Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 9 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 405,133All CVEsplus 19,158 rejected
- 623Last 24 hours4,821 in the last 7 days
- 18,807Last 30 days1,602 of them critical
- 1,779Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 0 | 6 | 7 | 0 | 0 | 13 | 22 |
| 2025 | 0 | 0 | 4 | 0 | 0 | 4 | 9 |
| 2024 | 0 | 0 | 4 | 0 | 0 | 4 | 5 |
| 2023 | 0 | 0 | 1 | 0 | 0 | 1 | 1 |
| Title | ||
|---|---|---|
| CVE-2026-96767 | NEX-Forms <= 9.3.2 - Unauthenticated Stored Cross-Site Scripting via Content-Type Headerwebaways · NEX-Forms – Ultimate Forms Plugin for WordPress | High7.2 |
| CVE-2026-75961 | NEX-Forms <= 9.3.0 - Authenticated (Administrator+) SQL Injection via 'operator' Key of the 'additional_params' Parameterwebaways · NEX-Forms – Ultimate Forms Plugin for WordPress | Medium4.9 |
| CVE-2026-15602 | NEX-Forms <= 9.2.4 - Authenticated (Admin+) SQL Injection via 'additional_params' Parameterwebaways · NEX-Forms – Ultimate Forms Plugin for WordPress | Medium4.9 |
| CVE-2026-15450 | NEX-Forms <= 9.2.3 - Authenticated (Admin+) Arbitrary File Deletion via Path Traversal via 'location' Parameterwebaways · NEX-Forms – Ultimate Forms Plugin for WordPress | High8.1 |
| CVE-2026-9017 | NEX-Forms <= 9.2.2 - Missing Authorization to Unauthenticated Arbitrary Form Entry Modification via nf_send_nf_email AJAX Actionwebaways · NEX-Forms – Ultimate Forms Plugin for WordPress | Medium5.3 |
| CVE-2026-13040 | NEX-Forms <= 9.2.2 - Unauthenticated Stored Cross-Site Scripting via 'real_val__' Parameterwebaways · NEX-Forms – Ultimate Forms Plugin for WordPress | High7.2 |
| CVE-2026-12142 | NEX-Forms <= 9.2.2 - Unauthenticated Stored Cross-Site Scripting via '_name[]' Array Parameterwebaways · NEX-Forms – Ultimate Forms Plugin for WordPress | High7.2 |
| CVE-2026-12404 | NEX-Forms <= 9.2.2 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via CSVExport Classwebaways · NEX-Forms – Ultimate Forms Plugin for WordPress | Medium5.3 |
| CVE-2026-7046 | NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.12 - Authenticated (Administrator+) SQL Injection via 'table' Parameterwebaways · NEX-Forms – Ultimate Forms Plugin for WordPress | Medium4.9 |
| CVE-2026-5063 | NEX-Forms <= 9.1.11 - Unauthenticated Stored Cross-Site Scripting via POST Parameter Key Nameswebaways · NEX-Forms – Ultimate Forms Plugin for WordPress | High7.2 |
| CVE-2026-1947 | NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.9 - Missing Authorization to Unauthenticated Arbitrary Form Entry Modification via nf_set_entry_update_idwebaways · NEX-Forms – Ultimate Forms Plugin for WordPress | High7.5 |
| CVE-2026-1948 | NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.9 - Missing Authorization to Authenticated (Subscriber+) License Deactivation via deactivate_licensewebaways · NEX-Forms – Ultimate Forms Plugin for WordPress | Medium4.3 |
| CVE-2025-15510 | NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.8 - Missing Authorization to Unauthenticated Sensitive Information Exposurewebaways · NEX-Forms – Ultimate Forms Plugin for WordPress | Medium5.3 |
| CVE-2025-10185 | NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.6 - Authenticated (Admin+) SQL Injectionwebaways · NEX-Forms – Ultimate Forms Plugin for WordPress | Medium4.9 |
| CVE-2025-3468 | NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.9.1 - Authenticated (Custom) Stored Cross-Site Scriptingwebaways · NEX-Forms – Ultimate Forms Plugin for WordPress | Medium6.4 |
| CVE-2025-4208 | NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.9.1 - Authenticated (Custom) Limited Code Execution via get_table_records Functionwebaways · NEX-Forms – Ultimate Forms Plugin for WordPress | Medium6.3 |
| CVE-2024-13498 | NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.8.1 - Unauthenticated Sensitive Information Exposurewebaways · NEX-Forms – Ultimate Forms Plugin for WordPress | Medium5.3 |
| CVE-2024-10862 | NEX-Forms <= 8.7.15 - Authenticated (Admin+) SQL Injectionwebaways · NEX-Forms – Ultimate Forms Plugin for WordPress | Medium4.9 |
| CVE-2024-1130 | NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.5.6 - Missing Authorization via set_read()webaways · NEX-Forms – Ultimate Forms Plugin for WordPress | Medium5.3 |
| CVE-2024-1129 | NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.5.6 - Missing Authorization via set_starred()webaways · NEX-Forms – Ultimate Forms Plugin for WordPress | Medium5.3 |
| CVE-2024-0907 | NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.5.6 - Missing Authorization via restore_records()webaways · NEX-Forms – Ultimate Forms Plugin for WordPress | Medium5.3 |
| CVE-2020-36670 | NEX-Forms <= 7.7.1 - Missing Authorization on Various AJAX Actionswebaways · NEX-Forms – Ultimate Forms Plugin for WordPress | Medium6.3 |