Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 7 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 406,568All CVEsplus 19,172 rejected
- 363Last 24 hours4,808 in the last 7 days
- 16,725Last 30 days1,463 of them critical
- 1,781Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 7 | 43 | 40 | 1 | 0 | 91 | 178 |
| 2025 | 0 | 3 | 2 | 0 | 0 | 5 | 87 |
| 2024 | 0 | 4 | 8 | 1 | 0 | 13 | 82 |
| 2023 | 4 | 31 | 27 | 0 | 0 | 62 | 69 |
| 2022 | 1 | 4 | 2 | 0 | 0 | 7 | 7 |
| Title | ||
|---|---|---|
| CVE-2026-124433 | phpMyFAQ before 4.1.11 Insufficient Authorization in Group Deletion via GroupControllerPublic exploitthorsten · phpMyFAQ | High7.0 |
| CVE-2026-124432 | phpMyFAQ before 4.1.11 and 4.2.0-beta.3 Account Enumeration via WebAuthn prepare-loginPublic exploitthorsten · phpMyFAQ | Medium6.9 |
| CVE-2026-116183 | phpMyFAQ before 4.1.10 Authorization Bypass via /api/faq/create openQuestionIDthorsten · phpMyFAQ | High8.7 |
| CVE-2026-116182 | phpMyFAQ before 4.1.10 SSRF via PDF Export Image FetchingPublic exploitthorsten · phpMyFAQ | Medium5.3 |
| CVE-2026-111911 | phpMyFAQ 4.0.0 before 4.1.9 Authentication Bypass via WebAuthn Credential InjectionPublic exploitthorsten · phpMyFAQ | Critical9.3 |
| CVE-2026-111910 | phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Authorization Bypass via attachment.php DownloadsPublic exploitthorsten · phpMyFAQ | High7.1 |
| CVE-2026-111909 | phpMyFAQ before 4.1.9 Missing Authorization Allows Superadmin Deletion via deleteUser APIthorsten · phpMyFAQ | High7.2 |
| CVE-2026-111908 | phpMyFAQ 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta BOLA in FAQ Update via REST APIPublic exploitthorsten · phpMyFAQ | High8.7 |
| CVE-2026-111907 | phpMyFAQ 4.0.0 before 4.1.9 CSRF via /admin/api/update-databasethorsten · phpMyFAQ | High7.1 |
| CVE-2026-111906 | phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta CSRF in Elasticsearch/OpenSearch Admin API Index OperationsPublic exploitthorsten · phpMyFAQ | High7.1 |
| CVE-2026-111905 | phpMyFAQ 3.2.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta IDOR Leaks TOTP Secret via /admin/api/user/dataPublic exploitthorsten · phpMyFAQ | High7.0 |
| CVE-2026-111904 | phpMyFAQ 4.2.0-alpha before 4.2.0-beta Information Disclosure via open-questions APIPublic exploitthorsten · phpMyFAQ | Medium6.9 |
| CVE-2026-111903 | phpMyFAQ 4.2.0-alpha before 4.2.0-beta Stored XSS via SVG DTD Entity BypassPublic exploitthorsten · phpMyFAQ | Medium5.1 |
| CVE-2026-111902 | phpMyFAQ 4.2.0-alpha before 4.2.0-beta Authorization Bypass via Comments and Attachments APIthorsten · phpMyFAQ | Medium6.9 |
| CVE-2026-111901 | phpMyFAQ 4.2.0-alpha before 4.2.0-beta Unauthenticated DoS via API PaginationPublic exploitthorsten · phpMyFAQ | High8.7 |
| CVE-2026-111900 | phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Draft FAQ Attachment Disclosure via attachment.phpPublic exploitthorsten · phpMyFAQ | Medium5.3 |
| CVE-2026-111898 | phpMyFAQ 4.2.0-alpha before 4.2.0-beta Account Takeover via Keycloak Implicit Account LinkingPublic exploitthorsten · phpMyFAQ | High7.7 |
| CVE-2026-111897 | phpMyFAQ 4.2.0-alpha before 4.2.0-beta Authorization Bypass in Attachment Administration EndpointsPublic exploitthorsten · phpMyFAQ | High7.1 |
| CVE-2026-111896 | phpMyFAQ 4.2.0-alpha before 4.2.0-beta Stored XSS via SVG Upload Sanitizer Bypassthorsten · phpMyFAQ | Medium5.1 |
| CVE-2026-111895 | phpMyFAQ 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta Account Takeover via Entra ID preferred_usernamePublic exploitthorsten · phpMyFAQ | High7.6 |
| CVE-2026-111894 | phpMyFAQ 3.2.1 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Stored XSS via iframe data: URIPublic exploitthorsten · phpMyFAQ | Medium5.1 |
| CVE-2026-111893 | phpMyFAQ 4.2.0-alpha before 4.2.0-beta Privilege Escalation via Group Category Restrictions APIPublic exploitthorsten · phpMyFAQ | High8.5 |
| CVE-2026-111892 | phpMyFAQ 4.2.0-alpha before 4.2.0-beta Missing Rate Limiting on Password-Reset EndpointsPublic exploitthorsten · phpMyFAQ | Medium6.9 |
| CVE-2026-111891 | phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta Privilege Escalation via Group Permissions APIthorsten · phpMyFAQ | High7.0 |
| CVE-2026-111890 | phpMyFAQ 4.2.0-alpha.2 before 4.2.0-beta Privilege Escalation via updateUserRightsPublic exploitthorsten · phpMyFAQ | High7.0 |
| CVE-2026-111889 | phpMyFAQ 4.1.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Missing Authorization via Admin DashboardPublic exploitthorsten · phpMyFAQ | Medium5.3 |
| CVE-2026-111888 | phpMyFAQ 4.0.0 before 4.1.9 Incorrect Authorization via news update APIPublic exploitthorsten · phpMyFAQ | Medium5.1 |
| CVE-2026-111887 | phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Account Enumeration via Guest Comment EndpointPublic exploitthorsten · phpMyFAQ | Medium6.9 |
| CVE-2026-111886 | phpMyFAQ 4.2.0-alpha.2 before 4.2.0-beta 2FA Brute-Force via remove-twofactor EndpointPublic exploitthorsten · phpMyFAQ | High7.1 |
| CVE-2026-111885 | phpMyFAQ 4.2.0-alpha before 4.2.0-beta Missing Authorization via deleteGroup APIPublic exploitthorsten · phpMyFAQ | High7.0 |
| CVE-2026-111884 | phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Missing Current-Password Step-Up on E-mail Change Enables Account TakeoverPublic exploitthorsten · phpMyFAQ | High8.7 |
| CVE-2026-111882 | phpMyFAQ 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta TOTP 2FA Bypass via SSO Callbacksthorsten · phpMyFAQ | High8.6 |
| CVE-2026-109573 | phpMyFAQ before 4.1.9 SQL Injection via api/autocomplete Search EndpointPublic exploitthorsten · phpMyFAQ | Critical9.2 |
| CVE-2026-108851 | phpMyFAQ through 4.1.10 Missing Authorization via MCP Server faq_search ToolPublic exploitthorsten · phpMyFAQ | Medium4.8 |
| CVE-2026-47132 | phpMyFAQ: SQL LIKE Wildcard Injection in Chat User Search Allows Authenticated User EnumerationPublic exploitthorsten · phpMyFAQ | Medium5.4 |
| CVE-2026-56738 | phpMyFAQ has SQL Injection in `StopWords::add()` — Unescaped Stop Word Insertionthorsten · phpMyFAQ | High8.5 |
| CVE-2026-56737 | phpMyFAQ's two-factor authentication login bypasses the password factorPublic exploitthorsten · phpMyFAQ | High8.1 |
| CVE-2026-56736 | phpMyFAQ has Stored XSS in Admin FAQ Editor via HTML Entity Bypass in Frontend FAQ SubmissionPublic exploitthorsten · phpMyFAQ | High8.2 |
| CVE-2026-85593 | phpMyFAQ before 4.1.8 Stored XSS via html_entity_decodethorsten · phpMyFAQ | Medium5.1 |
| CVE-2026-85592 | phpMyFAQ before 4.1.8 Authorization Bypass via question/createPublic exploitthorsten · phpMyFAQ | Medium6.3 |
| CVE-2026-85591 | phpMyFAQ before 4.1.8 Authentication Bypass via Unverified Password Changethorsten · phpMyFAQ | High7.1 |
| CVE-2026-85590 | phpMyFAQ before 4.1.8 Authentication Bypass via Two-Factor DisablePublic exploitthorsten · phpMyFAQ | High7.1 |
| CVE-2026-85589 | phpMyFAQ before 4.2.0-alpha.2 Missing Authorization via Dashboard APIPublic exploitthorsten · phpMyFAQ | Medium5.3 |
| CVE-2026-85588 | phpMyFAQ before 4.1.8 TOTP Secret Exposure via Data Exportthorsten · phpMyFAQ | Medium5.3 |
| CVE-2026-85587 | phpMyFAQ before 4.1.8 Incorrect Authorization via Admin PagesPublic exploitthorsten · phpMyFAQ | Medium5.3 |
| CVE-2026-85586 | phpMyFAQ before 4.1.8 CAPTCHA Bypass via store parameterthorsten · phpMyFAQ | Medium6.9 |
| CVE-2026-76215 | phpMyFAQ before 4.1.7 Missing Authorization via child resourcesPublic exploitthorsten · phpMyFAQ | Medium6.9 |
| CVE-2026-76214 | phpMyFAQ before 4.1.7 WebAuthn Replay Attack via Challengethorsten · phpMyFAQ | Critical9.1 |
| CVE-2026-76213 | phpMyFAQ before 4.1.7 2FA Brute-Force via Session-Scoped ThrottlePublic exploitthorsten · phpMyFAQ | Critical9.1 |
| CVE-2026-76212 | phpMyFAQ before 4.1.7 LIKE Wildcard Injection via PostgreSQLPublic exploitthorsten · phpMyFAQ | Medium6.9 |