Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 1 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 402,137All CVEsplus 19,141 rejected
- 330Last 24 hours3,295 in the last 7 days
- 16,931Last 30 days1,560 of them critical
- 1,769Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 9 | 24 | 14 | 0 | 0 | 47 | 77 |
| 2025 | 0 | 0 | 2 | 0 | 0 | 2 | 30 |
| 2024 | 1 | 1 | 0 | 0 | 0 | 2 | 28 |
| 2023 | 7 | 1 | 11 | 1 | 0 | 20 | 26 |
| 2022 | 0 | 1 | 4 | 1 | 0 | 6 | 6 |
| Title | ||
|---|---|---|
| CVE-2026-121436 | Froxlor 2.3.8 before 2.3.15 API Key Disclosure via api_keys.phpfroxlor · froxlor | High8.6 |
| CVE-2026-121435 | Froxlor before 2.3.15 Authorization Bypass via Mysqls.add APIfroxlor · froxlor | Medium5.3 |
| CVE-2026-121434 | Froxlor 2.3.0 before 2.3.15 Authorization Bypass via Certificates.update APIPublic exploitfroxlor · froxlor | Medium5.3 |
| CVE-2026-113678 | Froxlor before 2.3.15 Symlink Following Privilege Escalation via Traffic CronPublic exploitfroxlor · froxlor | Critical9.4 |
| CVE-2026-113677 | Froxlor 0.10.0 before 2.3.15 Missing Authorization via SubDomains.delete APIPublic exploitfroxlor · froxlor | Medium5.3 |
| CVE-2026-113676 | Froxlor 0.10.0 before 2.3.15 Authorization Bypass via Admins.get APIPublic exploitfroxlor · froxlor | Medium5.3 |
| CVE-2026-109963 | Froxlor before 2.3.14 IDOR in Email Template Editor via admin_templates.phpPublic exploitfroxlor · froxlor | Medium5.3 |
| CVE-2026-109962 | Froxlor 0.10.0 before 2.3.14 Missing Authorization in MysqlServer and Cronjobs APIPublic exploitfroxlor · froxlor | Medium5.3 |
| CVE-2026-109961 | Froxlor 0.10.0 before 2.3.14 Newline Injection via Ftps.add additional_membersPublic exploitfroxlor · froxlor | High8.4 |
| CVE-2026-109960 | Froxlor 2.0.0 before 2.3.14 Stored XSS via Customer Theme ValuePublic exploitfroxlor · froxlor | High8.7 |
| CVE-2026-100720 | Froxlor before 2.3.12 Stored XSS via SSL certificate issuerfroxlor · froxlor | Critical9.3 |
| CVE-2026-100719 | Froxlor before 2.3.12 Credential Disclosure via DirProtections APIfroxlor · froxlor | High7.1 |
| CVE-2026-100718 | Froxlor before 2.3.12 Authentication Bypass via EmailSender.addfroxlor · froxlor | High7.1 |
| CVE-2026-100717 | froxlor before 2.3.12 CRLF Injection via validateUrl userinfofroxlor · froxlor | High8.5 |
| CVE-2026-100716 | Froxlor before 2.3.12 Privilege Escalation via SymlinkPublic exploitfroxlor · froxlor | Critical9.4 |
| CVE-2026-100715 | Froxlor before 2.3.12 Arbitrary File Deletion via SymlinkPublic exploitfroxlor · froxlor | High8.5 |
| CVE-2026-100714 | Froxlor before 2.3.12 Command Injection via letsencryptchallengepathfroxlor · froxlor | Critical9.4 |
| CVE-2026-100713 | Froxlor before 2.3.12 Privilege Escalation via SSH Key Syncfroxlor · froxlor | High7.1 |
| CVE-2026-100712 | froxlor before 2.3.12 Two-Factor Authentication Bypass via CSRFPublic exploitfroxlor · froxlor | High7.1 |
| CVE-2026-100711 | froxlor before 2.3.12 Authentication Bypass via Session PersistencePublic exploitfroxlor · froxlor | High8.7 |
| CVE-2026-100710 | Froxlor before 2.3.12 DKIM Private Key Disclosure via APIfroxlor · froxlor | Medium6.9 |
| CVE-2026-100709 | Froxlor before 2.3.11 2FA Bypass via Namespace Confusionfroxlor · froxlor | High7.7 |
| CVE-2026-100708 | Froxlor before 2.3.13 Private Key Disclosure via Certificates APIPublic exploitfroxlor · froxlor | High7.1 |
| CVE-2026-90937 | froxlor before 2.2.5 nginx/Apache Configuration Injection via subdomain redirect URLfroxlor · froxlor | Critical9.4 |
| CVE-2026-90936 | Froxlor before 2.3.7 Information Disclosure via customer_email.phpPublic exploitfroxlor · froxlor | Medium5.3 |
| CVE-2026-90935 | Froxlor before 2.3.7 Authorization Bypass via Mysqls.add APIPublic exploitfroxlor · froxlor | Medium5.3 |
| CVE-2024-58383 | Froxlor before 2.2.0 Insecure File Permissions mysql.confPublic exploitfroxlor · froxlor | High8.4 |
| CVE-2026-90767 | Froxlor before 2.3.12 SSH Key Injection via authorized_keysPublic exploitfroxlor · Froxlor | High7.1 |
| CVE-2026-55593 | Froxlor: CSRF Vulnerability in Froxlor AJAX Endpoint — Missing Cross-Site Request Forgery Protectionfroxlor · froxlor | Medium6.5 |
| CVE-2026-54347 | Froxlor: Stored XSS in DNS TXT Record Content Allows Customer-to-Admin Account Takeoverfroxlor · froxlor | High8.7 |
| CVE-2026-54348 | Froxlor: Second-Order SQL Injection via `Admins.add` `ipaddress` Parameter Allows Full Database ExfiltrationPublic exploitfroxlor · froxlor | High7.2 |
| CVE-2026-54543 | Froxlor DomainZones.add allows DNS zone-file RR injection via record/type fieldsfroxlor · froxlor | Medium5.4 |
| CVE-2026-62988 | Froxlor: Credential and 2FA secret disclosure via Froxlor API endpointsPublic exploitfroxlor · froxlor | Critical9.0 |
| CVE-2026-52793 | Froxlor: API Authentication bypasses 2FA AuthenticationPublic exploitfroxlor · froxlor | High8.1 |
| CVE-2026-41237 | Froxlor has an incomplete fix for CVE-2026-30932Public exploitfroxlor · froxlor | High8.6 |
| CVE-2026-41236 | Froxlor has privilege escalation in SSH key synchronization via symlinked `authorized_keys` pathPublic exploitfroxlor · froxlor | High8.8 |
| CVE-2026-41235 | Froxlor has an authorization bypass in FTP shell assignment via missing server-side `available_shells` enforcementPublic exploitfroxlor · froxlor | High8.6 |
| CVE-2026-41234 | Froxlor: BIND Zone File Injection via TXT Record ContentPublic exploitfroxlor · froxlor | High7.6 |
| CVE-2026-41233 | Froxlor has a Reseller Domain Quota Bypass via Unvalidated adminid Parameter in Domains.add()Public exploitfroxlor · froxlor | Medium5.4 |
| CVE-2026-41232 | Froxlor has an Email Sender Alias Domain Ownership Bypass via Wrong Array Index that Allows Cross-Customer Email SpoofingPublic exploitfroxlor · froxlor | Medium5.0 |
| CVE-2026-41231 | Froxlor has Incomplete Symlink Validation in DataDump.add() that Allows Arbitrary Directory Ownership Takeover via CronPublic exploitfroxlor · froxlor | High7.5 |
| CVE-2026-41230 | Froxlor has a BIND Zone File Injection via Unsanitized DNS Record Content in DomainZones::add()Public exploitfroxlor · froxlor | High8.5 |
| CVE-2026-41229 | Froxlor has a PHP Code Injection via Unescaped Single Quotes in userdata.inc.php Generation (MysqlServer API)Public exploitfroxlor · froxlor | Critical9.1 |
| CVE-2026-41228 | Froxlor has Local File Inclusion via path traversal in API `def_language` parameter that leads to Remote Code ExecutionPublic exploitfroxlor · froxlor | Critical10.0 |
| CVE-2026-30932 | Froxlor is vulnerable to BIND zone file injection via unsanitized DNS record content in DomainZones APIPublic exploitfroxlor · froxlor | High8.6 |
| CVE-2026-26279 | Froxlor Admin-to-Root Privilege Escalation via Input Validation Bypass + OS Command Injectionfroxlor · Froxlor | Critical9.1 |
| CVE-2020-36978 | Froxlor Froxlor Server Management Panel 0.10.16 - Persistent Cross-Site ScriptingPublic exploitFroxlor · Froxlor Froxlor Server Management Panel | Medium5.1 |
| CVE-2025-48958 | Froxlor has an HTML Injection VulnerabilityPublic exploitfroxlor · Froxlor | Medium5.5 |
| CVE-2025-29773 | Froxlor allows Multiple Accounts to Share the Same Email Address Leading to Potential Privilege Escalation or Account TakeoverPublic exploitfroxlor · Froxlor | Medium5.8 |
| CVE-2024-34070 | Froxlor Vulnerable to Blind XSS Leading to Froxlor Application CompromisePublic exploitfroxlor · Froxlor | Critical9.7 |