Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 9 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 400,986All CVEsplus 19,118 rejected
- 418Last 24 hours2,844 in the last 7 days
- 16,806Last 30 days1,543 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 95 | 128 | 159 | 1 | 0 | 383 | 534 |
| 2025 | 10 | 18 | 21 | 3 | 0 | 52 | 151 |
| 2024 | 2 | 1 | 18 | 0 | 0 | 21 | 99 |
| 2023 | 11 | 3 | 17 | 0 | 0 | 31 | 78 |
| 2022 | 3 | 2 | 11 | 0 | 0 | 16 | 47 |
| 2021 | 3 | 4 | 17 | 0 | 0 | 24 | 31 |
| 2020 | 1 | 4 | 2 | 0 | 0 | 7 | 7 |
| Title | ||
|---|---|---|
| CVE-2026-115451 | Joomla Extension - tassos.gr - File deletion through improper access control in Advanced Custom Fields extension 2.8.13-2.8.15, 3.1.4-3.1.8 and Smile Pack 1.2.7-1.2.9, 2.1.2-2.1.6tassos.gr · Advanced Custom Fields extension for Joomla | Medium6.9 |
| CVE-2026-118494 | Joomla Extension - jreviews.com - Secret configs cached in a web-accessible in JReviews 1.0.0-5.12.0, 6.0.0-6.6.9jreviews.com · JReviews component for Joomla | High8.2 |
| CVE-2026-107129 | Joomla Extension - balbooa.com - Unauthenticated arbitrary file deletion via path traversal in Gridbox < 2.20.5.0balbooa.com · Gridbox extension for Joomla | High8.3 |
| CVE-2026-107130 | Joomla Extension - balbooa.com - Unauthenticated deletion of submission/field files in Gridbox < 2.20.5.0balbooa.com · Gridbox extension for Joomla | Medium6.9 |
| CVE-2026-107903 | Joomla Extension - balbooa.com - Stored XSS in reviews via inconsistent sanitization in Gridbox < 2.20.5.0balbooa.com · Gridbox extension for Joomla | High8.6 |
| CVE-2026-105607 | Joomla Extension - balbooa.com - Unauthenticated stored XSS in the "Recent Comments / Recent Reviews" widget in Gridbox < 2.20.5.0balbooa.com · Gridbox extension for Joomla | High8.6 |
| CVE-2026-115452 | Joomla Extension - tassos.gr - Privileged stored XSS in Advanced Custom Fields 2.8.2-2.8.15, 3.0.0-3.1.8 and Smile Pack 1.1.2-1.2.9, 2.0.0-2.1.6tassos.gr · Advanced Custom Fields extension for Joomla | High7.5 |
| CVE-2026-105606 | Joomla Extension - joomlaboat.com - Unauthenticated arbitrary file upload in Custom Tables < 3.7.8joomlaboat.com · Custom Tables extension for Joomla | Critical9.5 |
| CVE-2026-105605 | Joomla Extension - dj-extensions.com - IDOR vulnerability allowing cross-account ad access in DJ-Classifieds < 3.11.3dj-extensions.com · DJ-Classifieds extension for Joomla | Medium5.3 |
| CVE-2026-105604 | Joomla Extension - dj-extensions.com - Unauthenticated SQL injection in DJ-Classifieds < 3.11.3dj-extensions.com · DJ-Classifieds extension for Joomla | Critical9.3 |
| CVE-2026-105603 | Joomla Extension - dj-extensions.com - Authenticated arbitrary file upload in DJ-Classifieds < 3.11.3dj-extensions.com · DJ-Classifieds extension for Joomla | Critical9.4 |
| CVE-2026-102802 | Joomla Extension - regularlabs.com - PHP code injection vector in Sourcerer extension < 17.0.1 when used with Articles Anywhere extension < 20.1.1regularlabs.com · Sourcerer Free extension for Joomla | High8.9 |
| CVE-2026-103419 | Joomla Extension - joomshaper.com - Stored Cross-Site Scripting (XSS) in Media Picker in Helix Ultimate < 2.2.11.joomshaper.com · Helix Ultimate extension for Joomla | High8.6 |
| CVE-2026-103420 | Joomla Extension - php-web-design.com - CSRF for various actions in StageIt 1.0-5.7.5, 6.0-6.3.5php-web-design.com · StageIt extension for Joomla | High7.2 |
| CVE-2026-105600 | Joomla Extension - php-web-design.com - RCE via setting strings in StageIt 1.0-5.7.5, 6.0-6.3.5php-web-design.com · StageIt extension for Joomla | High8.6 |
| CVE-2026-105601 | Joomla Extension - php-web-design.com - Reflected XSS in StageIt 1.0-5.7.5, 6.0-6.3.5php-web-design.com · StageIt extension for Joomla | Medium5.3 |
| CVE-2026-105602 | Joomla Extension - joomshaper.com - Stored Cross-Site Scripting (XSS) in Mega Menu Badge Text in Helix Ultimate < 2.2.11.joomshaper.com · Helix Ultimate extension for Joomla | High8.6 |
| CVE-2026-102801 | Joomla Extension - regularlabs.com - Exposure of Sensitive Information to Unauthorized Actor in Users Anywhere extension for Joomla < 3.0.1regularlabs.com · Users Anywhere (Free, Pro) extension for Joomla | Medium5.1 |
| CVE-2026-102790 | Joomla Extension - icagenda.com - Authenticated Stored XSS in iCagenda 4.0.8 to 4.0.12icagenda.com · iCagenda extension for Joomla | High8.6 |
| CVE-2026-102799 | Joomla Extension - icagenda.com - CSV formula injection in the registrations export in iCagenda 3.5.0 to 4.0.16icagenda.com · iCagenda extension for Joomla | Medium5.3 |
| CVE-2026-102800 | Joomla Extension - dj-extensions.com - Unauthenticated Stored XSS in DJ-HelpfulArticles < 1.3.0dj-extensions.com · DJ-HelpfulArticles extension for Joomla | High8.7 |
| CVE-2026-102787 | Joomla Extension - phoca.cz - CSRF in category management in Phoca Download 3.1.0 - 6.1.5phoca.cz · Phoca Download extension for Joomla | Medium5.3 |
| CVE-2026-102788 | Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.4.2balbooa.com · Gridbox extension for Joomla | Critical9.3 |
| CVE-2026-102789 | Joomla Extension - balbooa.com - Missing Authorization Check on Editor Controller Task in Gridbox < 2.20.4.2balbooa.com · Gridbox extension for Joomla | Critical9.3 |
| CVE-2026-102786 | Joomla Extension - phoca.cz - Authenticated stored cross-site scripting through HTML attribute injection in Phoca Gallery 4.5.0 - 6.1.5phoca.cz · Phoca Gallery extension for Joomla | High8.6 |
| CVE-2026-102785 | Joomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro 5.0.0-5.0.52yootheme.com · YOOtheme Pro extension for Joomla | Critical10.0 |
| CVE-2026-102783 | Joomla Extension - balbooa.com - Path Traversal in image preview Gridbox < 2.20.4.0balbooa.com · Gridbox extension for Joomla | Medium6.3 |
| CVE-2026-102784 | Joomla Extension - balbooa.com - CSRF in language installation feature Gridbox < 2.20.4.0balbooa.com · Gridbox extension for Joomla | High8.7 |
| CVE-2026-102782 | Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Simple Membership < 7.4.0ordasoft.com · OrdaSoft Simple Membership extension for Joomla | Critical9.3 |
| CVE-2026-102781 | Joomla Extension - ordasoft.com - Unauthenticated Destructive CRUD in OrdaSoft Touch Slider < 5.4.6ordasoft.com · Touch Slider extension for Joomla | Medium6.9 |
| CVE-2026-102779 | Joomla Extension - joomlafry.com - Unauthenticated forced execution of published automation tasks in TF Content 2.9.0 - 2.9.4joomlafry.com · TF Content for Joomla | Medium6.9 |
| CVE-2026-102777 | Joomla Extension - svenbluege.de - Server-side request forgery in the Google Photos picker in Event Gallery extension < 6.6.0svenbluege.de · Event Gallery for Joomla | Medium6.3 |
| CVE-2026-102426 | Joomla Extension - joomshaper.com - Reflected XSS in the Dynamic Content Filter addon in SP Page Builder Pro 3.0.0 - 5.6.1p2joomshaper.com · SP Page Builder (Pro) extension for Joomla | Medium5.3 |
| CVE-2026-102778 | Joomla Extension - svenbluege.de - Cross-site scripting and open redirect on the share mini page in Event Gallery extension < 6.6.0svenbluege.de · Event Gallery for Joomla | Medium5.3 |
| CVE-2026-102780 | Joomla Extension - joomlafry.com - Unauthenticated cross-record publication and mass assignment in TF Content 2.9.0 - 2.9.4joomlafry.com · TF Content for Joomla | Medium6.9 |
| CVE-2026-102776 | Joomla Extension - svenbluege.de - Cross-site request forgery of list tasks of the backend in Event Gallery extension < 6.6.0svenbluege.de · Event Gallery for Joomla | Medium5.1 |
| CVE-2026-102775 | Joomla Extension - phoca.cz - Authorisation bypass through user-controlled key (IDOR) in Order View in Phoca Cart 5.0.0 - 6.1.8phoca.cz · Phoca Cart extension for Joomla | High8.7 |
| CVE-2026-102428 | Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Joomla CCK < 8.3.16ordasoft.com · OrdaSoft Joomla CCK | Critical9.3 |
| CVE-2026-102427 | Joomla Extension - ordasoft.com - Unauthenticated Remote Code Execution in OrdaSoft Joomla CCK < 8.3.16ordasoft.com · OrdaSoft Joomla CCK | Critical10.0 |
| CVE-2026-76570 | Joomla Extension - joomcode.com - Unauthenticated SQL injection in read and write queries in JCTables < 1.21.1joomcode.com · JCTables extension for Joomla | Critical10.0 |
| CVE-2026-102424 | Joomla Extension - balbooa.com - Unauthenticated path traversal exfiltrates local files through auto-reply attachments in Balbooa Forms < 2.4.3.4balbooa.com · Balbooa Forms extension for Joomla | High8.9 |
| CVE-2026-102425 | Joomla Extension - balbooa.com - Unauthenticated RCE via field shortcode injection in Balbooa Forms < 2.4.3.4balbooa.com · Balbooa Forms extension for Joomla | Critical9.5 |
| CVE-2026-101126 | Joomla Extension - balbooa.com - File meta data tampering in Balbooa Forms < 2.4.3.4balbooa.com · Balbooa Forms extension for Joomla | Medium6.9 |
| CVE-2026-101112 | Joomla Extension - balbooa.com - Unauthorized Deletion of Attachments in Balbooa Forms < 2.4.3.4balbooa.com · Balbooa Forms extension for Joomla | Medium6.9 |
| CVE-2026-101127 | Joomla Extension - balbooa.com - Unauthenticated upload filename stored XSS in Balbooa Forms < 2.4.3.4balbooa.com · Balbooa Forms extension for Joomla | High8.6 |
| CVE-2026-90915 | Joomla! Core - [20260905] - Core - Arbitrary directory deletion via cache purge action in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3Joomla! Project · Joomla! CMS | High7.0 |
| CVE-2026-92226 | Joomla! Core - [20260913] - Core - Improper ACL checks for varous webservice edit tasks in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3Joomla! Project · Joomla! CMS | High7.0 |
| CVE-2026-92224 | Joomla! Core - [20260911] - Core - XSS in link toolbar layout in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3Joomla! Project · Joomla! CMS | Medium5.9 |
| CVE-2026-90907 | Joomla! Core - [20260902] - Core - Unauthorized user account creation via profile.save controller in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3Joomla! Project · Joomla! CMS | Medium6.9 |
| CVE-2026-90914 | Joomla! Core - [20260904] - Core - XSS in the generic media output layouts in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3Joomla! Project · Joomla! CMS | Medium5.9 |