Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 6 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,955All CVEsplus 19,141 rejected
- 330Last 24 hours3,207 in the last 7 days
- 17,014Last 30 days1,575 of them critical
- 1,769Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 1 | 4 | 5 | 5 | 0 | 15 | 15 |
| Title | ||
|---|---|---|
| CVE-2026-113409 | The Ortto plugin for WordPress before 1.0.25 did not escape stored settings on its admin settings page, leading to stored cross-site scripting. A threat actor…canva · ortto | Medium4.8 |
| CVE-2026-114173 | The Ortto plugin for WordPress before 1.0.25 did not filter the WooCommerce product data it embedded in public storefront pages. An unauthenticated threat…canva · ortto | Medium5.3 |
| CVE-2026-113387 | The Ortto plugin for WordPress before 1.0.25 did not authenticate configuration update requests, relying only on a secret exposed in public HTML. An…canva · ortto | High8.6 |
| CVE-2026-103220 | The Affinity by Canva application before 3.3.1 (October 2026 release) did not perform adequate bounds checking when parsing raster image data in Affinity…canva · affinity | Medium4.5 |
| CVE-2026-101130 | The Affinity by Canva application before 3.3.1 (October 2026 release) did not perform adequate bounds checking when parsing arrays of strings in Affinity…canva · affinity | Low3.6 |
| CVE-2026-101094 | The Affinity by Canva application before 3.3.1 (October 2026 release) did not correctly handle incomplete UTF-8 character sequences when parsing text in…canva · affinity | Low3.6 |
| CVE-2026-96396 | The Affinity by Canva application for macOS before 3.3.1 (October 2026 release) did not safely calculate the size of an image buffer when generating QuickLook…canva · affinity | Medium4.9 |
| CVE-2026-96395 | The Affinity by Canva app for macOS before 3.3.1 (October 2026 release) did not perform adequate bounds checking when generating QuickLook thumbnails and…canva · affinity | Low3.6 |
| CVE-2026-96394 | The Affinity by Canva application for macOS before 3.3.1 (October 2026 release) did not validate image dimensions against the size of the pixel data when…canva · affinity | Low2.9 |
| CVE-2026-96393 | The Affinity by Canva app before 3.3.1 (October 2026 release) did not perform adequate bounds checking when parsing Affinity document files, leading to an…canva · affinity | Low3.6 |
| CVE-2026-90860 | The Canva Mobile App for HarmonyOS before v1.15.1 did not restrict the headers returned to an external origin running in a privileged WebView. A threat actor…Canva · Canva | High7.1 |
| CVE-2026-92839 | Canva Desktop before v1.125.0 performed double decoding in the deeplink handler. A threat actor could cause the application to load arbitrary same-origin…Canva · Canva | Medium4.3 |
| CVE-2026-81546 | The Affinity by Canva application before 3.3.0 (September 2026 release) did not perform adequate bounds checking when parsing Affinity document files leading…Canva · Affinity | High7.7 |
| CVE-2026-85094 | The Canva Android App before 2.376.0 did not restrict the headers returned to an external origin running in a privileged WebView. A threat actor with control…Canva · Canva | High8.8 |
| CVE-2026-85085 | The Canva Android App before 2.376.0 allowed an external origin to be loaded in a privileged WebView. A threat actor who controls the page loaded by the user…Canva · Canva | Critical9.6 |