CVE-2026-73856 | ModSecurity: Response Body Inspection BypassPublic exploitowasp-modsecurity · ModSecurity | High8.6 |
| CVE-2026-61813 | ModSecurity: Incorrect libcurl TLS hostname verification setting in HttpsClient::downloadowasp-modsecurity · ModSecurity | Low3.7 |
| CVE-2026-103932 | ModSecurity: PCRE2 `@rxGlobal` match-limit errors are converted to no-matchPublic exploitowasp-modsecurity · ModSecurity | Medium5.8 |
| CVE-2026-52747 | ModSecurity: Multipart form-data parser silently strips embedded line breaks from form-field values, enabling request-body inspection bypassPublic exploitowasp-modsecurity · ModSecurity | High8.6 |
| CVE-2026-52761 | ModSecurity: Transformation utf8toUnicode produces wrong output on i386 architectureowasp-modsecurity · ModSecurity | Medium5.8 |
| CVE-2026-42268 | ModSecurity: Unsigned integer underflow in @verifySSN / @verifyCPF / @verifySVNR operatorsPublic exploitowasp-modsecurity · ModSecurity | High8.2 |
| CVE-2026-30923 | libModSecurity3 denial of service via segfault when using t:hexDecode on single-character query stringsPublic exploitowasp-modsecurity · ModSecurity | High8.2 |
| CVE-2025-54571 | ModSecurity's Insufficient Return Value Handling can Lead to XSS and Source Code DisclosurePublic exploitowasp-modsecurity · ModSecurity | Medium6.9 |
| CVE-2025-52891 | ModSecurity empty XML tag causes segmentation faultowasp-modsecurity · ModSecurity | Medium6.5 |
| CVE-2025-48866 | ModSecurity has possible DoS vulnerability in sanitiseArg actionPublic exploitowasp-modsecurity · ModSecurity | High7.5 |
| CVE-2025-47947 | ModSecurity Has Possible DoS VulnerabilityPublic exploitowasp-modsecurity · ModSecurity | High7.5 |
| CVE-2025-27110 | Libmodsecurity3 has possible bypass of encoded HTML entitiesPublic exploitowasp-modsecurity · ModSecurity | High7.9 |