Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 1 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 402,772All CVEsplus 19,156 rejected
- 564Last 24 hours3,409 in the last 7 days
- 17,063Last 30 days1,516 of them critical
- 1,773Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 682 | 2,493 | 2,141 | 9 | 0 | 5,325 | 19,452 |
| 2025 | 420 | 2,826 | 3,742 | 18 | 0 | 7,006 | 14,127 |
| 2024 | 378 | 1,306 | 2,845 | 35 | 0 | 4,564 | 7,121 |
| 2023 | 66 | 516 | 1,555 | 9 | 0 | 2,146 | 2,557 |
| 2022 | 18 | 35 | 303 | 25 | 0 | 381 | 411 |
| 2021 | 2 | 5 | 22 | 1 | 0 | 30 | 30 |
| Title | ||
|---|---|---|
| CVE-2026-120834 | WordPress WP2LEADS plugin <= 3.5.17 - Privilege Escalation vulnerabilityTobias · WP2LEADS | High7.3 |
| CVE-2026-121769 | WordPress WP w3all phpBB plugin <= 3.1.9 - SQL Injection vulnerabilityaxew3.com · WP w3all phpBB | High8.5 |
| CVE-2026-121573 | WordPress WP Activity Log plugin <= 5.6.7 - Cross Site Scripting (XSS) vulnerabilityMelapress · WP Activity Log | Medium6.5 |
| CVE-2026-121576 | WordPress MCP Server for WordPress plugin <= 2.0.1 - Privilege Escalation vulnerabilityAtlasAiDev · MCP Server for WordPress | High8.8 |
| CVE-2026-122664 | WordPress Broadcast Live Video plugin <= 7.3.14 - Cross Site Scripting (XSS) vulnerabilityVideoWhisper.com · Broadcast Live Video | High7.1 |
| CVE-2026-123482 | WordPress JetFormBuilder plugin <= 3.6.8 - Cross Site Scripting (XSS) vulnerabilityCrocoblock · JetFormBuilder | High7.1 |
| CVE-2026-121612 | WordPress WPBruiser {no- Captcha anti-Spam} plugin <= 3.6.2 - Broken Authentication vulnerabilityWPZOOM · WPBruiser {no- Captcha anti-Spam} | Medium4.3 |
| CVE-2026-122673 | WordPress ShopEngine plugin <= 4.9.8 - Cross Site Scripting (XSS) vulnerabilityWpmet · ShopEngine | Medium6.5 |
| CVE-2026-120854 | WordPress iubenda plugin <= 3.13.6 - Denial of Service Attack vulnerabilityiubenda · iubenda | High7.5 |
| CVE-2026-120856 | WordPress Invoice Gateway for WooCommerce – Invoice Payment Gateway plugin <= 1.1.6 - Cross Site Scripting (XSS) vulnerabilityRymera Web Co · Invoice Gateway for WooCommerce – Invoice Payment Gateway | High7.1 |
| CVE-2026-123460 | WordPress WordPress File Upload plugin <= 5.2.2 - Cross Site Scripting (XSS) vulnerabilityNickboss · WordPress File Upload | High7.1 |
| CVE-2026-122661 | WordPress Directorist plugin <= 8.10.7 - Cross Site Scripting (XSS) vulnerabilitywpWax · Directorist | Medium6.5 |
| CVE-2026-121722 | WordPress Formidable Forms Signature Online Contract Automation plugin <= 2.0.5 - Broken Access Control vulnerabilityWP E-Signature · Formidable Forms Signature Online Contract Automation | High7.5 |
| CVE-2026-119515 | WordPress Radius Booking — Booking Calendar for Appointments & Services plugin <= 1.0.20 - Broken Access Control vulnerabilityMamunur Rashid · Radius Booking — Booking Calendar for Appointments & Services | Medium6.5 |
| CVE-2026-122665 | WordPress Mang Board WP plugin <= 2.4.7 - Cross Site Scripting (XSS) vulnerabilityKitae Park · Mang Board WP | Medium6.5 |
| CVE-2026-122666 | WordPress Mang Board WP plugin <= 2.4.7 - Cross Site Scripting (XSS) vulnerabilityKitae Park · Mang Board WP | High7.1 |
| CVE-2026-119524 | WordPress WP Customer Area plugin <= 8.4.3 - Cross Site Scripting (XSS) vulnerabilityAguila Technologies · WP Customer Area | Medium6.5 |
| CVE-2026-123476 | WordPress Featured Image from URL plugin <= 6.1.4 - Cross Site Scripting (XSS) vulnerabilityfifu.app · Featured Image from URL | High7.1 |
| CVE-2026-120855 | WordPress TI WooCommerce Wishlist plugin <= 2.14.0 - Cross Site Scripting (XSS) vulnerabilityTemplateInvaders · TI WooCommerce Wishlist | Medium6.5 |
| CVE-2026-121570 | WordPress RSVP and Event Management plugin <= 2.7.17 - Cross Site Scripting (XSS) vulnerabilityWP Chill · RSVP and Event Management | High7.1 |
| CVE-2026-123475 | WordPress MapSVG plugin <= 8.16.3 - Broken Access Control vulnerabilityPT Norther Lights Production · MapSVG | High7.5 |
| CVE-2026-121782 | WordPress If-So Dynamic Content Personalization plugin <= 1.10.3 - Cross Site Scripting (XSS) vulnerabilityIf-So Dynamic Content · If-So Dynamic Content Personalization | High7.1 |
| CVE-2026-120838 | WordPress All-in-One Video Gallery plugin <= 5.0.0 - Cross Site Scripting (XSS) vulnerabilityPlugins360 Labs · All-in-One Video Gallery | Medium6.5 |
| CVE-2026-119483 | WordPress Form Maker by 10Web plugin <= 1.15.50 - Cross Site Scripting (XSS) vulnerability10Web · Form Maker by 10Web | High7.1 |
| CVE-2026-119497 | WordPress Directorist plugin <= 8.10.6 - Cross Site Scripting (XSS) vulnerabilitywpWax · Directorist | Medium6.5 |
| CVE-2026-119505 | WordPress Welcart e-Commerce plugin <= 2.12.6 - Cross Site Scripting (XSS) vulnerabilityWelcart · Welcart e-Commerce | High7.1 |
| CVE-2026-123463 | WordPress Checkout Files Upload for WooCommerce plugin <= 2.4.0 - Cross Site Scripting (XSS) vulnerabilityWP Wham · Checkout Files Upload for WooCommerce | High7.1 |
| CVE-2026-121763 | WordPress Hummingbird plugin <= 3.21.2 - Cross Site Scripting (XSS) vulnerabilityWPMU DEV · Hummingbird | Medium6.5 |
| CVE-2026-66675 | WordPress Motors plugin <= 1.4.128 - Cross Site Scripting (XSS) vulnerabilityStylemixThemes · Motors | Medium6.5 |
| CVE-2026-119514 | WordPress RepairBuddy plugin <= 4.1234 - Privilege Escalation vulnerabilityWebful Creations · RepairBuddy | Medium6.3 |
| CVE-2026-123484 | WordPress JetFormBuilder plugin <= 3.6.8 - Cross Site Scripting (XSS) vulnerabilityCrocoblock · JetFormBuilder | High7.1 |
| CVE-2026-121764 | WordPress FV Flowplayer Video Player plugin <= 7.5.56.7212 - Cross Site Scripting (XSS) vulnerabilityFolioVision · FV Flowplayer Video Player | High7.1 |
| CVE-2026-119504 | WordPress Frontend Admin by DynamiApps plugin <= 3.30.1 - Cross Site Scripting (XSS) vulnerabilityDynamiApps · Frontend Admin by DynamiApps | High7.1 |
| CVE-2026-119503 | WordPress Welcart e-Commerce plugin <= 2.12.6 - Content Injection vulnerabilityWelcart · Welcart e-Commerce | Medium6.5 |
| CVE-2026-54863 | WordPress Review Schema plugin <= 3.1.4 - Cross Site Scripting (XSS) vulnerabilityMamunur Rashid · Review Schema | High7.1 |
| CVE-2026-123465 | WordPress myCred plugin <= 4.0.2 - Sensitive Data Exposure vulnerabilitymyCred · myCred | High7.5 |
| CVE-2026-121780 | WordPress Flying Images plugin <= 2.4.15 - Cross Site Scripting (XSS) vulnerabilityGijo Varghese · Flying Images | High7.1 |
| CVE-2026-111403 | WordPress WP Inventory Manager plugin <= 2.5.9 - Cross Site Scripting (XSS) vulnerabilityWP Inventory · WP Inventory Manager | High7.1 |
| CVE-2026-121760 | WordPress weDocs plugin <= 2.6.1 - Broken Access Control vulnerabilityweDevs · weDocs | High7.5 |
| CVE-2026-119506 | WordPress Frontend Admin by DynamiApps plugin <= 3.30.1 - Privilege Escalation vulnerabilityDynamiApps · Frontend Admin by DynamiApps | Critical9.1 |
| CVE-2026-61987 | WordPress WCFM – Frontend Manager for WooCommerce plugin <= 6.8.1 - Cross Site Scripting (XSS) vulnerabilityWC Lovers · WCFM – Frontend Manager for WooCommerce | Medium6.5 |
| CVE-2026-114186 | WordPress AnyWhere Elementor plugin <= 1.3.0 - Broken Access Control vulnerabilityWPVibes · AnyWhere Elementor | Medium6.5 |
| CVE-2026-114189 | WordPress AnyWhere Elementor plugin <= 1.3.0 - SQL Injection vulnerabilityWPVibes · AnyWhere Elementor | High8.5 |
| CVE-2026-109900 | WordPress Melapress Role Editor plugin <= 1.3.0 - Privilege Escalation vulnerabilityMelapress · Melapress Role Editor | Critical9.6 |
| CVE-2026-120858 | WordPress FluentForm plugin <= 6.2.16 - Broken Access Control vulnerabilityWP ManageNinja LLC · FluentForm | Medium6.5 |
| CVE-2026-109899 | WordPress Melapress Role Editor plugin <= 1.3.0 - Broken Access Control vulnerabilityMelapress · Melapress Role Editor | High7.1 |
| CVE-2026-114188 | WordPress AnyWhere Elementor plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerabilityWPVibes · AnyWhere Elementor | Medium6.5 |
| CVE-2026-123472 | WordPress Meta Box – WordPress Custom Fields Framework plugin <= 5.15.3 - Cross Site Scripting (XSS) vulnerabilityeLightUp · Meta Box – WordPress Custom Fields Framework | Medium6.5 |
| CVE-2026-119522 | WordPress User Registration plugin <= 5.3.1 - Broken Access Control vulnerabilityThemeGrill · User Registration | Medium5.3 |
| CVE-2026-123461 | WordPress FOX plugin <= 1.5.6 - Broken Access Control vulnerabilityPluginUs.Net · FOX | Medium5.3 |