Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 3 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 403,061All CVEsplus 19,156 rejected
- 712Last 24 hours3,455 in the last 7 days
- 17,237Last 30 days1,545 of them critical
- 1,773Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 13 | 15 | 27 | 0 | 1 | 56 | 190 |
| 2025 | 52 | 14 | 63 | 5 | 0 | 134 | 134 |
| Title | ||
|---|---|---|
| CVE-2026-61719 | WeGIA: Stored Cross-Site Scripting (XSS) in "historico_prontuarios.php" via "textoProntuario" FieldPublic exploitLabRedesCefetRJ · WeGIA | High8.9 |
| CVE-2026-61673 | WeGIA: Stored DOM XSS in listar_despachos.php Allows Account TakeoverPublic exploitLabRedesCefetRJ · WeGIA | Medium6.3 |
| CVE-2026-61671 | WeGIA: Systemic IDOR + Missing CSRF — extract($_REQUEST) in All Controle ClassesPublic exploitLabRedesCefetRJ · WeGIA | High8.1 |
| CVE-2026-55684 | WeGIA: SQL Injection in html/socio/sistema/cadastro_cobrancas_geracao.phpLabRedesCefetRJ · WeGIA | Critical9.8 |
| CVE-2026-55682 | WeGIA: Session Fixation via User-Controlled PHPSESSID Cookie + DB_HOST Leak in html/seguranca/sessionStart.phpPublic exploitLabRedesCefetRJ · WeGIA | High8.1 |
| CVE-2026-55681 | WeGIA: SQL Injection in html/matPat/restaurar_produto_desocultar.php via id_produto parameterPublic exploitLabRedesCefetRJ · WeGIA | High8.8 |
| CVE-2026-55679 | WeGIA: Pre-auth Installer Injection Chain Enables Command Execution and Arbitrary PHP Code InjectionPublic exploitLabRedesCefetRJ · WeGIA | Medium6.5 |
| CVE-2026-55680 | WeGIA: Unauthenticated SQL Injection in cadastro_cobranca.php via "codigo" parameterLabRedesCefetRJ · WeGIA | Critical9.8 |
| CVE-2026-55683 | WeGIA: SQL Injection in html/socio/sistema/cadastro_cobranca.phpPublic exploitLabRedesCefetRJ · WeGIA | Critical9.8 |
| CVE-2026-54767 | WeGIA: Hardcoded Secret Key Backdoor — Mass Data Destruction via deletar_socios.phpPublic exploitLabRedesCefetRJ · WeGIA | Critical9.1 |
| CVE-2026-54671 | WeGIA: Authorization Bypass via Empty Resource Array in InternoControlePublic exploitLabRedesCefetRJ · WeGIA | High8.8 |
| CVE-2026-54670 | WeGIA: Unauthenticated Auth Bypass + Local File InclusionPublic exploitLabRedesCefetRJ · WeGIA | Critical9.1 |
| CVE-2026-76634 | WeGIA < 3.9.2 Insecure Direct Object Reference via profile_funcionario.phpPublic exploitLabRedesCefetRJ · WeGIA | High7.1 |
| CVE-2026-76633 | WeGIA < 3.9.2 Authorization Bypass Password Change via alterarSenhaLabRedesCefetRJ · WeGIA | High8.6 |
| CVE-2026-45335 | WeGIA: Middleware whitelist bypass → open redirect via InternoControle.nextPagePublic exploitLabRedesCefetRJ · WeGIA | Medium5.4 |
| CVE-2026-45027 | WeGIA: Use of Weak Password Hashing Algorithm (SHA-256, no salt) in html/login.phpPublic exploitLabRedesCefetRJ · WeGIA | Medium5.9 |
| CVE-2026-45026 | WeGIA: Stored XSS in html/atendido/processo_aceitacao.phpPublic exploitLabRedesCefetRJ · WeGIA | Medium6.8 |
| CVE-2026-45025 | WeGIA: Stored XSS in html/atendido/etapa_processo.phpPublic exploitLabRedesCefetRJ · WeGIA | Medium6.8 |
| CVE-2026-42873 | WeGIA: Error Handling Upload DocDependentePublic exploitLabRedesCefetRJ · WeGIA | None0.0 |
| CVE-2026-42872 | WeGIA: Reflected XSS in listar_arquivos_etapa.phpPublic exploitLabRedesCefetRJ · WeGIA | Medium6.1 |
| CVE-2026-42870 | WeGIA: Cross-Site Scripting (XSS) Stored endpoint 'informacao_adicional.php' parameter 'descricao'Public exploitLabRedesCefetRJ · WeGIA | Medium6.4 |
| CVE-2026-42871 | WeGIA: Error Handling familiar_docfamiliarPublic exploitLabRedesCefetRJ · WeGIA | Medium6.9 |
| CVE-2026-40286 | WeGIA has Cross-Site Scripting in Controle de ContribuiçãoPublic exploitLabRedesCefetRJ · WeGIA | High7.5 |
| CVE-2026-40285 | WeGIA has SQL Injection via Session Variable Override in DespachoControle.phpPublic exploitLabRedesCefetRJ · WeGIA | High8.8 |
| CVE-2026-40284 | WeGIA has stored XSS in listar_despachos.phpPublic exploitLabRedesCefetRJ · WeGIA | Medium6.8 |
| CVE-2026-40282 | WeGIA has stored XSS in intercorrencia_visualizar.phpPublic exploitLabRedesCefetRJ · WeGIA | Medium6.4 |
| CVE-2026-40283 | WeGIA has stored XSS in profile_paciente.phpPublic exploitLabRedesCefetRJ · WeGIA | Medium6.8 |
| CVE-2026-35475 | WeGIA - Open Redirect - backup redirection — Unvalidated $_GET['redirect']Public exploitLabRedesCefetRJ · WeGIA | Medium5.1 |
| CVE-2026-35474 | WeGIA - Open Redirect - atualizacao redirection - Unvalidated $_GET['redirect']Public exploitLabRedesCefetRJ · WeGIA | Medium5.1 |
| CVE-2026-35473 | WeGIA - Open Redirect - IentradaControle - listarId() - Unvalidated $_GET['nextPage']Public exploitLabRedesCefetRJ · WeGIA | Medium5.1 |
| CVE-2026-35399 | WeGIA has Stored XSS in backup file namesPublic exploitLabRedesCefetRJ · WeGIA | High8.5 |
| CVE-2026-35472 | WeGIA - Open Redirect - EstoqueControle - listarTodos() - Unvalidated $_GET['nextPage']Public exploitLabRedesCefetRJ · WeGIA | Medium5.1 |
| CVE-2026-35398 | WeGIA - Open Redirect - OrigemControle - listarTodos() & listarId_Nome() - Unvalidated $_GET['nextPage']Public exploitLabRedesCefetRJ · WeGIA | Medium5.1 |
| CVE-2026-35396 | WeGIA - Open Redirect - IsaidaControle - listarId() - Unvalidated $_GET['nextPage']Public exploitLabRedesCefetRJ · WeGIA | Medium5.1 |
| CVE-2026-35395 | WeGIA has a SQL Injection in DespachoDAO.php via id_memorando parameterPublic exploitLabRedesCefetRJ · WeGIA | High8.8 |
| CVE-2026-33991 | WeGIA has SQL Injection in deletar_tag.phpPublic exploitLabRedesCefetRJ · WeGIA | High8.8 |
| CVE-2026-33136 | WeGIA has Reflected Cross-Site Scripting (XSS) in `listar_memorandos_ativos.php` via `sccd` parameterPublic exploitLabRedesCefetRJ · WeGIA | Critical9.3 |
| CVE-2026-33135 | WeGIA has Reflected Cross-Site Scripting (XSS) in `novo_memorandoo.php` via `sccs` parameterPublic exploitLabRedesCefetRJ · WeGIA | Critical9.3 |
| CVE-2026-33134 | WeGIA has Authenticated Time-Based Blind SQL Injection in `restaurar_produto.php` via `id_produto` parameterPublic exploitLabRedesCefetRJ · WeGIA | Critical9.3 |
| CVE-2026-33133 | WeGIA has an arbitrary SQL execution vulnerability via crafted backup archiveLabRedesCefetRJ · WeGIA | High8.6 |
| CVE-2026-31896 | WeGIA has a Time-Based Blind SQL Injection in remover_produto_ocultar.phpPublic exploitLabRedesCefetRJ · WeGIA | Critical9.8 |
| CVE-2026-31895 | WeGIA has a SQL Injection via Direct Query Interpolation in restaurar_produto.phpPublic exploitLabRedesCefetRJ · WeGIA | High8.8 |
| CVE-2026-31894 | WeGIA affected by arbitrary file read via symlink in backup restoreLabRedesCefetRJ · WeGIA | Medium6.9 |
| CVE-2026-28411 | WeGIA Vulnerable to Authentication Bypass via `extract($_REQUEST)`Public exploitLabRedesCefetRJ · WeGIA | Critical9.8 |
| CVE-2026-28409 | WeGIA Vulnerable to Remote Code Execution (RCE) via OS Command InjectionPublic exploitLabRedesCefetRJ · WeGIA | Critical10.0 |
| CVE-2026-28408 | WeGIA lacks authentication verification in adicionar_tipo_docs_atendido.phpPublic exploitLabRedesCefetRJ · WeGIA | Critical9.8 |
| CVE-2026-23731 | WeGIA Clickjacking VulnerabilityPublic exploitLabRedesCefetRJ · WeGIA | Medium4.3 |
| CVE-2026-23730 | WeGIA has an Open Redirect Vulnerability in control.php Endpoint via nextPage Parameter (metodo=listarTodos, nomeClasse=ProdutoControle)Public exploitLabRedesCefetRJ · WeGIA | Medium4.8 |
| CVE-2026-23729 | WeGIA has an Open Redirect Vulnerability in control.php Endpoint via nextPage Parameter (metodo=listarDescricao, nomeClasse=ProdutoControle)Public exploitLabRedesCefetRJ · WeGIA | Medium4.8 |
| CVE-2026-23728 | WeGIA has an Open Redirect Vulnerability in control.php Endpoint via nextPage Parameter (metodo=listarTodos, nomeClasse=DestinoControle)Public exploitLabRedesCefetRJ · WeGIA | Medium4.8 |