Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 2 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 402,754All CVEsplus 19,156 rejected
- 573Last 24 hours3,420 in the last 7 days
- 17,050Last 30 days1,516 of them critical
- 1,772Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 0 | 7 | 36 | 1 | 0 | 44 | 52 |
| 2025 | 1 | 0 | 5 | 0 | 0 | 6 | 8 |
| 2024 | 1 | 0 | 0 | 0 | 0 | 1 | 2 |
| 2023 | 0 | 0 | 0 | 1 | 0 | 1 | 1 |
| Title | ||
|---|---|---|
| CVE-2026-121733 | Bagisto before 2.4.5 Stored XSS via RMA Conversation Attachment UploadWebkul · Bagisto | Low2.1 |
| CVE-2026-115326 | QloApps through 1.7.0 IDOR via OrderDetailController Refund RequestWebkul · QloApps | Medium5.3 |
| CVE-2026-112193 | Webkul Aureus ERP UserForm.php weak passwordPublic exploitWebkul · Aureus ERP | Medium6.3 |
| CVE-2026-112190 | Webkul Aureus ERP composer.json insertion of sensitive information into debugging codePublic exploitWebkul · Aureus ERP | Medium6.9 |
| CVE-2026-111284 | Aureus ERP through 1.6.0 Stored XSS via Time Off Holiday Action ModalPublic exploitWebkul · Aureus ERP | Medium5.1 |
| CVE-2026-110229 | QloApps through 1.7.0 Missing Hotel Access Restriction in Credit SlipsWebkul · QloApps | Medium5.3 |
| CVE-2026-110226 | QloApps through 1.7.0 Authorization Bypass via id_hotel in Room Type CreationWebkul · QloApps | Medium5.3 |
| CVE-2026-110224 | QloApps through 1.7.0 Reflected XSS via Search Alias Validation ErrorsPublic exploitWebkul · QloApps | Medium5.1 |
| CVE-2026-110221 | QloApps through 1.7.0 Reflected XSS via Advanced Price Rule Name and Impact ValueWebkul · QloApps | Medium5.1 |
| CVE-2026-110219 | QloApps through 1.7.0 Reflected XSS via Additional Facility Price FieldWebkul · QloApps | Medium5.1 |
| CVE-2026-110218 | Aureus ERP through 1.6.0 Unpublished Blog Post Disclosure via Direct URLWebkul · Aureus ERP | Medium6.3 |
| CVE-2026-109393 | QloApps through 1.7.0 Insecure Direct Object Reference in Back-Office AJAX HandlersWebkul · QloApps | Medium5.3 |
| CVE-2026-107702 | QloApps through 1.7.0 Authorization Bypass via id_hotel in Admin Room BookingPublic exploitWebkul · QloApps | Medium5.3 |
| CVE-2026-105836 | QloApps through 1.7.0 Authorization Bypass via ajaxProcessBulkUpdateRoomsPublic exploitWebkul · QloApps | Medium5.3 |
| CVE-2026-103590 | QloApps through 1.7.0 Reflected XSS via Length of Stay FieldsWebkul · QloApps | Medium5.1 |
| CVE-2026-103589 | QloApps through 1.7.0 Reflected XSS via Room Type EditorPublic exploitWebkul · QloApps | Medium5.1 |
| CVE-2026-103588 | QloApps through 1.7.0 Reflected XSS via exceptions fieldPublic exploitWebkul · QloApps | Medium5.1 |
| CVE-2026-103587 | QloApps through 1.7.0 Reflected XSS via Book Now Search ParametersPublic exploitWebkul · QloApps | Medium5.1 |
| CVE-2026-101139 | Webkul Bagisto Invoice Mass Status Update state authorizationPublic exploitWebkul · Bagisto | Medium5.1 |
| CVE-2026-97062 | Aureus ERP 1.6.0 Stored XSS via SVG File UploadPublic exploitWebkul · Aureus ERP | Medium5.1 |
| CVE-2026-95655 | Aureus ERP before 1.5.0 Unscoped Message Access via ChatterPanelWebkul · Aureus ERP | High8.6 |
| CVE-2026-94387 | Aureus ERP before 1.6.0 Stored XSS via Chatter Field-Change LogWebkul · Aureus ERP | Medium5.1 |
| CVE-2026-93988 | QloApps through 1.7.0 Arbitrary File Read via getEmailHTMLPublic exploitwebkul · qloapps | High7.1 |
| CVE-2026-93454 | Aureus ERP through 1.6.0 Stored XSS via Payment Term NotePublic exploitWebkul · Aureus ERP | Medium5.1 |
| CVE-2026-92234 | QloApps through 1.7.0 Reflected XSS via Hotel Feature Validation ErrorsPublic exploitWebkul · QloApps | Medium5.1 |
| CVE-2026-89268 | QloApps through 1.7.0 Reflected XSS via List Filter ParametersWebkul · QloApps | Medium5.1 |
| CVE-2026-75498 | Webkul QloApps SQL injectionPublic exploitWebkul · QloApps | High8.6 |
| CVE-2026-75497 | Webkul QloApps SQL injectionPublic exploitWebkul · QloApps | High8.6 |
| CVE-2026-75496 | Webkul QloApps improper file upload validationPublic exploitWebkul · QloApps | High8.6 |
| CVE-2026-75082 | Webkul Bagisto Customer-Registration Notification Email register cross site scriptingPublic exploitWebkul · Bagisto | Medium5.3 |
| CVE-2026-75081 | Webkul Bagisto store behavioral workflowPublic exploitWebkul · Bagisto | Medium5.3 |
| CVE-2026-19997 | Webkul Bagisto Backend Sales RMA Endpoint requests authorizationPublic exploitWebkul · Bagisto | Medium5.1 |
| CVE-2026-19996 | Webkul Bagisto Backend Customer Behavior Data Endpoint customers privileges managementPublic exploitWebkul · Bagisto | Medium5.3 |
| CVE-2026-19995 | Webkul Bagisto RMA Message send-message cross site scriptingPublic exploitWebkul · Bagisto | Medium5.1 |
| CVE-2026-19994 | Webkul Bagisto Configuration Management execute authorizationPublic exploitWebkul · Bagisto | Medium5.3 |
| CVE-2026-19993 | Webkul Bagisto RMA State Validation update-status behavioral workflowPublic exploitWebkul · Bagisto | Medium5.3 |
| CVE-2026-19838 | Webkul Bagisto Backend Reporting Endpoint sales authorizationPublic exploitWebkul · Bagisto | Medium5.3 |
| CVE-2026-19837 | Webkul Bagisto Customer Search search information disclosurePublic exploitWebkul · Bagisto | Medium5.1 |
| CVE-2026-19836 | Webkul Bagisto Backend Customer Detail Feature view authorizationPublic exploitWebkul · Bagisto | Medium5.3 |
| CVE-2026-19835 | Webkul Bagisto Customer Item Deletion Endpoint access controlPublic exploitWebkul · Bagisto | Medium5.1 |
| CVE-2026-19834 | Webkul Bagisto Admin Customer Impersonation Feature login-as-customer authorizationPublic exploitWebkul · Bagisto | Medium5.1 |
| CVE-2026-60120 | Bagisto < 2.4.4 Stored XSS via CSTI in create.blade.phpWebkul · Bagisto | Medium5.1 |
| CVE-2017-20262 | Joomla! Component Ajax Quiz 1.8 SQL InjectionPublic exploitWebkul · Ajax Quiz | High8.8 |
| CVE-2026-9506 | Path Traversal Vulnerability in BagistoPublic exploitWebkul · Bagisto | High8.7 |
| CVE-2025-10759 | Webkul QloApps CSRF Token authorizationPublic exploitWebkul · QloApps | Medium6.9 |
| CVE-2025-29009 | WordPress Medical Prescription Attachment Plugin for WooCommerce <= 1.2.3 - Arbitrary File Upload VulnerabilityWebkul · Medical Prescription Attachment Plugin for WooCommerce | Critical10.0 |
| CVE-2025-6173 | Webkul QloApps ajax_products_list.php sql injectionPublic exploitWebkul · QloApps | Medium5.1 |
| CVE-2025-3568 | Webkul Krayin CRM SVG File edit cross site scriptingPublic exploitWebkul · Krayin CRM | Medium5.1 |
| CVE-2025-1155 | Webkul QloApps Your Location Search stores cross site scriptingPublic exploitWebkul · QloApps | Medium5.3 |
| CVE-2025-1074 | Webkul QloApps URL mylogout cross-site request forgeryPublic exploitWebkul · QloApps | Medium5.3 |