Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 8 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 402,147All CVEsplus 19,142 rejected
- 214Last 24 hours3,231 in the last 7 days
- 16,929Last 30 days1,558 of them critical
- 1,769Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 15 | 33 | 237 | 41 | 1 | 327 | 576 |
| 2025 | 17 | 48 | 124 | 7 | 0 | 196 | 249 |
| 2024 | 3 | 2 | 4 | 0 | 0 | 9 | 53 |
| 2023 | 0 | 4 | 4 | 0 | 0 | 8 | 44 |
| 2022 | 1 | 3 | 7 | 0 | 0 | 11 | 36 |
| 2021 | 1 | 2 | 4 | 0 | 0 | 7 | 25 |
| 2020 | 2 | 1 | 1 | 0 | 0 | 4 | 18 |
| 2019 | 1 | 3 | 6 | 0 | 0 | 10 | 14 |
| 2018 | 0 | 1 | 0 | 0 | 0 | 1 | 4 |
| 2017 | 0 | 3 | 0 | 0 | 0 | 3 | 3 |
| Title | ||
|---|---|---|
| CVE-2026-110176 | File Force Download for Drupal 7 Access Bypass via Unconditional Download HeadersDrupal · File Force Download | High8.7 |
| CVE-2026-77152 | Field Collection for Drupal 7 access bypass via missing parent entity access checkDrupal · Field Collection for Drupal 7 | Medium5.3 |
| CVE-2026-107249 | Block AJAX - Highly critical - PHP object injection - SA-CONTRIB-2026-192Drupal · Block AJAX | Critical9.8 |
| CVE-2026-107250 | ECA Helper - Critical - Unsupported - SA-CONTRIB-2026-193Drupal · ECA Helper | Medium5.9 |
| CVE-2026-107251 | Entity Reference Manager (Merge entities) - Critical - Access bypass - SA-CONTRIB-2026-194Drupal · Entity Reference Manager (Merge entities) | Medium6.5 |
| CVE-2026-107252 | MathJax: LaTeX for Drupal - Critical - Cross site scripting - SA-CONTRIB-2026-195Drupal · MathJax: LaTeX for Drupal | Medium5.4 |
| CVE-2026-107253 | Orphans Media - Critical - Unsupported - SA-CONTRIB-2026-196Drupal · Orphans Media | Medium5.9 |
| CVE-2026-107254 | Authenticator Login Plus (2FA) - Critical - Improper authentication - SA-CONTRIB-2026-197Drupal · Authenticator Login Plus (2FA) | Medium4.8 |
| CVE-2026-107257 | Actstream - Critical - Access bypass - SA-CONTRIB-2026-198Drupal · Actstream | Medium6.5 |
| CVE-2026-107258 | Inline Entity Form Dialog - Moderately critical - Access bypass - SA-CONTRIB-2026-199Drupal · Inline Entity Form Dialog | Medium5.4 |
| CVE-2026-107259 | Linked Field - Moderately critical - Server-side template injection - SA-CONTRIB-2026-200Drupal · Linked Field | Medium5.4 |
| CVE-2026-107261 | Authenticator Login Plus (2FA) - Moderately critical - Improper authentication - SA-CONTRIB-2026-201Drupal · Authenticator Login Plus (2FA) | Medium4.2 |
| CVE-2026-107263 | Gutenberg - Moderately critical - Access bypass - SA-CONTRIB-2026-202Drupal · Gutenberg | Medium5.4 |
| CVE-2026-107264 | Inline Formatter Field - Moderately critical - Server-side template injection - SA-CONTRIB-2026-203Drupal · Inline Formatter Field | Medium5.4 |
| CVE-2026-107265 | Leaflet - Moderately critical - Cross site scripting - SA-CONTRIB-2026-204Drupal · Leaflet | Medium5.4 |
| CVE-2026-107266 | Views Share - Moderately critical - Access bypass - SA-CONTRIB-2026-205Drupal · Views Share | Medium5.3 |
| CVE-2026-96389 | Xray Audit - Moderately critical - Access bypass - SA-CONTRIB-2026-206Drupal · Xray Audit | Medium6.5 |
| CVE-2026-107268 | Two Factor Authentication - TFA / Passwordless Login - Moderately critical - Information disclosure - SA-CONTRIB-2026-207Drupal · Two Factor Authentication - TFA / Passwordless Login | Medium4.3 |
| CVE-2026-107267 | DKAN - Moderately critical - Access bypass - SA-CONTRIB-2026-208Drupal · DKAN | Medium5.3 |
| CVE-2026-107306 | Menu Link Attributes - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-209Drupal · Menu Link Attributes | Low3.8 |
| CVE-2026-107307 | SmartLinker AI - Moderately critical - Information disclosure - SA-CONTRIB-2026-210Drupal · SmartLinker AI | Medium4.3 |
| CVE-2026-107308 | Country - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-211Drupal · Country | Low3.1 |
| CVE-2026-107309 | Easy Breadcrumb - Moderately critical - Information disclosure - SA-CONTRIB-2026-212Drupal · Easy Breadcrumb | Low3.7 |
| CVE-2026-107310 | Freelinking - Moderately critical - Information Disclosure - SA-CONTRIB-2026-213Drupal · Freelinking | Medium4.3 |
| CVE-2026-107311 | Permissions by Term - Moderately critical - Information disclosure - SA-CONTRIB-2026-214Drupal · Permissions by Term | Low3.7 |
| CVE-2026-107312 | Examples for Developers - Less critical - Allocation of resources without limits or throttling - SA-CONTRIB-2026-215Drupal · Examples for Developers | Medium4.3 |
| CVE-2026-107255 | Restrict route by IP - Critical - Access bypass - SA-CONTRIB-2026-216Drupal · Restrict route by IP | High7.3 |
| CVE-2026-107262 | Advanced Filesystem - Moderately critical - Cross-Site Request Forgery - SA-CONTRIB-2026-217Drupal · Advanced Filesystem | Medium5.3 |
| CVE-2026-108097 | Drupal core - Critical - Remote code execution - SA-CORE-2026-014Drupal · Drupal core | High8.1 |
| CVE-2026-110738 | Gin Admin Theme - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-219Drupal · Gin Admin Theme | Medium6.5 |
| CVE-2026-108515 | Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-015Drupal · Drupal core | Medium6.5 |
| CVE-2026-108514 | Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-016Drupal · Drupal core | Medium6.5 |
| CVE-2026-108099 | Entity List - Critical - Remote code execution - SA-CONTRIB-2026-218Drupal · Entity List | High8.1 |
| CVE-2026-114523 | Ffmpeg Image Toolkit - Highly critical - Remote Code Execution - SA-CONTRIB-2026-220Drupal · Ffmpeg Image Toolkit | Critical9.8 |
| CVE-2026-114527 | UI Icons - Critical - Cross site scripting - SA-CONTRIB-2026-221Drupal · UI Icons | High7.1 |
| CVE-2026-114528 | Zero Point - Critical - Cross-site scripting - SA-CONTRIB-2026-222Drupal · Zero Point | High7.1 |
| CVE-2026-114526 | Black Hole - Critical - Cross-site scripting - SA-CONTRIB-2026-223Drupal · Black Hole | High7.1 |
| CVE-2026-114525 | ABC - Critical - Cross-site scripting - SA-CONTRIB-2026-224Drupal · ABC | High7.1 |
| CVE-2026-114524 | Custom Formatters - Critical - Remote code execution - SA-CONTRIB-2026-225Drupal · Custom Formatters | High7.2 |
| CVE-2026-114529 | CSV Field - Moderately critical - Cross site Scripting - SA-CONTRIB-2026-226Drupal · CSV Field | Medium6.5 |
| CVE-2026-114530 | Dopup - Critical - Information disclosure - SA-CONTRIB-2026-227Drupal · Dopup | Medium5.3 |
| CVE-2026-114531 | Swiper formatter - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-228Drupal · Swiper formatter | Medium6.5 |
| CVE-2026-107260 | Sector Distribution - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-229Drupal · Sector Distribution | Medium6.5 |
| CVE-2026-114532 | UI Icons - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-230Drupal · UI Icons | Medium6.5 |
| CVE-2026-114533 | Ágora Transparency Theme - Moderately critical - Information disclosure - SA-CONTRIB-2026-231Drupal · Ágora Transparency Theme | Medium5.3 |
| CVE-2026-114534 | Block Attributes - Moderately critical - Cross site Scripting - SA-CONTRIB-2026-232Drupal · Block Attributes | Medium5.9 |
| CVE-2026-114535 | Swiper formatter - Moderately critical - Information disclosure - SA-CONTRIB-2026-233Drupal · Swiper formatter | Medium5.3 |
| CVE-2026-114536 | USWDS Paragraph Components - Moderately critical - Cross site scripting - SA-CONTRIB-2026-234Drupal · USWDS Paragraph Components | Medium6.5 |
| CVE-2026-114537 | View Unpublished - Moderately critical - Access bypass - SA-CONTRIB-2026-235Drupal · View Unpublished | Medium5.3 |
| CVE-2026-114538 | Bootstrap - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-236Drupal · Bootstrap | High7.1 |