Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 1 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 406,342All CVEsplus 19,170 rejected
- 747Last 24 hours5,151 in the last 7 days
- 17,070Last 30 days1,503 of them critical
- 1,779Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 37 | 368 | 756 | 65 | 2 | 1,228 | 9,969 |
| 2025 | 32 | 700 | 1,166 | 24 | 0 | 1,922 | 8,741 |
| 2024 | 29 | 474 | 897 | 21 | 0 | 1,421 | 6,819 |
| 2023 | 16 | 238 | 1,035 | 17 | 0 | 1,306 | 5,398 |
| 2022 | 7 | 230 | 451 | 14 | 0 | 702 | 4,092 |
| 2021 | 10 | 214 | 234 | 9 | 0 | 467 | 3,390 |
| 2020 | 5 | 220 | 170 | 5 | 0 | 400 | 2,923 |
| 2019 | 7 | 347 | 189 | 0 | 0 | 543 | 2,523 |
| 2018 | 3 | 361 | 88 | 1 | 0 | 453 | 1,980 |
| 2017 | 5 | 275 | 34 | 1 | 0 | 315 | 1,527 |
| 2016 | 2 | 69 | 8 | 2 | 0 | 81 | 1,212 |
| 2015 | 0 | 12 | 229 | 0 | 0 | 241 | 1,131 |
| 2014 | 0 | 2 | 243 | 1 | 0 | 246 | 890 |
| 2013 | 0 | 4 | 116 | 0 | 0 | 120 | 644 |
| 2012 | 0 | 1 | 152 | 1 | 0 | 154 | 524 |
| 2011 | 0 | 1 | 54 | 0 | 0 | 55 | 370 |
| 2010 | 0 | 1 | 71 | 3 | 0 | 75 | 315 |
| 2009 | 0 | 4 | 109 | 0 | 0 | 113 | 240 |
| 2008 | 0 | 11 | 64 | 3 | 0 | 78 | 127 |
| 2007 | 0 | 3 | 35 | 0 | 0 | 38 | 49 |
| 2006 | 0 | 2 | 1 | 0 | 0 | 3 | 11 |
| 2005 | 0 | 3 | 5 | 0 | 0 | 8 | 8 |
| Title | ||
|---|---|---|
| CVE-2026-126323 | Vvveb through 1.0.8.6 CSRF via GET Admin State-Changing Actionsgivanz · Vvveb | Medium5.3 |
| CVE-2026-126485 | OpenEMR before 8.5.0 CSRF via Observation Form delete.phpopenemr · openemr | Medium5.3 |
| CVE-2026-128043 | OpenMage magento-lts before 20.19.0 CSRF via PayPal Cancel Return HandlersOpenMage · magento-lts | Low2.3 |
| CVE-2026-128049 | OpenMage Magento LTS before 20.18.2 CSRF via OAuth Authorization ConfirmOpenMage · magento-lts | Critical9.4 |
| CVE-2026-126355 | Hono: `csrf()` does not check requests sent by hyperlink auditing (`text/ping`)honojs · hono | Medium5.3 |
| CVE-2026-125836 | WordPress Simple JWT Login plugin <= 3.6.8 - Cross Site Request Forgery (CSRF) vulnerabilityNicu Micle · Simple JWT Login | High8.8 |
| CVE-2026-122003 | Abilities Bridge < 1.4.2 - Administrator Account Creation via CSRFPublic exploitUnknown · Abilities Bridge | High8.8 |
| CVE-2026-126775 | Social-auth-core 4.7.0 before 7.0.0 Login CSRF via SAML RelayStatepython-social-auth · social-auth-core | Low2.3 |
| CVE-2026-77168 | A cross-site request forgery vulnerability in tracker-invocation.php in Revive Adserver 6.0.8 and earlier allows an attacker to modify a tracker's name,…Revive · Adserver | Medium4.3 |
| CVE-2026-125838 | WordPress Quality theme <= 3.3 - Cross Site Request Forgery (CSRF) vulnerabilitywebriti · Quality | High8.8 |
| CVE-2026-125839 | WordPress ElitePress theme <= 3.2.1 - Cross Site Request Forgery (CSRF) vulnerabilitywebriti · ElitePress | High8.8 |
| CVE-2026-125840 | WordPress Rambo theme <= 3.0 - Cross Site Request Forgery (CSRF) vulnerabilitywebriti · Rambo | High8.8 |
| CVE-2026-125841 | WordPress Heroic theme <= 1.4.2 - Cross Site Request Forgery (CSRF) vulnerabilitywebriti · Heroic | High8.8 |
| CVE-2026-125842 | WordPress Wallstreet Agency theme <= 1.3.4 - Cross Site Request Forgery (CSRF) vulnerabilitywebriti · Wallstreet Agency | High8.8 |
| CVE-2026-125843 | WordPress Spasalon theme <= 3.0 - Cross Site Request Forgery (CSRF) vulnerabilitywebriti · Spasalon | High8.8 |
| CVE-2026-125844 | WordPress vice theme <= 1.4 - Cross Site Request Forgery (CSRF) vulnerabilitywebriti · vice | High8.8 |
| CVE-2026-125845 | WordPress vdequator theme <= 1.2.7 - Cross Site Request Forgery (CSRF) vulnerabilitywebriti · vdequator | High8.8 |
| CVE-2026-125846 | WordPress Mazino theme <= 1.1 - Cross Site Request Forgery (CSRF) vulnerabilitywebriti · Mazino | High8.8 |
| CVE-2026-125847 | WordPress vdperanto theme <= 2.2 - Cross Site Request Forgery (CSRF) vulnerabilitywebriti · vdperanto | High8.8 |
| CVE-2026-125848 | WordPress Leo theme <= 1.7.4 - Cross Site Request Forgery (CSRF) vulnerabilitywebriti · Leo | High8.8 |
| CVE-2026-125849 | WordPress Shk Corporate theme <= 2.4.3 - Cross Site Request Forgery (CSRF) vulnerabilitywebriti · Shk Corporate | High8.8 |
| CVE-2026-125850 | WordPress Appointment Dark theme <= 1.3.4 - Cross Site Request Forgery (CSRF) vulnerabilitywebriti · Appointment Dark | High8.8 |
| CVE-2026-118411 | Apache Roller: Cross-site request forgery through GET requests to administrative actionsApache Software Foundation · Apache Roller | High8.8 |
| CVE-2026-105154 | Apache Roller: Cross-site request forgery in Planet administration lets an attacker make the server fetch arbitrary URLsApache Software Foundation · Apache Roller | Medium6.1 |
| CVE-2026-124263 | WordPress Locatoraid Store Locator plugin <= 3.9.75 - Cross Site Request Forgery (CSRF) vulnerabilityplainware · Locatoraid Store Locator | Medium5.4 |
| CVE-2026-125446 | WordPress Edwiser Bridge plugin <= 4.3.4 - Cross Site Request Forgery (CSRF) vulnerabilityWisdmLabs · Edwiser Bridge | High8.8 |
| CVE-2026-125445 | WordPress VOD Infomaniak plugin <= 1.5.16 - Cross Site Request Forgery (CSRF) vulnerabilityInfomaniak Network · VOD Infomaniak | Medium4.3 |
| CVE-2026-121770 | WordPress VISeek plugin <= 1.0.5 - Cross Site Request Forgery (CSRF) vulnerabilityVillaTheme · VISeek | Medium5.4 |
| CVE-2026-125784 | WordPress RestroPress plugin <= 3.4.11 - Cross Site Request Forgery (CSRF) vulnerabilityMagnigenie · RestroPress | High8.8 |
| CVE-2026-121472 | AutomatorWP < 6.0.8 - Zoom/AWeber Integration Connection Hijack via CSRFPublic exploitUnknown · AutomatorWP | Medium5.0 |
| CVE-2026-126067 | Action Pack: Missing SameSite attribute on session cookies from Action Pack session storesrails · rails | Low3.1 |
| CVE-2026-125339 | Winter CMS: CSRF through AJAX handler names reachable as backend page actionswintercms · winter | Medium6.1 |
| CVE-2026-118152 | Microsoft Exchange Server Spoofing VulnerabilityMicrosoft · Microsoft Exchange Server Subscription Edition RTM | Medium6.5 |
| CVE-2026-109481 | ASP.NET Core Elevation of Privilege VulnerabilityMicrosoft · .NET 11.0 installed on Linux | High7.5 |
| CVE-2026-124251 | WordPress WPIDE – File Manager & Code Editor plugin <= 3.6.4 - Cross Site Request Forgery (CSRF) vulnerabilityXplodedThemes · WPIDE – File Manager & Code Editor | High8.8 |
| CVE-2026-112137 | A vulnerability has been identified in Mendix Studio Pro 11 (All versions >= V11.15.0 < V11.16.0), Mendix Studio Pro 11.12 (All versions >= V11.12.6 <…Siemens · Mendix Studio Pro 11 | Medium5.1 |
| CVE-2026-60041 | CSRF in backendMB connect line · mbCONNECT24 | Medium5.3 |
| CVE-2026-120014 | Cross-Site Request Forgery (CSRF) vulnerability in SAP Web Dispatcher and Internet Communication ManagerSAP_SE · SAP Web Dispatcher and Internet Communication Manager | High7.6 |
| CVE-2026-89131 | Cross Site Request Forgery (CSRF) vulnerability in SAP NetWeaver Enterprise PortalSAP_SE · SAP NetWeaver Enterprise Portal | Medium4.3 |
| CVE-2026-89119 | Cross-Site Request Forgery (CSRF) vulnerability in SAP Web Dispatcher and Internet Communication ManagerSAP_SE · SAP Web Dispatcher and Internet Communication Manager | Critical9.6 |
| CVE-2026-125077 | SourceCodester Smart Attendance System with QR Code Scanner cross-site request forgeryPublic exploitSourceCodester · Smart Attendance System with QR Code Scanner | Medium5.3 |
| CVE-2026-119755 | Tasmota 16.0.0 CSRF via Referer Header Validation Bypassarendst · Tasmota | High7.5 |
| CVE-2026-8640 | IBM Verify Directory is affected by multiple vulnerabilitiesIBM · Security Verify Directory | Low3.5 |
| CVE-2026-84229 | IBM Guardium Data Protection is affected by multiple vulnerabilitiesIBM · Guardium Data Protection | Medium6.5 |
| CVE-2026-14963 | IBM Cognos Command Center has addressed vulnerabilitiesIBM · Cognos Command Center | Medium4.3 |
| CVE-2026-123545 | OpenAM 14.5.1 before 16.1.4 CSRF in OAuth 2.0 Device FlowOpenIdentityPlatform · OpenAM | High7.1 |
| CVE-2026-123495 | Vikunja 2.0.0 before 2.7.1 Login CSRF via /api/v2 Login and OIDC Callbackgo-vikunja · vikunja | Medium5.1 |
| CVE-2026-123494 | Vikunja before 2.7.1 Login CSRF via Migration OAuth Callbacksgo-vikunja · vikunja | Medium5.1 |
| CVE-2026-121783 | WordPress WP Data Access plugin <= 5.5.90 - Cross Site Request Forgery (CSRF) vulnerabilityPassionate Programmer Peter · WP Data Access | Medium6.5 |
| CVE-2026-121762 | WordPress PowerPress Podcasting plugin <= 11.18.0 - Cross Site Request Forgery (CSRF) vulnerabilityBlubrry Podcasting · PowerPress Podcasting | High8.8 |