Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 6 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,167All CVEsplus 19,120 rejected
- 474Last 24 hours2,785 in the last 7 days
- 16,854Last 30 days1,538 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 5 | 3 | 6 | 0 | 0 | 14 | 36 |
| 2025 | 0 | 11 | 11 | 0 | 0 | 22 | 22 |
| Title | ||
|---|---|---|
| CVE-2026-11587 | Authenticated SQL Injection via PHP Array Key in ACL Management (Resources & Actions) — Centreon 26.03.0Centreon · Centreon | High7.2 |
| CVE-2025-12523 | Broken Object Level Authorization in Users Configuration Endpoint (/centreon/api/latest/configuration/users) – Sensitive Information DisclosureCentreon · Centreon | Medium6.5 |
| CVE-2025-13050 | Broken Function Level Authorization — `postcommand.php` allows execution of poller post-restart commands by non-admin usersCentreon · Centreon | Medium5.4 |
| CVE-2026-14453 | A user with low privileges can inject SSTI templates that can lead to RCE in open-ticketsCentreon · Infra Monitoring | Critical9.6 |
| CVE-2026-2749 | Path traversal in Centreon Open TicketsCentreon · Centreon Open Tickets on Central Server | Critical9.9 |
| CVE-2026-2750 | Command Injection via CLAPI generatetrapsCentreon · Centreon Open Tickets on Central Server | Critical9.1 |
| CVE-2026-2751 | Blind SQL InjectionCentreon · Centreon Web on Central Server | High8.3 |
| CVE-2025-15029 | An unauthenticated user is able to introduce SQL Injection using the Awie export moduleCentreon · Infra Monitoring | Critical9.8 |
| CVE-2025-15026 | Unauthenticated configuration import allows administrative account creation using AWIE componentCentreon · Infra Monitoring | Critical9.8 |
| CVE-2025-12511 | A user with elevated privileges can inject XSS in the DSM Administration’s Extensions configuration pageCentreon · Infra Monitoring | Medium6.8 |
| CVE-2025-12513 | A user with elevated privileges can inject XSS in the Hosts configuration parameters pageCentreon · Infra Monitoring | Medium6.8 |
| CVE-2025-12519 | Information disclosure on Administration parameters API endpointCentreon · Infra Monitoring | Medium5.3 |
| CVE-2025-13056 | A user with elevated privileges can inject XSS in the Administration ACL Menus configuration pageCentreon · Infra Monitoring | Medium6.8 |
| CVE-2025-5965 | RCE via the backup feature available only to user with high privilegeCentreon · Infra Monitoring | High7.2 |
| CVE-2025-54890 | A user with elevated privileges can inject XSS in the Hostgroups configuration pageCentreon · Infra Monitoring | Medium6.8 |
| CVE-2025-12514 | A user with elevated privileges is able to introduce a SQL Injection using the Open-tickets Notification rules configuration parametersCentreon · Infra Monitoring - Open-tickets | High7.2 |
| CVE-2025-8460 | A user with elevated privileges can inject XSS in the Notification rules configuration pageCentreon · Infra Monitoring | Medium6.8 |
| CVE-2025-10023 | A user with elevated privileges can inject XSS in the Services Meta-services configuration pageCentreon · Infra Monitoring | Medium6.2 |
| CVE-2025-8432 | CentreonBI user account on the MBI server can execute commands as root by modifying script runned by the CRONCentreon · Infra Monitoring | High8.4 |
| CVE-2025-8459 | A user with low privileges can inject XSS in the Monitoring Recurrent downtimes pageCentreon · Infra Monitoring | High7.7 |
| CVE-2025-8430 | A user with elevated privileges can inject XSS in the Commands Connectors configuration configuration pageCentreon · Infra Monitoring | Medium6.8 |
| CVE-2025-8429 | A user with elevated privileges can inject XSS in the ACL Action access configuration pageCentreon · Infra Monitoring | Medium6.8 |
| CVE-2025-54893 | A user with elevated privileges can inject XSS in the Hosts templates configuration pageCentreon · Infra Monitoring | Medium6.8 |
| CVE-2025-54891 | A user with elevated privileges can inject XSS in the ACL Resource Access configuration pageCentreon · Infra Monitoring | Medium6.8 |
| CVE-2025-54892 | A user with elevated privileges can inject XSS in the SNMP traps group configuration pageCentreon · Infra Monitoring | Medium6.8 |
| CVE-2025-54889 | A user with elevated privileges can inject XSS in the SNMP traps manufacturer configuration pageCentreon · Infra Monitoring | Medium6.8 |
| CVE-2025-5946 | RCE via the poller reload feature available only to user with high privilegeCentreon · Infra Monitoring | High7.2 |
| CVE-2025-8428 | XSS found in the HTTP loader widgetCentreon · Infra Monitoring | Medium6.8 |
| CVE-2025-6791 | Second order SQL injection available to user with low privilegeCentreon · web | High8.8 |
| CVE-2025-4650 | User with high privileges is able to introduce a SQLi using the Meta Service indicator pageCentreon · web | High7.2 |
| CVE-2025-4649 | ACL are not correctly taken into account in the display of the "event logs" page. This page requiring, high privileges, will display all available logs.Centreon · web | Medium4.9 |
| CVE-2025-4648 | A user with elevated privileges can inject XSS by altering the content of a SVG media during the submit request.Centreon · web | High8.4 |
| CVE-2025-4647 | A user with elevated privileges can bypass sanitization measures by replacing the content of an existing SVGCentreon · web | High8.4 |
| CVE-2025-4646 | A high privilege user is able to create and use a valid admin API token in centreon-webCentreon · web | High7.2 |
| CVE-2025-3872 | Privilege escalation by altering payload in contact formCentreon · Centreon | High7.2 |
| CVE-2025-3767 | SQL Injection in Centreon BAM boolean KPI listingCentreon · Centreon BAM | High7.2 |