Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 4 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 402,047All CVEsplus 19,141 rejected
- 254Last 24 hours3,257 in the last 7 days
- 16,895Last 30 days1,563 of them critical
- 1,769Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 1 | 34 | 39 | 0 | 0 | 74 | 357 |
| 2025 | 1 | 15 | 17 | 0 | 0 | 33 | 283 |
| 2024 | 20 | 7 | 20 | 0 | 0 | 47 | 250 |
| 2023 | 54 | 30 | 65 | 0 | 0 | 149 | 203 |
| 2022 | 6 | 16 | 32 | 0 | 0 | 54 | 54 |
| Title | ||
|---|---|---|
| CVE-2026-115541 | HumHub 1.19.0 - Stored cross-site scripting in friendship confirmationHumHub · HumHub Community Edition | High7.2 |
| CVE-2026-103038 | PingTools Network Utilities 4.64 - OS command injection through Watcher ICMP hostStreamSoft · PingTools Network Utilities | High8.6 |
| CVE-2026-101947 | ExifTool for photo and video 5.0.1 - Local OS command injection through filenames during CSV exportCellHubs · ExifTool for photo and video | High8.4 |
| CVE-2026-91107 | openSIS Classic 9.3 - Insecure Direct Object Reference (IDOR)OS4ED · openSIS-Classic | Critical9.3 |
| CVE-2026-102626 | LimeSurvey Community Edition 7.4.0 - Stored XSS through the Date/Time date_min question attributePublic exploitLimeSurvey · LimeSurvey | High7.2 |
| CVE-2026-97685 | LimeSurvey Community Edition 7.3.0 - Cross-survey object authorization bypass in REST survey patch operationsPublic exploitLimeSurvey · LimeSurvey | High7.1 |
| CVE-2026-85082 | Maple Media Root Browser Classic 3.3.0 - OS command injection through crafted SQLite filenamesPublic exploitMaple Media · Root Browser Classic | High8.5 |
| CVE-2026-84283 | FluteCode Secure Folder 1.2 -Plaintext vault files in shared storage bypass the PIN gatePublic exploitFluteCode · Secure Folder | Medium6.8 |
| CVE-2026-92730 | LimeSurvey Community Edition 7.0.14 - Reflected XSS in participant CSV import result via invalid attribute column nameLimeSurvey · LimeSurvey | High7.4 |
| CVE-2026-91775 | LimeSurvey Community Edition 7.0.14 - Reflected XSS through unescaped LSS survey-import warningsPublic exploitLimeSurvey · LimeSurvey | High7.4 |
| CVE-2026-93769 | HumHub 1.18.5 - Stored XSS in Profile Field Category title via HForm#renderForm leading to System Administrator account takeoverHumhub · Humhub | High7.2 |
| CVE-2026-77875 | Hide Photos - Secure vault 4.1.0 - Insecure storage of vault media and wallet records in shared external storageQUANTUMTECH LTD · Hide Photos - Secure vault | Medium6.8 |
| CVE-2026-79954 | NASA CryptoLib 1.5.0 - TC receive path accepts Security Associations from the wrong GVCIDNASA · CryptoLib | High8.7 |
| CVE-2026-77884 | Gallery - Private Photo Vault 1.0.41 - Unauthenticated local-network HTTP file exposurePublic exploitBrain Trust · Gallery - Private Photo Vault | High7.1 |
| CVE-2026-81301 | Ekia File Manager 1.2.7 - Exported ContentProvider allows unauthorized file accessEkia · File Manager | High8.5 |
| CVE-2026-19754 | Baserow 2.2.0 through 2.3.3 - SQL injection in formula index() JSONB array extractionPublic exploitBaserow · Baserow | High8.6 |
| CVE-2026-65931 | LimeSurvey Community Edition 7.0.5 - Improper authorization in survey menu entry creation endpointLimeSurvey · LimeSurvey | Medium5.1 |
| CVE-2026-63360 | LimeSurvey Community Edition 7.0.5 - Reflected XSS in user activation confirmation endpointPublic exploitLimeSurvey · LimeSurvey | High7.4 |
| CVE-2026-16809 | LimeSurvey Community Edition 7.0.5 - Stored XSS in quota message renderingPublic exploitLimeSurvey · LimeSurvey | High7.2 |
| CVE-2026-65930 | LimeSurvey Community Edition 7.0.5 - Stored XSS in replacement-fieldsPublic exploitLimeSurvey · LimeSurvey | Medium4.8 |
| CVE-2026-15973 | LimeSurvey 7.0.5 - Stored XSS in Survey Menu EntriesLimeSurvey · LimeSurvey | High8.4 |
| CVE-2026-19755 | NoSleep 1.5.1 - Unauthorized disclosure of root-owned files through privileged XPC helperNoSleep · NoSleep | Medium6.9 |
| CVE-2026-19198 | Akaunting 3.1.21 - Improper authorization in BulkActions handle dispatchPublic exploitAkaunting · Akaunting | High8.7 |
| CVE-2026-18430 | HumHub 1.18.4 - Stored XSS in comment-deletion notifications through unescaped administrator reasonPublic exploitHumHub · HumHub | High7.2 |
| CVE-2026-18756 | HumHub Community Edition 1.18.4-pl1 - Reflected XSS in Space membership request button renderingHumHub · HumHub | High7.2 |
| CVE-2026-18526 | HumHub 1.18.4 / 1.18.4-pl1 – Stored Cross-Site Scripting in oEmbed confirmationHumHub · HumHub | High7.4 |
| CVE-2026-18403 | LimeSurvey Community Edition 7.0.5 - Authenticated SQL injection in CPDBPublic exploitLimeSurvey · LimeSurvey | Medium6.0 |
| CVE-2026-63361 | LimeSurvey Community Edition 7.0.5 - Reflected XSS in HTML editor popupPublic exploitLimeSurvey · LimeSurvey | High8.5 |
| CVE-2026-10716 | Directus <12.1.0 - Authenticated time-based SQL injection in PostgreSQL/PostGIS collection creationDirectus · Directus | High7.5 |
| CVE-2026-13227 | ERPNext v16.25.0 - Improper authorization in Prospect opportunities APIPublic exploitFrappe · ERPNext | High7.1 |
| CVE-2026-13229 | Zammad 7.0.1 - Improper authorization in ticket article attachment cloningPublic exploitZammad · Zammad | High7.1 |
| CVE-2026-14871 | osTicket v1.18.3 - v1.17.7 - BOLA/IDOR in ticket field viewing allows cross-department data disclosureosTicket · osTicket | High7.1 |
| CVE-2026-11944 | openSIS Classic 9.3 - Authenticated path traversal in SentMail attachment downloadPublic exploitOS4ED · openSIS-Classic | Medium5.3 |
| CVE-2026-11779 | PayloadCMS 3.84.1 - Authenticated account lockout bypass through default unlock accessPublic exploitPayloadCMS · PayloadCMS | Medium5.3 |
| CVE-2026-50712 | Frappe Framework 17.0.0-dev - Stored XSS in Tree View node label renderingPublic exploitFrappe · Frappe Framework | Medium4.8 |
| CVE-2026-50711 | Frappe Framework 17.0.0-dev - Stored XSS in Number Card filter fields renderingPublic exploitFrappe · Frappe Framework | Medium4.6 |
| CVE-2026-50710 | Frappe Framework 17.0.0-dev - Stored XSS via eval in Number Card filters_configPublic exploitFrappe · Frappe Framework | Medium4.6 |
| CVE-2026-50709 | Frappe Framework 17.0.0-dev - Stored XSS in Notifications Events color renderingPublic exploitFrappe · Frappe Framework | Medium4.8 |
| CVE-2026-50708 | Frappe Framework 17.0.0-dev - Stored XSS in Multi Select Dialog result renderingPublic exploitFrappe · Frappe Framework | Medium4.8 |
| CVE-2026-50705 | Frappe Framework 17.0.0-dev - Stored XSS in Form Dashboard headline renderingPublic exploitFrappe · Frappe Framework | Medium4.6 |
| CVE-2026-50704 | Frappe Framework 17.0.0-dev - Reflected/Stored XSS in File View breadcrumbs renderingPublic exploitFrappe · Frappe Framework | Medium4.6 |
| CVE-2026-50703 | Frappe Framework 17.0.0-dev - Stored XSS in Desktop Icon label renderingFrappe · Frappe Framework | Medium4.8 |
| CVE-2026-50701 | Frappe Framework 17.0.0-dev - Reflected DOM XSS in dashboard-view breadcrumb renderingFrappe · Frappe Framework | Medium5.1 |
| CVE-2026-50700 | Frappe Framework 17.0.0-dev - Stored XSS in frappe.get_avatar image renderingFrappe · Frappe Framework | Medium4.6 |
| CVE-2026-50699 | Frappe Framework 17.0.0-dev - Stored XSS in Auto Repeat dashboard schedule renderingPublic exploitFrappe · Frappe Framework | Medium4.6 |
| CVE-2026-50698 | Frappe Framework 17.0.0-dev - Stored XSS in Audit Trail template renderingPublic exploitFrappe · Frappe Framework | Medium4.6 |
| CVE-2026-11994 | Akaunting 3.1.21 - Authenticated stored XSS in report description renderingPublic exploitAkaunting · Akaunting | Medium4.8 |
| CVE-2026-11943 | Akaunting 3.1.21 - Authenticated stored XSS in document timelinePublic exploitAkaunting · Akaunting | Medium4.8 |
| CVE-2026-11942 | Akaunting 3.1.21 - Stored XSS in delete confirmation modalPublic exploitAkaunting · Akaunting | Medium4.8 |
| CVE-2026-11982 | Stored XSS via missing XSS safety check in Admin2 Pages API partial validationPublic exploitGrav · grav-plugin-api | Medium5.1 |