Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 6 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 406,545All CVEsplus 19,172 rejected
- 357Last 24 hours4,846 in the last 7 days
- 16,724Last 30 days1,464 of them critical
- 1,781Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 2 | 8 | 3 | 1 | 0 | 14 | 28 |
| 2025 | 1 | 0 | 0 | 0 | 0 | 1 | 14 |
| 2024 | 1 | 1 | 3 | 0 | 0 | 5 | 13 |
| 2023 | 2 | 1 | 0 | 0 | 0 | 3 | 8 |
| 2022 | 0 | 0 | 0 | 0 | 0 | 0 | 5 |
| 2021 | 0 | 1 | 3 | 0 | 0 | 4 | 5 |
| 2020 | 0 | 0 | 0 | 0 | 0 | 0 | 1 |
| 2019 | 0 | 1 | 0 | 0 | 0 | 1 | 1 |
| Title | ||
|---|---|---|
| CVE-2026-86177 | Pterodactyl Panel before 1.14.1 Privilege Escalation via Schedule TasksPublic exploitpterodactyl · panel | High8.7 |
| CVE-2026-61617 | Pterodactyl Wings SFTP write path does not enforce disk quota, allowing node-wide disk exhaustionPublic exploitpterodactyl · wings | High7.7 |
| CVE-2026-52856 | Wings: Maliciously crafted packet during SFTP connection handshake causes denial of servicepterodactyl · wings | High7.5 |
| CVE-2026-52855 | Wings exposes node configuration secrets through egg configuration-file templatingpterodactyl · wings | Critical9.9 |
| CVE-2026-52857 | Wings: Maliciously or erroneously created parsed config files can cause wings process to OOMpterodactyl · wings | Medium5.5 |
| CVE-2026-61609 | Pterodactyl's shared global rate-limit key on login and 2FA checkpoint enables unauthenticated panel-wide authentication lockout (DoS)Public exploitpterodactyl · panel | High7.5 |
| CVE-2026-54593 | Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissionsPublic exploitpterodactyl · panel | High8.1 |
| CVE-2026-35202 | Pterodactyl has a database resource limit bypass via race condition in Client APIpterodactyl · panel | Low2.3 |
| CVE-2026-26016 | Pterodactyl Panel Allows Cross-Node Server Configuration Disclosure via Remote API Missing Authorizationpterodactyl · panel | Critical9.2 |
| CVE-2026-21696 | Endless reprocessing/reupload of activity log data due to SQLite max parameters limit not being consideredPublic exploitpterodactyl · wings | High8.3 |
| CVE-2025-69199 | Pterodactyl Wings's websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks under certain circumstancespterodactyl · panel | High8.3 |
| CVE-2025-69198 | Pterodactyl's improper resource locking allows raced queries to create more resources than allotedpterodactyl · panel | Medium6.0 |
| CVE-2025-69197 | Pterodactyl TOTPs can be reused during validity windowpterodactyl · panel | Medium6.5 |
| CVE-2025-68954 | Pterodactyl does not revoke SFTP access when server is deleted or permissions reducedpterodactyl · panel | High7.5 |
| CVE-2025-49132 | Pterodactyl Panel Allows Unauthenticated Arbitrary Remote Code ExecutionPublic exploitpterodactyl · panel | Critical10.0 |
| CVE-2024-49762 | Pterodactyl Panel has plain-text logging of user passwords when two-factor authentication is disabledpterodactyl · panel | Medium4.6 |
| CVE-2024-34066 | Arbitrary File Write/Read in Pterodactyl wingspterodactyl · wings | High8.5 |
| CVE-2024-34067 | Multiple cross site scripting (XSS) vulnerabilities in the admin area of Pterodactyl panelpterodactyl · panel | Medium6.1 |
| CVE-2024-34068 | Server-side Request Forgery during remote file pull in Pterodactyl wingspterodactyl · wings | Medium6.4 |
| CVE-2024-27102 | Improper isolation of server file access in github.com/pterodactyl/wingsPublic exploitpterodactyl · wings | Critical10.0 |
| CVE-2023-32080 | Wings vulnerable to escape to host from installation containerpterodactyl · wings | Critical9.1 |
| CVE-2023-25168 | Symbolic Link (Symlink) Following allowing the deletion of files and directories on the host system in wingspterodactyl · wings | Critical9.6 |
| CVE-2023-25152 | Symbolic Link (Symlink) Following in github.com/pterodactyl/wingspterodactyl · wings | High8.4 |
| CVE-2021-41273 | Cross-Site Request Forgery allowing sending of test emails and generation of node auto-deployment keyspterodactyl · panel | Medium4.3 |
| CVE-2021-41176 | logout CSRF in Pterodactyl Panelpterodactyl · panel | Medium4.3 |
| CVE-2021-41129 | Authentication bypass in Pterodactylpterodactyl · panel | High8.1 |
| CVE-2021-32699 | Asymmetric Resource Consumption (Amplification) in Docker containers created by Wingspterodactyl · wings | Medium6.5 |
| CVE-2019-1020002 | Pterodactyl before 0.7.14 with 2FA allows credential sniffing.Pterodactyl · Pterodactyl Panel | High7.5 |