Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read just now.
At a glance
Published CVEs; rejected ones are not counted.
- 406,620All CVEsplus 19,172 rejected
- 52Last 24 hours4,665 in the last 7 days
- 16,222Last 30 days1,435 of them critical
- 1,781Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 0 | 15 | 12 | 1 | 0 | 28 | 28 |
| Title | ||
|---|---|---|
| CVE-2026-126778 | Wallos 4.4.0 before 5.10.3 Stored XSS via sendnotifications.phpellite · Wallos | Medium5.1 |
| CVE-2026-77353 | Wallos: iCalendar Injection via CRLF in Subscription Name/Notes ExportPublic exploitellite · Wallos | Medium4.6 |
| CVE-2026-77352 | Wallos: Authenticated SSRF via per-user SMTP notification host (low-privilege user)ellite · Wallos | Medium4.3 |
| CVE-2026-77348 | Wallos incomplete fix for CVE-2026-33407: unauthenticated httpoxy SSRF still reachable via `endpoints/payments/search.php`Public exploitellite · Wallos | High8.2 |
| CVE-2026-77351 | Wallos: SSRF via Unvalidated User-Level SMTP Host in Email Notification SettingsPublic exploitellite · Wallos | Low3.5 |
| CVE-2026-61641 | Wallos: OIDC account takeover via email-based account linking without `email_verified` checkellite · Wallos | High8.1 |
| CVE-2026-61640 | Wallos: SSRF via OIDC Token/UserInfo URL Configurationellite · Wallos | High8.5 |
| CVE-2026-61639 | Wallos: Zip Slip path traversal in database restore writes files to webrootellite · Wallos | High8.5 |
| CVE-2026-61638 | Wallos: SSRF via Test Email Notification - unvalidated SMTP host/portellite · Wallos | High8.2 |
| CVE-2026-54600 | Wallos: Unauthenticated database replacement via import endpoint on fresh installPublic exploitellite · Wallos | High8.2 |
| CVE-2026-54599 | Wallos: OIDC state parameter never validated — login CSRF / account takeoverPublic exploitellite · Wallos | High7.5 |
| CVE-2026-54598 | Missing Authentication for Critical Function in wallosPublic exploitellite · Wallos | High7.5 |
| CVE-2026-50199 | Wallos: Cross-user Fixer/API Layer credential consumption in exchange-rate refreshPublic exploitellite · Wallos | Medium4.3 |
| CVE-2026-50198 | Wallos: Cross-user subscription cost inference via replacement_subscription_idPublic exploitellite · Wallos | Medium4.3 |
| CVE-2026-41689 | Wallos: Shared local webhook allowlist lets low-privilege users send arbitrary requests to allowlisted internal servicesPublic exploitellite · Wallos | Medium6.0 |
| CVE-2026-41688 | Incomplete fix for CVE-2026-33399: SSRF in WallosPublic exploitellite · Wallos | High7.7 |
| CVE-2026-41687 | Wallos: SSRF CGNAT Bypass in subscription/payments Logo URL — is_cgnat_ip() Not Used in Inline ChecksPublic exploitellite · Wallos | Medium4.3 |
| CVE-2026-33417 | Wallos: Password Reset Tokens Never ExpirePublic exploitellite · Wallos | Medium6.5 |
| CVE-2026-33401 | Wallos: Incomplete fix for CVE-2026-30840 - SSRF in AI and notification endpoints bypass ssrf_helper.phpPublic exploitellite · Wallos | High7.1 |
| CVE-2026-33400 | Wallos: Stored cross-site scripting (XSS) vulnerability in the payment method rename endpointPublic exploitellite · Wallos | Medium5.4 |
| CVE-2026-33399 | Wallos: SSRF Bypass - Incomplete Fix for CVE-2026-30839/30840Public exploitellite · Wallos | High7.7 |
| CVE-2026-33407 | Wallos: SSRF via HTTP Proxy Environment VariablePublic exploitellite · Wallos | High8.3 |
| CVE-2026-30842 | Wallos: Authenticated Missing Authorization Allows Deletion of Other Users’ Uploaded AvatarsPublic exploitellite · Wallos | Medium4.3 |
| CVE-2026-30841 | Wallos: Reflected XSS via unescaped token and email parameters in passwordreset.phpPublic exploitellite · Wallos | Medium6.9 |
| CVE-2026-30840 | Wallos: Server-Side Request Forgery (SSRF) in Notification TestersPublic exploitellite · Wallos | High8.8 |
| CVE-2026-30839 | Wallos: SSRF via webhook test endpointellite · Wallos | Medium5.3 |
| CVE-2026-30828 | Wallos: SSRF via url parameter leading to File Traversalellite · Wallos | High8.7 |
| CVE-2026-27479 | Wallos: SSRF via Redirect Bypass in Logo/Icon URL FetchPublic exploitellite · Wallos | High7.7 |