Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 1 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 405,284All CVEsplus 19,159 rejected
- 575Last 24 hours4,859 in the last 7 days
- 18,783Last 30 days1,611 of them critical
- 1,779Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 0 | 5 | 7 | 1 | 0 | 13 | 14 |
| 2025 | 0 | 0 | 1 | 0 | 0 | 1 | 1 |
| Title | ||
|---|---|---|
| CVE-2026-85287 | HomeBox: Email Case-Sensitivity Bypass Allows Duplicate Account Creation and Login Denial of ServicePublic exploitsysadminsmedia · homebox | Medium6.5 |
| CVE-2026-75599 | HomeBox: Stored XSS via `javascript:` URI in Custom Entity Fieldssysadminsmedia · homebox | Medium5.4 |
| CVE-2026-85286 | HomeBox: Timing Side-Channel in Login Endpoint Allows User Enumeration via Bcrypt Hashing Delaysysadminsmedia · homebox | Low3.7 |
| CVE-2026-116680 | Homebox generic notifier SSRF via HTTP redirect after URL validationsysadminsmedia · homebox | Medium6.4 |
| CVE-2026-55473 | HomeBox: Notifier SSRF guard misses NAT64 prefixes (64:ff9b::/96, 64:ff9b:1::/48) — generic:// URL reaches cloud metadata on NAT64 egresssysadminsmedia · homebox | Medium6.0 |
| CVE-2026-48826 | HomeBox: Cross-Group Inventory Wipe in Homebox via Global Owner Role and X-Tenant Header Switchingsysadminsmedia · homebox | High8.1 |
| CVE-2026-48974 | HomeBox: Forced Group Membership Without Consent in Homebox AddMember Handlersysadminsmedia · homebox | Medium5.4 |
| CVE-2026-48975 | HomeBox: Cross-Tenant IDOR in MaintenanceEntry Update and Delete Allows Tampering and Destruction of Any User's Maintenance History in Homeboxsysadminsmedia · homebox | High8.1 |
| CVE-2026-48976 | HomeBox: Cross-Tenant IDOR in Notifier Update Leaks Shoutrrr Credentials and Allows Webhook Hijacksysadminsmedia · homebox | High8.1 |
| CVE-2026-40196 | HomeBox has Unauthorized API Access via Retained defaultGroup ID After Group Access Revocationsysadminsmedia · homebox | High8.1 |
| CVE-2026-27981 | HomeBox has an Auth Rate Limit Bypass via IP Spoofingsysadminsmedia · homebox | High7.4 |
| CVE-2026-27600 | HomeBox affected by Blind SSRFsysadminsmedia · homebox | Medium5.0 |
| CVE-2026-26272 | HomeBox affected by Stored XSS via HTML/SVG Attachment Uploadsysadminsmedia · homebox | Medium4.6 |
| CVE-2025-53108 | HomeBox Missing User Authorizationsysadminsmedia · homebox | Medium5.3 |