Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 8 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 406,575All CVEsplus 19,172 rejected
- 247Last 24 hours4,787 in the last 7 days
- 16,659Last 30 days1,459 of them critical
- 1,781Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 96 | 134 | 165 | 1 | 0 | 396 | 547 |
| 2025 | 10 | 18 | 21 | 3 | 0 | 52 | 151 |
| 2024 | 2 | 1 | 18 | 0 | 0 | 21 | 99 |
| 2023 | 11 | 3 | 17 | 0 | 0 | 31 | 78 |
| 2022 | 3 | 2 | 11 | 0 | 0 | 16 | 47 |
| 2021 | 3 | 4 | 17 | 0 | 0 | 24 | 31 |
| 2020 | 1 | 4 | 2 | 0 | 0 | 7 | 7 |
| Title | ||
|---|---|---|
| CVE-2026-117544 | Joomla Extension - jdownloads.com - IDOR allowing restricted file downloads in jDownloads < 4.1.8jdownloads.com · jDownloads extension for Joomla | High8.2 |
| CVE-2026-117542 | Joomla Extension - jdownloads.com - Authenticated path traversal in jDownloads < 4.1.8jdownloads.com · jDownloads extension for Joomla | Medium5.1 |
| CVE-2026-120467 | Joomla / WordPress Extension - acymailing.com - Subscriber identity not bound to the record acted upon in AcyMailing 1.0.0 - 11.1.1Datasolution · AcyMailing extension for Joomla and WordPress | High7.1 |
| CVE-2026-120468 | Joomla Extension - acymailing.com - Unauthenticated disclosure of mailing list metadata in AcyMailing 1.0.0 - 11.1.1Datasolution · AcyMailing extension for Joomla | Medium6.9 |
| CVE-2026-117551 | Joomla Extension - jdownloads.com - RCE through file upload in jDownloads < 4.1.8jdownloads.com · jDownloads extension for Joomla | Critical10.0 |
| CVE-2026-120471 | Joomla Extension - acymailing.com - Site modules rendered outside their access level in AcyMailing 1.0.0 - 11.1.1Datasolution · AcyMailing extension for Joomla | Medium6.9 |
| CVE-2026-120470 | Joomla / WordPress Extension - acymailing.com - Online version of an email readable without the visibility check in AcyMailing 1.0.0 - 11.1.1Datasolution · AcyMailing extension for Joomla and WordPress | Medium6.9 |
| CVE-2026-120466 | Joomla / WordPress Extension - acymailing.com - Missing authorization on subscription changes in AcyMailing 1.0.0 - 11.1.1Datasolution · AcyMailing extension for Joomla and WordPress | High8.8 |
| CVE-2026-120469 | Joomla / WordPress Extension - acymailing.com - Open redirect on the subscription and unsubscription endpoints in AcyMailing 1.0.0 - 11.1.1Datasolution · AcyMailing extension for Joomla and WordPress | Medium5.1 |
| CVE-2026-117550 | Joomla Extension - jdownloads.com - Publishing of files without approval in jDownloads < 4.1.8jdownloads.com · jDownloads extension for Joomla | High7.1 |
| CVE-2026-117543 | Joomla Extension - jdownloads.com - SSRF via external download URL field jDownloads < 4.1.8jdownloads.com · jDownloads extension for Joomla | High8.9 |
| CVE-2026-118495 | Joomla / WordPress Extension - acymailing.com - Exposure of sensitive information to an unauthorized actor in AcyMailing 6.0.0 - 11.1.1Datasolution · AcyMailing extension for Joomla and WordPress | High8.8 |
| CVE-2026-102803 | Joomla Extension - j2commerce.com - Gift voucher and single-use coupon could pay for more than one order in J2Store 6.0.0 - 6.6.5j2commerce.com · J2Store extension for Joomla | Medium6.0 |
| CVE-2026-115451 | Joomla Extension - tassos.gr - File deletion through improper access control in Advanced Custom Fields extension 2.8.13-2.8.15, 3.1.4-3.1.8 and Smile Pack 1.2.7-1.2.9, 2.1.2-2.1.6tassos.gr · Advanced Custom Fields extension for Joomla | Medium6.9 |
| CVE-2026-118494 | Joomla Extension - jreviews.com - Secret configs cached in a web-accessible in JReviews 1.0.0-5.12.0, 6.0.0-6.6.9jreviews.com · JReviews component for Joomla | High8.2 |
| CVE-2026-107129 | Joomla Extension - balbooa.com - Unauthenticated arbitrary file deletion via path traversal in Gridbox < 2.20.5.0balbooa.com · Gridbox extension for Joomla | High8.3 |
| CVE-2026-107130 | Joomla Extension - balbooa.com - Unauthenticated deletion of submission/field files in Gridbox < 2.20.5.0balbooa.com · Gridbox extension for Joomla | Medium6.9 |
| CVE-2026-107903 | Joomla Extension - balbooa.com - Stored XSS in reviews via inconsistent sanitization in Gridbox < 2.20.5.0balbooa.com · Gridbox extension for Joomla | High8.6 |
| CVE-2026-105607 | Joomla Extension - balbooa.com - Unauthenticated stored XSS in the "Recent Comments / Recent Reviews" widget in Gridbox < 2.20.5.0balbooa.com · Gridbox extension for Joomla | High8.6 |
| CVE-2026-115452 | Joomla Extension - tassos.gr - Privileged stored XSS in Advanced Custom Fields 2.8.2-2.8.15, 3.0.0-3.1.8 and Smile Pack 1.1.2-1.2.9, 2.0.0-2.1.6tassos.gr · Advanced Custom Fields extension for Joomla | High7.5 |
| CVE-2026-105606 | Joomla Extension - joomlaboat.com - Unauthenticated arbitrary file upload in Custom Tables < 3.7.8joomlaboat.com · Custom Tables extension for Joomla | Critical9.5 |
| CVE-2026-105605 | Joomla Extension - dj-extensions.com - IDOR vulnerability allowing cross-account ad access in DJ-Classifieds < 3.11.3dj-extensions.com · DJ-Classifieds extension for Joomla | Medium5.3 |
| CVE-2026-105604 | Joomla Extension - dj-extensions.com - Unauthenticated SQL injection in DJ-Classifieds < 3.11.3dj-extensions.com · DJ-Classifieds extension for Joomla | Critical9.3 |
| CVE-2026-105603 | Joomla Extension - dj-extensions.com - Authenticated arbitrary file upload in DJ-Classifieds < 3.11.3dj-extensions.com · DJ-Classifieds extension for Joomla | Critical9.4 |
| CVE-2026-102802 | Joomla Extension - regularlabs.com - PHP code injection vector in Sourcerer extension < 17.0.1 when used with Articles Anywhere extension < 20.1.1regularlabs.com · Sourcerer Free extension for Joomla | High8.9 |
| CVE-2026-103419 | Joomla Extension - joomshaper.com - Stored Cross-Site Scripting (XSS) in Media Picker in Helix Ultimate < 2.2.11.joomshaper.com · Helix Ultimate extension for Joomla | High8.6 |
| CVE-2026-103420 | Joomla Extension - php-web-design.com - CSRF for various actions in StageIt 1.0-5.7.5, 6.0-6.3.5php-web-design.com · StageIt extension for Joomla | High7.2 |
| CVE-2026-105600 | Joomla Extension - php-web-design.com - RCE via setting strings in StageIt 1.0-5.7.5, 6.0-6.3.5php-web-design.com · StageIt extension for Joomla | High8.6 |
| CVE-2026-105601 | Joomla Extension - php-web-design.com - Reflected XSS in StageIt 1.0-5.7.5, 6.0-6.3.5php-web-design.com · StageIt extension for Joomla | Medium5.3 |
| CVE-2026-105602 | Joomla Extension - joomshaper.com - Stored Cross-Site Scripting (XSS) in Mega Menu Badge Text in Helix Ultimate < 2.2.11.joomshaper.com · Helix Ultimate extension for Joomla | High8.6 |
| CVE-2026-102801 | Joomla Extension - regularlabs.com - Exposure of Sensitive Information to Unauthorized Actor in Users Anywhere extension for Joomla < 3.0.1regularlabs.com · Users Anywhere (Free, Pro) extension for Joomla | Medium5.1 |
| CVE-2026-102790 | Joomla Extension - icagenda.com - Authenticated Stored XSS in iCagenda 4.0.8 to 4.0.12icagenda.com · iCagenda extension for Joomla | High8.6 |
| CVE-2026-102799 | Joomla Extension - icagenda.com - CSV formula injection in the registrations export in iCagenda 3.5.0 to 4.0.16icagenda.com · iCagenda extension for Joomla | Medium5.3 |
| CVE-2026-102800 | Joomla Extension - dj-extensions.com - Unauthenticated Stored XSS in DJ-HelpfulArticles < 1.3.0dj-extensions.com · DJ-HelpfulArticles extension for Joomla | High8.7 |
| CVE-2026-102787 | Joomla Extension - phoca.cz - CSRF in category management in Phoca Download 3.1.0 - 6.1.5phoca.cz · Phoca Download extension for Joomla | Medium5.3 |
| CVE-2026-102788 | Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.4.2balbooa.com · Gridbox extension for Joomla | Critical9.3 |
| CVE-2026-102789 | Joomla Extension - balbooa.com - Missing Authorization Check on Editor Controller Task in Gridbox < 2.20.4.2balbooa.com · Gridbox extension for Joomla | Critical9.3 |
| CVE-2026-102786 | Joomla Extension - phoca.cz - Authenticated stored cross-site scripting through HTML attribute injection in Phoca Gallery 4.5.0 - 6.1.5phoca.cz · Phoca Gallery extension for Joomla | High8.6 |
| CVE-2026-102785 | Joomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro 5.0.0-5.0.52yootheme.com · YOOtheme Pro extension for Joomla | Critical10.0 |
| CVE-2026-102783 | Joomla Extension - balbooa.com - Path Traversal in image preview Gridbox < 2.20.4.0balbooa.com · Gridbox extension for Joomla | Medium6.3 |
| CVE-2026-102784 | Joomla Extension - balbooa.com - CSRF in language installation feature Gridbox < 2.20.4.0balbooa.com · Gridbox extension for Joomla | High8.7 |
| CVE-2026-102782 | Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Simple Membership < 7.4.0Public exploitordasoft.com · OrdaSoft Simple Membership extension for Joomla | Critical9.3 |
| CVE-2026-102781 | Joomla Extension - ordasoft.com - Unauthenticated Destructive CRUD in OrdaSoft Touch Slider < 5.4.6ordasoft.com · Touch Slider extension for Joomla | Medium6.9 |
| CVE-2026-102779 | Joomla Extension - joomlafry.com - Unauthenticated forced execution of published automation tasks in TF Content 2.9.0 - 2.9.4joomlafry.com · TF Content for Joomla | Medium6.9 |
| CVE-2026-102777 | Joomla Extension - svenbluege.de - Server-side request forgery in the Google Photos picker in Event Gallery extension < 6.6.0svenbluege.de · Event Gallery for Joomla | Medium6.3 |
| CVE-2026-102426 | Joomla Extension - joomshaper.com - Reflected XSS in the Dynamic Content Filter addon in SP Page Builder Pro 3.0.0 - 5.6.1p2joomshaper.com · SP Page Builder (Pro) extension for Joomla | Medium5.3 |
| CVE-2026-102778 | Joomla Extension - svenbluege.de - Cross-site scripting and open redirect on the share mini page in Event Gallery extension < 6.6.0svenbluege.de · Event Gallery for Joomla | Medium5.3 |
| CVE-2026-102780 | Joomla Extension - joomlafry.com - Unauthenticated cross-record publication and mass assignment in TF Content 2.9.0 - 2.9.4joomlafry.com · TF Content for Joomla | Medium6.9 |
| CVE-2026-102776 | Joomla Extension - svenbluege.de - Cross-site request forgery of list tasks of the backend in Event Gallery extension < 6.6.0svenbluege.de · Event Gallery for Joomla | Medium5.1 |
| CVE-2026-102775 | Joomla Extension - phoca.cz - Authorisation bypass through user-controlled key (IDOR) in Order View in Phoca Cart 5.0.0 - 6.1.8phoca.cz · Phoca Cart extension for Joomla | High8.7 |