Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 5 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 406,581All CVEsplus 19,172 rejected
- 155Last 24 hours4,783 in the last 7 days
- 16,608Last 30 days1,456 of them critical
- 1,781Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 6 | 19 | 11 | 0 | 0 | 36 | 36 |
| Title | ||
|---|---|---|
| CVE-2026-119300 | Wekan: ReDoS via Unescaped User Input in RegExpPublic exploitwekan · wekan | Medium6.5 |
| CVE-2026-68901 | WeKan Board Export REST Endpoints: NULL Pointer Dereference on Invalid authToken Leads to Uncaught Exception / Remote Denial of ServicePublic exploitwekan · wekan | Medium6.5 |
| CVE-2026-68900 | Wekan: Stored XSS in HTML board exports through a card-title second parsePublic exploitwekan · wekan | High7.6 |
| CVE-2026-68899 | Wekan: File Upload MIME Type Validation Bypass — Stored XSS via Missing System Binary Fallbackwekan · wekan | High8.7 |
| CVE-2026-68561 | Wekan: a low-privilege board member escalates to board admin and takes over a private board via the `sort` collection-allow rulePublic exploitwekan · wekan | High8.8 |
| CVE-2026-68560 | Wekan:hell Injection in External Antivirus Scanner Path via asyncExecwekan · wekan | High7.7 |
| CVE-2026-68558 | Wekan: SSRF filter bypass via DNS-resolving hostname in outgoing webhooks (incomplete fix of CVE-2026-53446)Public exploitwekan · wekan | High8.5 |
| CVE-2026-68559 | Wekan: Broken access control in the Excel-export route (`/api/boards/:boardId/exportExcel`)Public exploitwekan · wekan | Medium6.5 |
| CVE-2026-55652 | Wekan: Header-login IP allowlist bypass via X-Forwarded-For spoofing in Wekan allows unauthenticated full account takeover (incl. admin)Public exploitwekan · wekan | Critical9.8 |
| CVE-2026-55234 | Wekan: Broken access control: any authenticated user can move their Cards/Lists/Swimlanes into a private board they are not a member of (cross-board write via collection allow rule)Public exploitwekan · wekan | High8.5 |
| CVE-2026-53447 | Wekan: `cloneBoard` Meteor method has no authorization check — any user can clone (read) any private board by IDPublic exploitwekan · wekan | Medium6.5 |
| CVE-2026-52893 | Wekan: OIDC Account Takeover via Unconditional Email-Based Account Merge in onCreateUser hookPublic exploitwekan · wekan | Critical9.2 |
| CVE-2026-53444 | Wekan: Missing authorization on OIDC Meteor methods allows privilege escalation to adminPublic exploitwekan · wekan | High7.6 |
| CVE-2026-53445 | Wekan: Authorization bypass in copyBoard DDP method allows any user to copy private boardsPublic exploitwekan · wekan | High7.1 |
| CVE-2026-53446 | Wekan: Server-Side Request Forgery (SSRF) via webhook integration URLswekan · wekan | Medium6.2 |
| CVE-2026-52892 | Wekan: Read-only board members can create/modify/delete Custom Fields (privilege escalation via read-level authz on write ops)wekan · wekan | Medium6.5 |
| CVE-2026-52891 | Wekan: Shell Injection via Avatar Uploadwekan · wekan | Critical9.9 |
| CVE-2026-52890 | Wekan: Arbitrary file read and server DoS via attachment versions.original.pathPublic exploitwekan · wekan | High7.1 |
| CVE-2026-59154 | Wekan: Checklist direct DDP updates can write checklist data into private boardswekan · wekan | Medium4.3 |
| CVE-2026-41455 | WeKan < 8.35 SSRF via Webhook URLwekan · wekan | Medium6.3 |
| CVE-2026-41454 | WeKan < 8.35 Missing Authorization via Integration REST APIwekan · wekan | High8.7 |
| CVE-2026-30847 | Wekan Credential Leak via notificationUsers Publication Exposes Password Hashes and Session TokensWekan · Wekan | Critical9.3 |
| CVE-2026-30846 | Wekan Exposes All Global Webhook Integrations through globalwebhooks PublicationWekan · Wekan | High8.7 |
| CVE-2026-30845 | Wekan Exposes Sensitive Data through Lack of Field Filtering During Board PublicationWekan · Wekan | Medium6.9 |
| CVE-2026-30844 | Wekan Vulnerable to SSRF through Lack of Validation or Filtering in Attachment URL LoadingWekan · Wekan | Critical9.3 |
| CVE-2026-30843 | Wekan has Cross-Board IDOR in Custom Fields Update EndpointsWekan · Wekan | Critical9.3 |
| CVE-2026-25859 | WeKan < 8.20 Migration Functionality Insufficient Permission ChecksWeKan · WeKan | High7.1 |
| CVE-2026-25568 | WeKan < 8.19 allowPrivateOnly Setting Enforcement BypassWeKan · WeKan | High7.1 |
| CVE-2026-25567 | WeKan < 8.19 Card Comment Author Spoofing via User-controlled authorIdWeKan · WeKan | Medium5.3 |
| CVE-2026-25566 | WeKan < 8.19 Cross-board Card Move Without Destination AuthorizationWeKan · WeKan | High7.1 |
| CVE-2026-25565 | WeKan < 8.19 Read-only Board Roles Can Update CardsWeKan · WeKan | High7.1 |
| CVE-2026-25564 | WeKan < 8.19 Checklist Deletion IDOR via Missing Relationship ValidationWeKan · WeKan | High7.1 |
| CVE-2026-25563 | WeKan < 8.19 Checklist Creation Cross-Board IDORWeKan · WeKan | High7.1 |
| CVE-2026-25562 | WeKan < 8.19 Attachments Publication Information DisclosureWeKan · WeKan | Medium5.3 |
| CVE-2026-25561 | WeKan < 8.19 Attachment Upload Object Relationship Validation BypassWeKan · WeKan | High7.1 |
| CVE-2026-25560 | WeKan < 8.19 LDAP Authentication Filter InjectionWeKan · WeKan | High8.7 |