Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 3 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 402,159All CVEsplus 19,142 rejected
- 204Last 24 hours3,228 in the last 7 days
- 16,874Last 30 days1,558 of them critical
- 1,769Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 0 | 1 | 1 | 1 | 0 | 3 | 12 |
| 2025 | 0 | 0 | 0 | 1 | 0 | 1 | 9 |
| 2024 | 0 | 2 | 6 | 0 | 0 | 8 | 8 |
| Title | ||
|---|---|---|
| CVE-2026-58197 | ToolHive: containerized MCP servers can reach host services via host.docker.internal, enabling lateral movementPublic exploitstacklok · toolhive | High8.8 |
| CVE-2026-58196 | ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation)Public exploitstacklok · toolhive | Medium4.7 |
| CVE-2026-54450 | ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gatewaystacklok · toolhive | Low2.9 |
| CVE-2025-47274 | ToolHive stores secrets in the state store with no encryptionstacklok · toolhive | Low2.4 |
| CVE-2024-37904 | Denial of service from maliciously configured Git repository in Minderstacklok · minder | Medium5.7 |
| CVE-2024-35238 | Denial of service of Minder Server from maliciously crafted GitHub attestationsstacklok · minder | Medium5.3 |
| CVE-2024-35194 | Stacklok Minder vulnerable to denial of service from maliciously crafted templatesstacklok · minder | Medium5.3 |
| CVE-2024-35185 | Denial of service of Minder Server with attacker-controlled REST endpointstacklok · minder | Medium5.3 |
| CVE-2024-34084 | Minder's Github Webhook Handler vulnerable to denial of service from un-validated requestsPublic exploitstacklok · minder | High7.5 |
| CVE-2024-31455 | Minder GetRepositoryByName data leakstacklok · minder | Medium4.3 |
| CVE-2024-27916 | `GetRepositoryByName`, `DeleteRepositoryByName` and `GetArtifactByName` allow access of arbitrary repositories in Minder by any authenticated userPublic exploitstacklok · minder | High7.1 |
| CVE-2024-27093 | Minder trusts client-provided mapping from repo name to upstream IDPublic exploitstacklok · minder | Medium4.6 |