Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 6 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 406,598All CVEsplus 19,172 rejected
- 75Last 24 hours4,669 in the last 7 days
- 16,324Last 30 days1,438 of them critical
- 1,781Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 42 | 109 | 150 | 2 | 0 | 303 | 350 |
| 2025 | 4 | 3 | 0 | 0 | 0 | 7 | 47 |
| 2024 | 4 | 4 | 6 | 0 | 0 | 14 | 40 |
| 2023 | 0 | 3 | 0 | 0 | 0 | 3 | 26 |
| 2022 | 9 | 9 | 4 | 0 | 0 | 22 | 23 |
| 2021 | 0 | 1 | 0 | 0 | 0 | 1 | 1 |
| Title | ||
|---|---|---|
| CVE-2026-126810 | WWBN AVideo 29.1.0 through 29.7.1 Stored XSS via Channel RSS FeedPublic exploitWWBN · AVideo | Medium5.1 |
| CVE-2026-126809 | WWBN AVideo through 29.7.1 Missing Authorization via objects/import.json.phpWWBN · AVideo | Medium6.1 |
| CVE-2026-126806 | WWBN AVideo 14.3 through 29.7.1 Stored XSS via Video Source TagPublic exploitWWBN · AVideo | Critical9.3 |
| CVE-2026-126805 | WWBN AVideo through 29.7.1 Privilege Escalation via Encoder video_id_hashWWBN · AVideo | High8.6 |
| CVE-2026-126804 | WWBN AVideo 12.4 through 29.7.1 Path Traversal File Deletion via deleteImage.json.phpPublic exploitWWBN · AVideo | High7.2 |
| CVE-2026-126545 | WWBN AVideo through 29.7.1 Missing Authorization via get_api_tags APIPublic exploitWWBN · AVideo | Medium5.3 |
| CVE-2026-126544 | WWBN AVideo 6.5 through 29.7.1 Email Verification Bypass via User::verifyCode()WWBN · AVideo | Medium5.3 |
| CVE-2026-126543 | WWBN AVideo through 29.7.1 Wallet Credit Manipulation via PayPalYPT ipnV2.phpPublic exploitWWBN · AVideo | High8.7 |
| CVE-2026-126542 | WWBN AVideo 6.5 through 29.7.1 Authentication Bypass via Hybridauth Social LoginPublic exploitWWBN · AVideo | Critical9.3 |
| CVE-2026-126541 | WWBN AVideo through 29.7.1 Missing Authorization via Live Restream EndpointsPublic exploitWWBN · AVideo | High8.6 |
| CVE-2026-124424 | WWBN AVideo Path Traversal Arbitrary VTT File Write via receiveAsync.json.phpPublic exploitWWBN · AVideo | High7.1 |
| CVE-2026-123486 | WWBN AVideo 29.0 through 29.4.0 Race Condition in PayPal IPN Deduplication via ipn.phpPublic exploitWWBN · AVideo | Medium6.0 |
| CVE-2026-61575 | AVideo-Encoder vulnerable to stored DOM cross-site scripting through queue titlesWWBN · AVideo-Encoder | Medium4.7 |
| CVE-2026-61569 | AVideo-Encoder: pre-authentication streamer-login SQL injectionPublic exploitWWBN · AVideo-Encoder | High7.5 |
| CVE-2026-61571 | AVideo-Encoder: missing authentication on control and status endpointsPublic exploitWWBN · AVideo-Encoder | High7.3 |
| CVE-2026-61572 | AVideo-Encoder: unauthenticated full-response server-side request forgeryPublic exploitWWBN · AVideo-Encoder | High8.6 |
| CVE-2026-61573 | AVideo-Encoder: reflected cross-site scripting in the login interfaceWWBN · AVideo-Encoder | Medium6.1 |
| CVE-2026-61567 | AVideo-Encoder: unauthenticated command execution through streamer login trustPublic exploitWWBN · AVideo-Encoder | Critical10.0 |
| CVE-2026-61564 | AVideo-Encoder: unauthenticated installer PHP code injectionPublic exploitWWBN · AVideo-Encoder | Critical10.0 |
| CVE-2026-116800 | WWBN AVideo before 29.5.0 Local PHP File Inclusion via Accept-Language HeaderWWBN · AVideo | Medium6.9 |
| CVE-2026-116139 | WWBN AVideo 26.0 through 29.3.0 Stored XSS via Comment Markdown RenderingWWBN · AVideo | Medium5.1 |
| CVE-2026-114634 | WWBN AVideo before 29.4.0 Blind SSRF via getHeaderContentTypeFromURL RedirectWWBN · AVideo | Medium5.3 |
| CVE-2026-114633 | WWBN AVideo before 29.4.0 Incorrect Authorization via confirmDeleteUser.json.phpPublic exploitWWBN · AVideo | High7.0 |
| CVE-2026-114048 | WWBN AVideo before 24.0 CSRF via Legacy Playlist and Video EndpointsPublic exploitWWBN · AVideo | Medium5.1 |
| CVE-2026-105086 | WWBN AVideo 12.4 through 29.2.0 Stored XSS via Double-Encoded Video TitlePublic exploitWWBN · AVideo | Critical9.3 |
| CVE-2026-105089 | WWBN AVideo through 29.2.0 Stored XSS via trailer1 in YouPHPFlix2 TemplatesPublic exploitWWBN · AVideo | Critical9.3 |
| CVE-2026-100630 | AVideo before 29.1.0 Stored XSS via HTML Entity Bypass in trailer1 FieldPublic exploitWWBN · AVideo | Medium5.1 |
| CVE-2026-92915 | WWBN AVideo userVerifyEmail.php Unauthenticated Access ControlPublic exploitWWBN · AVideo | Medium6.9 |
| CVE-2026-92914 | AVideo LoginControl PGP Second Factor Authentication BypassWWBN · AVideo | High8.6 |
| CVE-2026-92913 | AVideo Weak PRNG Activation Code Authentication BypassPublic exploitWWBN · AVideo | Critical9.1 |
| CVE-2026-92912 | AVideo Cryptographically Weak PRNG via uniqid Stream KeyPublic exploitWWBN · AVideo | High8.3 |
| CVE-2026-92586 | AVideo through 29.0 Missing Authorization via comment API endpointPublic exploitWWBN · AVideo | Medium5.3 |
| CVE-2026-92585 | AVideo through 29.0 Missing Authorization Check via API Like EndpointPublic exploitWWBN · AVideo | Medium5.3 |
| CVE-2026-92584 | AVideo through 29.0 Stored Cross-Site Scripting via User-Agent HeaderPublic exploitWWBN · AVideo | Medium5.3 |
| CVE-2026-92583 | AVideo through 29.0 Rate Limit Bypass via Non-Atomic Counter IncrementPublic exploitWWBN · AVideo | Medium6.9 |
| CVE-2026-92582 | AVideo through 29.0 Broken Access Control via videoAddNew.json.php CSRF BypassWWBN · AVideo | High7.1 |
| CVE-2026-92581 | AVideo through 29.0 Like Counter Desynchronization via Array ParameterPublic exploitWWBN · AVideo | Medium5.3 |
| CVE-2026-92580 | AVideo through 29.0 CloneSite Stored Shell Injection via SSH Password CSRFPublic exploitWWBN · AVideo | High8.7 |
| CVE-2026-92579 | AVideo through 29.0 Broken Access Control via CSRF Exemption Basename CollisionPublic exploitWWBN · AVideo | Medium5.3 |
| CVE-2026-92578 | WWBN AVideo through 29.0 Authentication Bypass via Stored Password HashPublic exploitWWBN · AVideo | Critical9.2 |
| CVE-2026-92577 | AVideo through 29.0 API get_api_video Broken Access Control via clean_titleWWBN · AVideo | High8.7 |
| CVE-2026-91967 | AVideo through 29.0 Blind SSRF via getHeaderContentTypeFromURLPublic exploitWWBN · AVideo | Medium5.3 |
| CVE-2026-91966 | AVideo through 29.0 Unauthenticated SSRF via Host HeaderPublic exploitWWBN · AVideo | Medium6.9 |
| CVE-2026-91965 | WWBN AVideo through 29.0 Broken Access Control via Live EndpointsPublic exploitWWBN · AVideo | High8.7 |
| CVE-2026-90552 | WWBN AVideo Missing Authorization via Playlists_schedules list.json.phpPublic exploitWWBN · AVideo | Medium5.3 |
| CVE-2026-90551 | WWBN AVideo Missing Authorization via video_from_program APIWWBN · AVideo | Medium6.9 |
| CVE-2026-90550 | WWBN AVideo Missing Authorization via mediaSession.json.phpPublic exploitWWBN · AVideo | Medium6.9 |
| CVE-2026-90549 | WWBN AVideo Missing Authorization via videosAndroid.json.php EndpointWWBN · AVideo | Medium6.9 |
| CVE-2026-90548 | WWBN AVideo Missing Authorization in ImageGallery list.json.phpPublic exploitWWBN · AVideo | Medium6.9 |
| CVE-2026-90547 | WWBN AVideo Missing Authorization via getBookmarks.json.phpPublic exploitWWBN · AVideo | Medium6.9 |