Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 3 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 406,521All CVEsplus 19,172 rejected
- 735Last 24 hours5,166 in the last 7 days
- 16,846Last 30 days1,479 of them critical
- 1,781Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 247 | 2,297 | 5,692 | 205 | 39 | 8,480 | 49,648 |
| 2025 | 71 | 1,671 | 6,382 | 168 | 1 | 8,293 | 41,168 |
| 2024 | 94 | 1,079 | 5,892 | 300 | 3 | 7,368 | 32,875 |
| 2023 | 100 | 690 | 3,423 | 520 | 0 | 4,733 | 25,507 |
| 2022 | 96 | 235 | 2,608 | 289 | 2 | 3,230 | 20,774 |
| 2021 | 48 | 148 | 2,468 | 22 | 0 | 2,686 | 17,544 |
| 2020 | 41 | 120 | 1,990 | 18 | 0 | 2,169 | 14,858 |
| 2019 | 19 | 49 | 2,264 | 10 | 0 | 2,342 | 12,689 |
| 2018 | 6 | 36 | 1,971 | 8 | 0 | 2,021 | 10,347 |
| 2017 | 3 | 16 | 1,457 | 1 | 0 | 1,477 | 8,326 |
| 2016 | 0 | 7 | 463 | 2 | 0 | 472 | 6,849 |
| 2015 | 0 | 0 | 535 | 191 | 0 | 726 | 6,377 |
| 2014 | 0 | 4 | 813 | 210 | 0 | 1,027 | 5,651 |
| 2013 | 0 | 0 | 478 | 138 | 0 | 616 | 4,624 |
| 2012 | 0 | 1 | 614 | 114 | 0 | 729 | 4,008 |
| 2011 | 0 | 0 | 422 | 37 | 0 | 459 | 3,279 |
| 2010 | 0 | 0 | 525 | 69 | 0 | 594 | 2,820 |
| 2009 | 0 | 0 | 750 | 72 | 0 | 822 | 2,226 |
| 2008 | 0 | 1 | 750 | 52 | 0 | 803 | 1,404 |
| 2007 | 1 | 2 | 399 | 22 | 0 | 424 | 601 |
| 2006 | 0 | 0 | 107 | 11 | 0 | 118 | 177 |
| 2005 | 0 | 1 | 46 | 3 | 0 | 50 | 59 |
| 2004 | 0 | 0 | 3 | 0 | 0 | 3 | 9 |
| 2003 | 0 | 0 | 4 | 0 | 0 | 4 | 6 |
| 2002 | 0 | 0 | 2 | 0 | 0 | 2 | 2 |
| Title | ||
|---|---|---|
| CVE-2026-110199 | IBM ContextForge MCP Gateway is affected by a DOM-based cross-site scriptingIBM · ContextForge MCP Gateway | Medium4.8 |
| CVE-2026-9870 | IBM Cyber Fraud includes components with multiple known vulnerabilitiesIBM · Cyber Fraud | Medium6.1 |
| CVE-2026-128122 | SvelteKit: Prerendered redirect paths can inject arbitrary rules into the `_redirects` file generated by `@sveltejs/adapter-cloudflare`sveltejs · kit | Medium5.9 |
| CVE-2026-128116 | SvelteKit: Protocol-relative module import during server-side route resolution allows cross-origin script executionsveltejs · kit | Medium5.3 |
| CVE-2026-67444 | Hubleys: Stored XSS via unrestricted background-image upload, served with an attacker-chosen Content-Type and no CSP protectionknrdl · hubleys-dashboard | High7.1 |
| CVE-2026-129140 | paicoding 1.0.0 through 1.0.3 Stored XSS via SVG Image Uploaditwanger · paicoding | Medium5.1 |
| CVE-2026-129141 | paicoding 1.0.0 through 1.0.3 Stored XSS via JSON-LD Profile Descriptionitwanger · paicoding | Medium5.1 |
| CVE-2026-129142 | paicoding commit 766c48b through 903adce Stored XSS via Payment Notificationsitwanger · paicoding | Medium5.1 |
| CVE-2026-129154 | SurveyKing 1.13.0 through 1.13.2 Stored XSS via Response Survey Snapshotjavahuang · SurveyKing | Medium5.3 |
| CVE-2026-129155 | DjangoBlog 2.0.0.0 through 2.1.0.0 Stored XSS via Comment Sanitizer class_filterliangliangyy · DjangoBlog | Medium5.1 |
| CVE-2026-129156 | DjangoBlog commit d186b1c through 6134ed6 Stored XSS via Comment Reactionsliangliangyy · DjangoBlog | Medium5.1 |
| CVE-2026-129158 | ragent 1.1.0 Stored XSS via SVG Knowledge-Base Document Uploadnageoffer · ragent | Medium5.1 |
| CVE-2026-129163 | Dromara free-fs 2.0.1 through 2.3.1 Stored XSS via File Preview Endpointdromara · free-fs | Medium5.1 |
| CVE-2026-129168 | PMail 2.9.1 through 2.9.8 Stored XSS via Inline HTML AttachmentsJinnrry · PMail | Medium5.3 |
| CVE-2026-129169 | PMail 2.5.0 through 2.9.8 Stored XSS via /api/email/send HTML BodyJinnrry · PMail | Medium5.1 |
| CVE-2026-129170 | FileCodeBox 2.2.1 through 2.8.4 Stored XSS via Markdown Preview Parser Errorvastsa · FileCodeBox | Medium5.3 |
| CVE-2026-129172 | EdgeEver 1.9.0 before 2.13.0 Stored XSS via Backup Restore and Public Sharestianma-if · EdgeEver | Medium5.1 |
| CVE-2026-128069 | rails-html-sanitizer: Possible XSS via shared scrubber state in concurrent callsrails · rails-html-sanitizer | Medium4.7 |
| CVE-2026-63166 | Omnispace Agora Project 26.10.0 Stored XSS via CSV Import PreviewOmnispace · Agora Project | Medium5.3 |
| CVE-2026-119517 | WordPress Catna – Woo Name Your Price and Offers plugin <= 2.0.3 - Cross Site Scripting (XSS) vulnerabilityVillaTheme · Catna – Woo Name Your Price and Offers | High7.1 |
| CVE-2026-124410 | WordPress Translate and boost SEO – Automatic AI translation – wpLingua plugin <= 3.1.1 - Cross Site Scripting (XSS) vulnerabilitywpLingua Translation Service · Translate and boost SEO – Automatic AI translation – wpLingua | High7.1 |
| CVE-2026-124965 | WordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.7.16 - Cross Site Scripting (XSS) vulnerabilityrtCamp Inc. · rtMedia for WordPress, BuddyPress and bbPress | Medium6.5 |
| CVE-2026-124418 | WordPress WP Job Portal plugin <= 2.7.2 - Cross Site Scripting (XSS) vulnerabilityAhmad · WP Job Portal | Medium6.5 |
| CVE-2026-124272 | WordPress Salon booking system plugin <= 10.31.14 - Cross Site Scripting (XSS) vulnerabilityDimitri Grassi · Salon booking system | High7.1 |
| CVE-2026-124260 | WordPress WP Photo Album Plus plugin <= 9.3.06.001 - Cross Site Scripting (XSS) vulnerabilityJacob N. Breetvelt · WP Photo Album Plus | High7.1 |
| CVE-2026-124420 | WordPress Woody ad snippets plugin <= 2.7.10 - Cross Site Scripting (XSS) vulnerabilityThemeisle · Woody ad snippets | High7.1 |
| CVE-2026-125783 | WordPress Custom Post Types and Custom Fields creator – WCK plugin <= 2.4.0 - Cross Site Scripting (XSS) vulnerabilitymadalin.ungureanu · Custom Post Types and Custom Fields creator – WCK | High7.1 |
| CVE-2026-125856 | WordPress Dynamic User Directory plugin <= 2.4 - Cross Site Scripting (XSS) vulnerabilitySarah Giles · Dynamic User Directory | High7.1 |
| CVE-2026-125854 | WordPress Unbounce Landing Pages plugin <= 1.1.6 - Cross Site Scripting (XSS) vulnerabilityUnbounce · Unbounce Landing Pages | High7.1 |
| CVE-2026-125837 | WordPress Make theme <= 1.10.10 - Cross Site Scripting (XSS) vulnerabilitythethemefoundry · Make | High7.1 |
| CVE-2026-125452 | WordPress WPJAM Basic plugin <= 7.1.2 - Cross Site Scripting (XSS) vulnerabilityDenishua · WPJAM Basic | High7.1 |
| CVE-2026-125794 | WordPress Extension for Leaflet Map plugin <= 6.1.1 - Cross Site Scripting (XSS) vulnerabilityhupe13 · Extension for Leaflet Map | Medium6.5 |
| CVE-2026-125831 | WordPress PowerPack Lite for Beaver Builder plugin <= 1.3.2 - Cross Site Scripting (XSS) vulnerabilityIdeaBox Creations · PowerPack Lite for Beaver Builder | Medium6.5 |
| CVE-2026-125809 | WordPress myCred plugin <= 4.0.2 - Cross Site Scripting (XSS) vulnerabilitymyCred · myCred | Medium6.5 |
| CVE-2026-125835 | WordPress JetTabs plugin <= 2.3.5 - Cross Site Scripting (XSS) vulnerabilityCrocoblock · JetTabs | Medium6.5 |
| CVE-2026-125807 | WordPress HT Mega plugin <= 3.2.8 - Cross Site Scripting (XSS) vulnerabilityHTMega · HT Mega | Medium6.5 |
| CVE-2026-125824 | WordPress WP Go Maps plugin <= 10.1.10 - Cross Site Scripting (XSS) vulnerabilityWP Go Maps · WP Go Maps | Medium6.5 |
| CVE-2026-125800 | WordPress Spectra plugin <= 2.20.5 - Cross Site Scripting (XSS) vulnerabilityBrainstorm Force · Spectra | Medium6.5 |
| CVE-2026-125816 | WordPress MapSVG plugin <= 9.0.4 - Cross Site Scripting (XSS) vulnerabilityPT Norther Lights Production · MapSVG | Medium6.5 |
| CVE-2026-119518 | WordPress Royal Elementor Addons plugin <= 1.7.1070 - Cross Site Scripting (XSS) vulnerabilityWProyal · Royal Elementor Addons | Medium6.5 |
| CVE-2026-121721 | WordPress Gutenberg Blocks plugin <= 3.7.6 - Cross Site Scripting (XSS) vulnerabilityPublishPress · Gutenberg Blocks | Medium6.5 |
| CVE-2026-125833 | WordPress YITH WooCommerce Ajax Product Filter plugin <= 5.24.0 - Cross Site Scripting (XSS) vulnerabilityYITH · YITH WooCommerce Ajax Product Filter | Medium6.5 |
| CVE-2025-71462 | Zipline before 3.7.12 XSS via url parameter on login pagediced · zipline | Medium5.1 |
| CVE-2026-126269 | NocoDB before 2026.09.0 Stored XSS via Attachment MIME Typenocodb · nocodb | Critical9.3 |
| CVE-2026-126274 | NocoDB before 2026.08.0 Stored XSS via Table Deletion Dialognocodb · nocodb | Critical9.3 |
| CVE-2026-126279 | NocoDB before 2026.06.2 Stored XSS via AI Field Prompt Tooltipnocodb · nocodb | High7.0 |
| CVE-2026-126286 | NocoDB before 2026.08.0 Reflected XSS via ncRedirectUrl in PageLeavingWarning.vuenocodb · nocodb | High8.6 |
| CVE-2026-126305 | EspoCRM before 10.0.9 Stored XSS via Knowledge Base Article Attachmentsespocrm · espocrm | High8.5 |
| CVE-2026-126306 | EspoCRM before 10.0.8 Stored XSS via Malicious SVG Attachmentespocrm · espocrm | High8.6 |
| CVE-2026-126369 | Vvveb through 1.0.8.6 Stored XSS via sanitizeHTML() Blacklist Bypassgivanz · Vvveb | Medium5.1 |