Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 8 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 402,153All CVEsplus 19,142 rejected
- 220Last 24 hours3,234 in the last 7 days
- 16,917Last 30 days1,558 of them critical
- 1,769Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 150 | 532 | 1,256 | 227 | 0 | 2,165 | 6,359 |
| 2025 | 19 | 104 | 413 | 59 | 0 | 595 | 4,194 |
| 2024 | 32 | 121 | 604 | 16 | 0 | 773 | 3,599 |
| 2023 | 50 | 165 | 711 | 9 | 0 | 935 | 2,826 |
| 2022 | 93 | 204 | 836 | 11 | 0 | 1,144 | 1,891 |
| 2021 | 48 | 183 | 514 | 2 | 0 | 747 | 747 |
| Title | ||
|---|---|---|
| CVE-2026-110963 | Userplace <= 1.2.0 - Unauthenticated Privilege EscalationPublic exploitUnknown · Userplace | Critical9.8 |
| CVE-2026-110132 | Sync Post With Other Site 1.9.3 - Contributor+ Arbitrary Custom Post Type Creation and ModificationPublic exploitUnknown · Sync Post With Other Site | Medium4.9 |
| CVE-2026-109925 | Productive Commerce < 1.1.54 - Unauthenticated SQLi via Wishlist and Compare HandlersPublic exploitUnknown · Productive Commerce | High8.6 |
| CVE-2026-106015 | Ecommerce Affiliate <= 1.0.0 - Unauthenticated Account Takeover via Email OTP Brute ForcePublic exploitUnknown · Ecommerce Affiliate | High8.1 |
| CVE-2026-105970 | BCK Auto-confirm Bank Transfer <= 2.0.1 - Unauthenticated WooCommerce Order Payment ConfirmationPublic exploitUnknown · Thanh Toán Quét Mã QR Code Tự Động | Medium5.3 |
| CVE-2026-104639 | Razorpay for WooCommerce < 4.8.9 - Admin+ SQLi via WebhookPublic exploitUnknown · Razorpay for WooCommerce | Medium4.1 |
| CVE-2026-104338 | Razorpay for WooCommerce < 4.8.9 - Unauthenticated User Context Switch via 1cc Coupon RoutePublic exploitUnknown · Razorpay for WooCommerce | Low3.7 |
| CVE-2026-104337 | Razorpay for WooCommerce < 4.8.9 - Unauthenticated Order Data Disclosure via 1CC Coupon ApplyPublic exploitUnknown · Razorpay for WooCommerce | Medium5.3 |
| CVE-2026-104307 | BackUpWordPress < 3.15 - Subscriber+ Backup Directory File Deletion via hmbkp_dismiss_errorPublic exploitUnknown · BackUpWordPress | Medium5.4 |
| CVE-2026-103303 | Turisbook Booking System <= 1.3.8 - Unauthenticated Stored XSS via Cart Background SettingPublic exploitUnknown · Turisbook Booking System | High8.8 |
| CVE-2026-114432 | Contact Form 7 6.2 - 6.2.3 - Unauthenticated Arbitrary File Upload via Invalid UTF-8 FilenamePublic exploitUnknown · Contact Form 7 | Critical9.8 |
| CVE-2026-96963 | Pie Register <= 3.8.4.15 - Contributor+ Invitation Code ModificationPublic exploitUnknown · Pie Register | Low2.7 |
| CVE-2026-96961 | Pie Register <= 3.8.4.15 - Unauthenticated Plugin Settings Reset and Redirect Data DestructionPublic exploitUnknown · Pie Register | Medium6.5 |
| CVE-2026-103375 | Antom Payments <= 2.0.11 - Unauthenticated WooCommerce Order Data DisclosurePublic exploitUnknown · Antom Payments | Medium5.3 |
| CVE-2026-97195 | Secure Custom Fields < 6.9.8 - Admin+ Stored XSS via HTML Attribute Name Injection into Field DefinitionPublic exploitUnknown · Secure Custom Fields | Low3.5 |
| CVE-2026-97194 | Secure Custom Fields < 6.9.8 - Contributor+ Unpublished Post Title and Status Disclosure via Relational FieldsPublic exploitUnknown · Secure Custom Fields | Low2.7 |
| CVE-2026-97193 | Secure Custom Fields < 6.9.8 - Contributor+ Relationship Field Update on Arbitrary Objects via IDORPublic exploitUnknown · Secure Custom Fields | Low2.7 |
| CVE-2026-97192 | Secure Custom Fields < 6.9.8 - Contributor+ Admin-Restricted Custom Field Update via Post Save PathPublic exploitUnknown · Secure Custom Fields | Low2.7 |
| CVE-2026-85344 | FV Player < 7.5.57.7212 - Subscriber+ Bulk Post Modification via Missing AuthorizationPublic exploitUnknown · FV Flowplayer Video Player | Medium4.3 |
| CVE-2026-122085 | Event Tickets Manager for WooCommerce < 1.6.0 - Unauthenticated Ticket Transfer and Attendee PII DisclosurePublic exploitUnknown · Event Tickets Manager for WooCommerce | Medium6.5 |
| CVE-2026-122062 | Pronamic Pay & Pronamic Pay doneren met Mollie - Unauthenticated Form Submission Disclosure via REST APIPublic exploitUnknown · Pronamic Pay | Medium5.3 |
| CVE-2026-122060 | WP Recipe Maker < 10.9.2 - Unauthenticated Password-Protected Recipe DisclosurePublic exploitUnknown · WP Recipe Maker | Medium5.3 |
| CVE-2026-122001 | Komfortkasse for WooCommerce < 1.4.9 - Administrator Account Creation via CSRFPublic exploitUnknown · Komfortkasse for WooCommerce | High8.8 |
| CVE-2026-121866 | Exsile SMS Gateway < 2.0.0 - Subscriber+ Privilege Escalation via Arbitrary Option UpdatePublic exploitUnknown · iLeads SMS Gateway by Exsile | High8.8 |
| CVE-2026-121858 | Event Tickets with Ticket Scanner < 3.2.9 - Authenticated SQLi via DataTables SearchPublic exploitUnknown · Event Tickets with Ticket Scanner | Medium6.3 |
| CVE-2026-121857 | Event Tickets with Ticket Scanner < 3.1.14 - Authenticated Ticket Data Disclosure and Removal via executeWCBackendPublic exploitUnknown · Event Tickets with Ticket Scanner | Medium4.2 |
| CVE-2026-121848 | Magic Link < 2.2.6 - Subscriber+ Privilege Escalation via Magic Link GenerationPublic exploitUnknown · Magic Link | High8.8 |
| CVE-2026-121796 | Add From Server Reloaded < 6.0.0 - Author+ Stored XSS via SVG UploadPublic exploitUnknown · Add From Server Lite | Medium6.8 |
| CVE-2026-121492 | Fiber Admin < 4.0.1 - Unauthenticated Arbitrary Post and Term Order Modification via fiad_cpo_update and fiad_cpo_tax_updatePublic exploitUnknown · Fiber Admin | Medium5.3 |
| CVE-2026-121491 | Fiber Admin 3.1.0 - 4.0.0 - Unauthenticated RCE via Host HeaderPublic exploitUnknown · Fiber Admin | Critical9.0 |
| CVE-2026-121380 | Tournamatch < 4.7.1 - Unauthenticated Team Invitation Email Disclosure via REST APIPublic exploitUnknown · Tournamatch | Medium5.3 |
| CVE-2026-121379 | Tournamatch < 4.7.1 - Subscriber+ Arbitrary File DeletionPublic exploitUnknown · Tournamatch | Critical9.6 |
| CVE-2026-119073 | Live Composer < 2.1.23 - Contributor+ Stored XSS via Post Module PaginationPublic exploitUnknown · Live Composer | Medium6.8 |
| CVE-2026-118534 | Directorist < 8.11 - Subscriber+ Payment Retry on Other Users' Orders via IDORPublic exploitUnknown · Directorist: AI-Powered Business Directory, Listings & Classified Ads | Medium4.3 |
| CVE-2026-118533 | Directorist < 8.11 - Subscriber+ Order and Payment Information Disclosure via Payment ReceiptPublic exploitUnknown · Directorist: AI-Powered Business Directory, Listings & Classified Ads | Medium4.3 |
| CVE-2026-118532 | Directorist < 8.11 - Subscriber+ Arbitrary Media Deletion via Listing Image FieldPublic exploitUnknown · Directorist: AI-Powered Business Directory, Listings & Classified Ads | Medium6.5 |
| CVE-2026-118530 | Directorist < 8.11 - Admin+ Cross-Site Account Lockout via Email Verification Bulk ActionPublic exploitUnknown · Directorist: AI-Powered Business Directory, Listings & Classified Ads | Medium5.0 |
| CVE-2026-118529 | Directorist < 8.11 - Subscriber+ Other Users' Pending Listing Publication via Featured Listing CheckoutPublic exploitUnknown · Directorist: AI-Powered Business Directory, Listings & Classified Ads | Low3.1 |
| CVE-2026-118528 | Directorist < 8.11 - Subscriber+ Draft Listing Contact Information Disclosure via IDORPublic exploitUnknown · Directorist: AI-Powered Business Directory, Listings & Classified Ads | Medium4.3 |
| CVE-2026-117588 | WP Google Review Slider < 18.11 - Google API Settings Update via CSRFPublic exploitUnknown · WP Google Review Slider | Medium4.3 |
| CVE-2026-117525 | FV Player < 7.5.57.7212 - Unauthenticated Stored XSS via Comment PopupPublic exploitUnknown · FV Flowplayer Video Player | High7.5 |
| CVE-2025-15708 | Live Composer < 2.1.23 - Admin+ Stored XSS via Partner SlugPublic exploitUnknown · Live Composer | Low3.5 |
| CVE-2026-97191 | Advanced Custom Fields < 6.8.11 - Contributor+ Admin-Restricted Custom Field Update via Post Save PathPublic exploitUnknown · Advanced Custom Fields (ACF®) | Low2.7 |
| CVE-2026-97190 | Advanced Custom Fields 6.2.0 - 6.8.10 - Contributor+ Relationship Field Update on Arbitrary Objects via IDORPublic exploitUnknown · Advanced Custom Fields (ACF®) | Low2.7 |
| CVE-2026-97189 | Advanced Custom Fields < 6.8.11 - Contributor+ Unpublished Post Title and Status Disclosure via Relational FieldsPublic exploitUnknown · Advanced Custom Fields (ACF®) | Low2.7 |
| CVE-2026-121636 | Quick Event Manager 9.9.5 - 9.18 - Unauthenticated PayPal IPN Verification Bypass via the 'debug' ParameterPublic exploitUnknown · Quick Event Manager | Medium5.3 |
| CVE-2026-121633 | Order Tracking < 3.6.0 - Unauthenticated Payment Confirmation Forgery via PayPal IPN ListenerPublic exploitUnknown · Order Tracking | Medium5.3 |
| CVE-2026-118166 | MC4WP: Mailchimp for WordPress < 4.15.0 - Unauthenticated Arbitrary Shortcode Execution via Dynamic Content TagPublic exploitUnknown · MC4WP: Mailchimp for WordPress | Medium4.8 |
| CVE-2026-118423 | WP Libre Form 1.5.0.1 - Unauthenticated RCE via Arbitrary File UploadPublic exploitUnknown · WP Libre Form | Critical10.0 |
| CVE-2026-88801 | MDJM Event Management and Mobile Events Manager <= 1.7.8.7 - Subscriber+ Stored XSS via Role CreationPublic exploitUnknown · MDJM Event Management | High8.0 |