Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 5 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 406,586All CVEsplus 19,172 rejected
- 65Last 24 hours4,783 in the last 7 days
- 16,378Last 30 days1,441 of them critical
- 1,781Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 1 | 14 | 36 | 3 | 0 | 54 | 68 |
| 2025 | 0 | 1 | 0 | 0 | 0 | 1 | 14 |
| 2024 | 2 | 0 | 0 | 1 | 0 | 3 | 13 |
| 2023 | 0 | 0 | 6 | 0 | 0 | 6 | 10 |
| 2022 | 0 | 1 | 0 | 0 | 0 | 1 | 4 |
| 2021 | 1 | 1 | 0 | 0 | 0 | 2 | 3 |
| 2020 | 0 | 1 | 0 | 0 | 0 | 1 | 1 |
| Title | ||
|---|---|---|
| CVE-2026-117554 | Admidio before 5.0.17 Event Guest Restriction Bypass via events_function.phpPublic exploitadmidio · admidio | Medium5.3 |
| CVE-2026-111916 | Admidio before 5.0.16 Information Disclosure via rss/links.php Weblinks FeedPublic exploitAdmidio · admidio | Medium6.9 |
| CVE-2026-111914 | Admidio 5.0.11 before 5.0.16 Broken Access Control via inventory_data.phpPublic exploitAdmidio · admidio | High7.1 |
| CVE-2026-111913 | Admidio 5.0.0 before 5.0.16 Authorization Bypass via pdfl Mode in lists_show.phpPublic exploitAdmidio · admidio | Medium5.3 |
| CVE-2026-111912 | Admidio 5.0.0 before 5.0.16 IDOR via Forum Topic UpdateAdmidio · admidio | High7.1 |
| CVE-2026-109329 | Admidio 4.3.2 through 4.3.17 and 5.0.0 before 5.0.15 Cross-Organization Access Control Bypass via members_assignment.phpAdmidio · admidio | High8.5 |
| CVE-2026-109328 | Admidio 5.0.0 before 5.0.15 Unauthenticated Stored XSS via Registration NamePublic exploitAdmidio · admidio | Medium5.3 |
| CVE-2026-109327 | Admidio 4.0.12 through 4.3.17 and 5.0.0 before 5.0.15 Reflected XSS via system/redirect.phpPublic exploitAdmidio · admidio | Medium5.1 |
| CVE-2026-53760 | Admidio: CSRF on Plugin Install, Uninstall, and Update via Unprotected GET RequestsPublic exploitAdmidio · admidio | Medium5.2 |
| CVE-2026-82658 | Admidio before 5.0.12 Broken Access Control via profile_function.phpPublic exploitAdmidio · admidio | Medium5.3 |
| CVE-2026-82657 | Admidio before 5.0.12 Authentication Bypass via RSS feedsPublic exploitAdmidio · admidio | High8.7 |
| CVE-2026-82656 | Admidio before 5.0.12 Path Traversal via Photo ZIP DownloadAdmidio · admidio | Low2.1 |
| CVE-2026-82655 | Admidio before 5.0.12 SQL Injection via relation_type_listPublic exploitAdmidio · admidio | High8.7 |
| CVE-2026-47234 | Admidio writes session IDs and auto-login cookie values to application logsAdmidio · admidio | Medium4.4 |
| CVE-2026-47233 | Admidio: Any logged-in user can delete inventory fields via `mode=field_delete` — incomplete fix of #2024Public exploitAdmidio · admidio | Medium6.5 |
| CVE-2026-47232 | Admidio PKCS#12 private key export action lacks CSRF protectionPublic exploitAdmidio · admidio | Medium4.3 |
| CVE-2026-47231 | Admidio has IDOR in `documents-files.php` `mode=move_save` that lets any folder-uploader exfiltrate files from private foldersPublic exploitAdmidio · admidio | High8.1 |
| CVE-2026-47230 | Admidio: IDOR in documents-files.php allows cross-folder file rename and description changes by unauthorized uploadersAdmidio · admidio | Medium6.5 |
| CVE-2026-47229 | Admidio: CSRF in SSO client `enable` action toggles SAML/OIDC clients without token validationPublic exploitAdmidio · admidio | Medium5.4 |
| CVE-2026-47228 | Admidio's CSRF in registration `send_login` mode resets arbitrary user passwordsPublic exploitAdmidio · admidio | Medium5.2 |
| CVE-2026-47227 | Admidio module-administrator can delete or reorder categories owned by other modules via dead authorization check in `modules/categories.php`Public exploitAdmidio · admidio | Medium6.5 |
| CVE-2026-47226 | Admidio: Authorization bypass in file_delete enables cross-folder file removal by authenticated users without delete privilegesAdmidio · admidio | Medium6.5 |
| CVE-2026-69094 | Admidio before 5.0.11 IDOR via save_temporary mylist_function.phpPublic exploitAdmidio · admidio | Medium5.3 |
| CVE-2026-69093 | Admidio before 5.0.11 CSRF via category-report preferencesPublic exploitAdmidio · admidio | High7.1 |
| CVE-2026-69092 | Admidio before 5.0.11 Reflected XSS via SSO/SAML EndpointPublic exploitAdmidio · admidio | Medium6.9 |
| CVE-2026-69091 | Admidio before 5.0.11 Authentication Bypass via forum.phpAdmidio · admidio | High8.7 |
| CVE-2026-69090 | Admidio before 5.0.11 Cross-Organization Role ModificationPublic exploitAdmidio · admidio | Medium6.9 |
| CVE-2018-25370 | Admidio 3.3.5 Cross-Site Request Forgery via roles_function.phpPublic exploitAdmidio · Admidio | Medium6.9 |
| CVE-2026-42194 | Incomplete fix for CVE-2026-32812: SSRF in admidioPublic exploitAdmidio · admidio | Medium6.8 |
| CVE-2026-41671 | Admidio: OIDC Token Introspection Endpoint Returns Active for All Tokens Without ValidationPublic exploitAdmidio · admidio | Medium6.8 |
| CVE-2026-41670 | Admidio: SAML Response Sent to Unvalidated Assertion Consumer Service URL from AuthnRequestPublic exploitAdmidio · admidio | High8.2 |
| CVE-2026-41669 | Admidio: SAML Signature Validation Result Ignored — Forged AuthnRequests and LogoutRequests ProcessedPublic exploitAdmidio · admidio | High8.2 |
| CVE-2026-41663 | Admidio: CSRF on Admin Preferences Triggers Unauthorized Backup, .htaccess Write, and Email SendPublic exploitAdmidio · admidio | Low3.5 |
| CVE-2026-41662 | Admidio: Missing Minimum Administrator Check in Role Membership RemovalPublic exploitAdmidio · admidio | Medium5.2 |
| CVE-2026-41661 | Admidio: Reflected XSS in msg_window.php via Square Bracket to HTML Tag ConversionPublic exploitAdmidio · admidio | Medium6.1 |
| CVE-2026-41660 | Admidio: Inverted 2FA Reset Authorization Check Lets Group Leaders Strip Admin TOTPPublic exploitAdmidio · admidio | High7.1 |
| CVE-2026-41659 | Admidio: Hidden Profile Field Values Leaked via Blind Search Oracle in Member AssignmentPublic exploitAdmidio · admidio | Low2.7 |
| CVE-2026-41658 | Admidio: Missing Authorization on Inventory Module Destructive Endpoints Allows Any Authenticated User to Delete ItemsPublic exploitAdmidio · admidio | Medium6.5 |
| CVE-2026-41657 | Admidio: Cross-Organization Member Data Exposure via Permission Check Mismatch in contacts_data.phpPublic exploitAdmidio · admidio | Medium4.9 |
| CVE-2026-41656 | Admidio: Path Traversal via Unvalidated `name` Parameter in Document Add Mode Enables Arbitrary Server File ReadPublic exploitAdmidio · admidio | Medium4.5 |
| CVE-2026-41655 | Admidio: Path Traversal in ECard Preview Allows Reading Arbitrary Server Files Including Database CredentialsPublic exploitAdmidio · admidio | Medium6.5 |
| CVE-2026-34384 | Admidio: Missing CSRF Protection on Registration Approval ActionsPublic exploitAdmidio · admidio | Medium4.5 |
| CVE-2026-34383 | Admidio: CSRF and Form Validation Bypass in Inventory Item Save via `imported` ParameterPublic exploitAdmidio · admidio | Medium4.3 |
| CVE-2026-34382 | Admidio: Missing CSRF Protection on Custom List Deletion in mylist_function.phpPublic exploitAdmidio · admidio | Medium4.6 |
| CVE-2026-34381 | Admidio: Unauthenticated Access to Role-Restricted documents via neutralized .htaccessPublic exploitAdmidio · admidio | High7.5 |
| CVE-2026-32813 | Admidio: Second-Order SQL Injection via List Configuration (lsc_special_field, lsc_sort, lsc_filter)Public exploitAdmidio · admidio | High8.0 |
| CVE-2026-32817 | Admidio is Missing Authorization and CSRF Protection on Document and Folder DeletionPublic exploitAdmidio · admidio | Critical9.1 |
| CVE-2026-32812 | Admidio Vulnerable to SSRF and Local File Read via Unrestricted URL Fetch in SSO Metadata EndpointPublic exploitAdmidio · admidio | Medium6.8 |
| CVE-2026-32757 | Admidio: HTMLPurifier Bypass in eCard Message Allows HTML Email InjectionPublic exploitAdmidio · admidio | Medium5.4 |
| CVE-2026-32756 | Admidio: Unrestricted File Upload via CSRF Token Validation Bypass in Documents & Files ModulePublic exploitAdmidio · admidio | High8.8 |