Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 7 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 405,440All CVEsplus 19,159 rejected
- 674Last 24 hours4,918 in the last 7 days
- 18,818Last 30 days1,596 of them critical
- 1,779Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 0 | 5 | 8 | 1 | 0 | 14 | 31 |
| 2025 | 1 | 1 | 7 | 2 | 0 | 11 | 17 |
| 2024 | 0 | 1 | 3 | 0 | 0 | 4 | 6 |
| 2023 | 0 | 1 | 1 | 0 | 0 | 2 | 2 |
| Title | ||
|---|---|---|
| CVE-2026-118662 | Vite: `server.fs.deny` bypassed with queriesvitejs · vite | Medium6.9 |
| CVE-2026-112948 | Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token filevitest-dev · vitest | Medium6.5 |
| CVE-2026-112947 | Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`vitejs · vite | Medium6.3 |
| CVE-2026-112946 | Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machinePublic exploitvitejs · vite | Medium6.3 |
| CVE-2026-112945 | Vite: Cross origin script execution through Vite custom middlewarePublic exploitvitejs · vite | Low2.1 |
| CVE-2026-112944 | launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editorsvitejs · launch-editor | Medium6.3 |
| CVE-2026-112943 | launch-editor: escapeCmdArgs() omits % escaping on Windowsvitejs · launch-editor | Medium6.3 |
| CVE-2026-112942 | launch-editor: `fs.existsSync()` existence check can be bypassed on Windowsvitejs · launch-editor | High7.5 |
| CVE-2026-53571 | Vite: `server.fs.deny` bypass on Windows alternate pathsPublic exploitvitejs · vite | High8.2 |
| CVE-2026-53632 | NTLMv2 hash disclosure via UNC path handling on WindowsPublic exploitvitejs · launch-editor | Medium5.5 |
| CVE-2024-52011 | launch-editor vulnerable to command injection via the crafted request on Windowsvitejs · launch-editor | High7.5 |
| CVE-2026-39365 | Vite has a Path Traversal in Optimized Deps `.map` HandlingPublic exploitvitejs · vite | Medium6.3 |
| CVE-2026-39364 | Vite has a `server.fs.deny` bypass with queriesPublic exploitvitejs · vite | High8.2 |
| CVE-2026-39363 | Vite Affected by Arbitrary File Read via Vite Dev Server WebSocketPublic exploitvitejs · vite | High8.2 |
| CVE-2025-68155 | @vitejs/plugin-rsc has Arbitrary File Read via `/__vite_rsc_findSourceMapURL` Endpoint on DevelopmentPublic exploitvitejs · vite-plugin-react | High7.5 |
| CVE-2025-67489 | @vitejs/plugin-rsc Remote Code Execution through unsafe dynamic imports in RSC server function APIs on development serverPublic exploitvitejs · vite-plugin-react | Critical9.8 |
| CVE-2025-62522 | vite allows server.fs.deny bypass via backslash on WindowsPublic exploitvitejs · vite | Medium6.0 |
| CVE-2025-58752 | Vite's `server.fs` settings were not applied to HTML filesPublic exploitvitejs · vite | Low2.3 |
| CVE-2025-58751 | Vite middleware may serve files starting with the same name with the public directoryPublic exploitvitejs · vite | Low2.3 |
| CVE-2025-46565 | Vite's server.fs.deny bypassed with /. for files under project rootPublic exploitvitejs · vite | Medium6.0 |
| CVE-2025-32395 | Vite has an `server.fs.deny` bypass with an invalid `request-target`Public exploitvitejs · vite | Medium6.0 |
| CVE-2025-31486 | Vite allows server.fs.deny to be bypassed with .svg or relative pathsPublic exploitvitejs · vite | Medium5.3 |
| CVE-2025-31125 | Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` queryExploitedPublic exploitvitejs · vite | Medium5.3 |
| CVE-2025-30208 | Vite bypasses server.fs.deny when using `?raw??`Public exploitvitejs · vite | Medium5.3 |
| CVE-2025-24010 | Vite allows any websites to send any requests to the development server and read the responsePublic exploitvitejs · vite | Medium6.5 |
| CVE-2024-45812 | DOM Clobbering gadget found in vite bundled scripts that leads to XSS in VitePublic exploitvitejs · vite | Medium6.4 |
| CVE-2024-45811 | server.fs.deny bypassed when using ?import&raw in vitePublic exploitvitejs · vite | Medium4.8 |
| CVE-2024-31207 | Vite's `server.fs.deny` did not deny requests for patterns with directoriesvitejs · vite | Medium5.9 |
| CVE-2024-23331 | Vite dev server option `server.fs.deny` can be bypassed when hosted on case-insensitive filesystemPublic exploitvitejs · vite | High7.5 |
| CVE-2023-49293 | Cross-site Scripting in `server.transformIndexHtml` via URL payload in vitePublic exploitvitejs · vite | Medium6.1 |
| CVE-2023-34092 | Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//)Public exploitvitejs · vite | High7.5 |