Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 2 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 404,765All CVEsplus 19,157 rejected
- 2,035Last 24 hours4,675 in the last 7 days
- 18,860Last 30 days1,625 of them critical
- 1,779Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 155 | 541 | 1,266 | 228 | 3 | 2,193 | 6,263 |
| 2025 | 21 | 105 | 412 | 59 | 0 | 597 | 4,070 |
| 2024 | 33 | 121 | 604 | 16 | 0 | 774 | 3,473 |
| 2023 | 52 | 165 | 710 | 9 | 0 | 936 | 2,699 |
| 2022 | 89 | 200 | 825 | 11 | 0 | 1,125 | 1,763 |
| 2021 | 38 | 149 | 436 | 1 | 0 | 624 | 638 |
| 2020 | 0 | 0 | 0 | 0 | 0 | 0 | 14 |
| 2019 | 0 | 1 | 0 | 0 | 0 | 1 | 14 |
| 2018 | 6 | 6 | 1 | 0 | 0 | 13 | 13 |
| Title | ||
|---|---|---|
| CVE-2026-106025 | Cargo Shipping Location for WooCommerce 4.0.0 - 5.7.1 - Unauthenticated Order Status ManipulationPublic exploitUnknown · Cargo Shipping Location for WooCommerce | Medium5.3 |
| CVE-2026-106007 | FraudLabs Pro SMS Verification <= 1.12.1 - Unauthenticated Unrestricted SMS Sending via wp_sms_action_sendPublic exploitUnknown · FraudLabs Pro SMS Verification | Medium5.3 |
| CVE-2026-119273 | BulletProof Security <= 7.2 - Unauthenticated Sensitive Data Disclosure via Security LogPublic exploitUnknown · BulletProof Security | Not scored |
| CVE-2026-110516 | All in One Visual Composer Addons <= 1.2 - Contributor+ LFI via vca_tabs_style Shortcode AttributePublic exploitUnknown · All in One Addons For WPBakery Page Builder (formerly Visual Composer) | Not scored |
| CVE-2026-104676 | Zion Builder <= 3.6.17 - Author+ Stored XSS via SVG UploadPublic exploitUnknown · Zion Builder | Not scored |
| CVE-2026-106008 | FraudLabs Pro SMS Verification 1.11.2 - 1.12.1 - Unauthenticated SMS Verification Bypass via wc_sms_action_verifiedPublic exploitUnknown · FraudLabs Pro SMS Verification | Medium5.3 |
| CVE-2026-115252 | Confection 0.4.0 - 0.4.7 - Unauthenticated RCE via Write Key OptionPublic exploitUnknown · Confection WordPress Cable | Critical10.0 |
| CVE-2026-106466 | JWT Auth <= 3.0.2 - Unauthenticated Account Access Persistence via Insufficient Refresh Token RevocationPublic exploitUnknown · JWT Auth | High7.5 |
| CVE-2026-81422 | Advanced Appointment Booking & Scheduling < 2.7 - Unauthenticated Arbitrary User RegistrationPublic exploitUnknown · Advanced Appointment Booking & Scheduling | Medium5.3 |
| CVE-2026-123751 | WP Duplicate <= 1.1.11 - Unauthenticated Arbitrary File Upload via Authentication BypassPublic exploitUnknown · WP Duplicate | Critical9.8 |
| CVE-2026-123145 | WooCommerce Stripe Payment Gateway 10.9.0 - 11.0.1 - Customer Password Stored in Plaintext via Express CheckoutPublic exploitUnknown · WooCommerce Stripe Payment Gateway | Medium4.4 |
| CVE-2026-123131 | GemBooking < 1.7.1 - Staff+ Arbitrary Post Deletion and Site Settings Update via REST Context Check BypassPublic exploitUnknown · GemBooking | Medium5.9 |
| CVE-2026-123129 | Event Tickets Manager for WooCommerce 1.5.4 - 1.5.9 - Unauthenticated Site-wide Event Ticket Price ManipulationPublic exploitUnknown · Event Tickets Manager for WooCommerce | Medium5.3 |
| CVE-2026-123128 | GemBooking < 1.7.1 - Unauthenticated Team Member Double-Booking via Cross-Object Race ConditionPublic exploitUnknown · GemBooking | Low3.7 |
| CVE-2026-123091 | Vigilant < 2.11.0 - 2FA Bypass via Third-Party Login FormsPublic exploitUnknown · Vigilant | High7.5 |
| CVE-2026-123088 | UniPAY Payment Gateway For WooCommerce < 2.4 - Unauthenticated Order Key and Customer PII DisclosurePublic exploitUnknown · UniPAY Payment Gateway For WooCommerce | Medium5.3 |
| CVE-2026-123064 | WP BASE Booking of Appointments, Services and Events 6.5.0 - Subscriber+ Privilege EscalationPublic exploitUnknown · WP BASE Booking of Appointments, Services and Events | High8.8 |
| CVE-2026-121875 | Post Duplicator < 3.0.18 - Admin+ Privilege Escalation via Unvalidated Capability AssignmentPublic exploitUnknown · Post Duplicator | High7.2 |
| CVE-2026-121874 | Post Duplicator < 3.0.18 - Admin+ Arbitrary Option Update via Unvalidated Option NamePublic exploitUnknown · Post Duplicator | High7.2 |
| CVE-2026-121759 | Fusion Page Builder < 1.7.1 - Contributor+ Arbitrary Post Trashing via IDORPublic exploitUnknown · Fusion Page Builder | Medium4.9 |
| CVE-2026-120409 | All-in-One Video Gallery < 5.1.1 - Unauthenticated Password-Protected Video Disclosure via Player Page and Download HandlerPublic exploitUnknown · All-in-One Video Gallery | Medium5.3 |
| CVE-2026-118202 | Limit Login Attempts Reloaded < 3.4.1 - Two-Factor Authentication Bypass via Malformed X-Forwarded-For HeaderPublic exploitUnknown · Limit Login Attempts Security | High7.5 |
| CVE-2026-118201 | Limit Login Attempts Reloaded 3.0.0 - 3.4.0 - Two-Factor Authentication Bypass via XML-RPCPublic exploitUnknown · Limit Login Attempts Security | High7.5 |
| CVE-2026-115256 | Mail Debug for WooCommerce <= 1.3.0 - Unauthenticated Sent Email Disclosure Leading to Account TakeoverPublic exploitUnknown · Mail Debug for WooCommerce | High7.5 |
| CVE-2026-115237 | Grand Job <= 1.2.1 - Unauthenticated Account Takeover via Empty Password Reset CodePublic exploitUnknown · Grand Job | Critical9.8 |
| CVE-2026-115213 | EASY-JS-WPAPI <= 2.0 - Unauthenticated Administrator Password Disclosure and Authentication BypassPublic exploitUnknown · EASY-JS-WPAPI Client HANDLE for the WordPress REST-API | Critical9.8 |
| CVE-2026-115212 | mView <= 1.0.3 - Subscriber+ Arbitrary File UploadPublic exploitUnknown · mView 豆瓣电影 | High8.8 |
| CVE-2026-115204 | AZEXO Store Locator <= 1.4 - Subscriber+ Arbitrary File Write via azt_items_importPublic exploitUnknown · AZEXO Store Locator | High8.8 |
| CVE-2026-110963 | Userplace <= 1.2.0 - Unauthenticated Privilege EscalationPublic exploitUnknown · Userplace | Critical9.8 |
| CVE-2026-110132 | Sync Post With Other Site 1.9.3 - Contributor+ Arbitrary Custom Post Type Creation and ModificationPublic exploitUnknown · Sync Post With Other Site | Medium4.9 |
| CVE-2026-109925 | Productive Commerce < 1.1.54 - Unauthenticated SQLi via Wishlist and Compare HandlersPublic exploitUnknown · Productive Commerce | High8.6 |
| CVE-2026-106015 | Ecommerce Affiliate <= 1.0.0 - Unauthenticated Account Takeover via Email OTP Brute ForcePublic exploitUnknown · Ecommerce Affiliate | High8.1 |
| CVE-2026-105970 | BCK Auto-confirm Bank Transfer <= 2.0.1 - Unauthenticated WooCommerce Order Payment ConfirmationPublic exploitUnknown · Thanh Toán Quét Mã QR Code Tự Động | Medium5.3 |
| CVE-2026-104639 | Razorpay for WooCommerce < 4.8.9 - Admin+ SQLi via WebhookPublic exploitUnknown · Razorpay for WooCommerce | Medium4.1 |
| CVE-2026-104338 | Razorpay for WooCommerce < 4.8.9 - Unauthenticated User Context Switch via 1cc Coupon RoutePublic exploitUnknown · Razorpay for WooCommerce | Low3.7 |
| CVE-2026-104337 | Razorpay for WooCommerce < 4.8.9 - Unauthenticated Order Data Disclosure via 1CC Coupon ApplyPublic exploitUnknown · Razorpay for WooCommerce | Medium5.3 |
| CVE-2026-104307 | BackUpWordPress < 3.15 - Subscriber+ Backup Directory File Deletion via hmbkp_dismiss_errorPublic exploitUnknown · BackUpWordPress | Medium5.4 |
| CVE-2026-103303 | Turisbook Booking System <= 1.3.8 - Unauthenticated Stored XSS via Cart Background SettingPublic exploitUnknown · Turisbook Booking System | High8.8 |
| CVE-2026-114432 | Contact Form 7 6.2 - 6.2.3 - Unauthenticated Arbitrary File Upload via Invalid UTF-8 FilenamePublic exploitUnknown · Contact Form 7 | Critical9.8 |
| CVE-2026-96963 | Pie Register <= 3.8.4.15 - Contributor+ Invitation Code ModificationPublic exploitUnknown · Pie Register | Low2.7 |
| CVE-2026-96961 | Pie Register <= 3.8.4.15 - Unauthenticated Plugin Settings Reset and Redirect Data DestructionPublic exploitUnknown · Pie Register | Medium6.5 |
| CVE-2026-103375 | Antom Payments <= 2.0.11 - Unauthenticated WooCommerce Order Data DisclosurePublic exploitUnknown · Antom Payments | Medium5.3 |
| CVE-2026-97195 | Secure Custom Fields < 6.9.8 - Admin+ Stored XSS via HTML Attribute Name Injection into Field DefinitionPublic exploitUnknown · Secure Custom Fields | Low3.5 |
| CVE-2026-97194 | Secure Custom Fields < 6.9.8 - Contributor+ Unpublished Post Title and Status Disclosure via Relational FieldsPublic exploitUnknown · Secure Custom Fields | Low2.7 |
| CVE-2026-97193 | Secure Custom Fields < 6.9.8 - Contributor+ Relationship Field Update on Arbitrary Objects via IDORPublic exploitUnknown · Secure Custom Fields | Low2.7 |
| CVE-2026-97192 | Secure Custom Fields < 6.9.8 - Contributor+ Admin-Restricted Custom Field Update via Post Save PathPublic exploitUnknown · Secure Custom Fields | Low2.7 |
| CVE-2026-85344 | FV Player < 7.5.57.7212 - Subscriber+ Bulk Post Modification via Missing AuthorizationPublic exploitUnknown · FV Flowplayer Video Player | Medium4.3 |
| CVE-2026-122085 | Event Tickets Manager for WooCommerce < 1.6.0 - Unauthenticated Ticket Transfer and Attendee PII DisclosurePublic exploitUnknown · Event Tickets Manager for WooCommerce | Medium6.5 |
| CVE-2026-122062 | Pronamic Pay & Pronamic Pay doneren met Mollie - Unauthenticated Form Submission Disclosure via REST APIPublic exploitUnknown · Pronamic Pay | Medium5.3 |
| CVE-2026-122060 | WP Recipe Maker < 10.9.2 - Unauthenticated Password-Protected Recipe DisclosurePublic exploitUnknown · WP Recipe Maker | Medium5.3 |