Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 7 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 400,161All CVEsplus 18,875 rejected
- 813Last 24 hours3,232 in the last 7 days
- 17,421Last 30 days1,567 of them critical
- 1,767Known exploitedin the CISA KEV catalog
CVEs published per month
In the last 12 months, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| Nov 2026 | 1 | 3 | 17 | 0 | 0 | 21 | 19,291 |
| Oct 2026 | 171 | 444 | 453 | 3 | 0 | 1,071 | 19,270 |
| Sept 2026 | 23 | 182 | 173 | 1 | 0 | 379 | 18,199 |
| Aug 2026 | 121 | 255 | 132 | 0 | 0 | 508 | 17,820 |
| Jul 2026 | 48 | 227 | 205 | 1 | 0 | 481 | 17,312 |
| Jun 2026 | 142 | 424 | 165 | 0 | 0 | 731 | 16,831 |
| May 2026 | 15 | 40 | 67 | 0 | 0 | 122 | 16,100 |
| Apr 2026 | 7 | 36 | 171 | 1 | 0 | 215 | 15,978 |
| Mar 2026 | 80 | 421 | 197 | 1 | 0 | 699 | 15,763 |
| Feb 2026 | 30 | 158 | 193 | 1 | 0 | 382 | 15,064 |
| Jan 2026 | 38 | 256 | 260 | 1 | 0 | 555 | 14,682 |
| Dec 2025 | 23 | 273 | 563 | 6 | 0 | 865 | 14,127 |
| Nov 2025 | 23 | 100 | 94 | 1 | 0 | 218 | 13,262 |
| Title | ||
|---|---|---|
| CVE-2026-54851 | WordPress Contact Form by WPForms plugin <= 2.0.3 - Cross Site Scripting (XSS) vulnerabilityAwesomemotive · Contact Form by WPForms | High7.1 |
| CVE-2026-62000 | WordPress WCFM Marketplace plugin <= 3.8.2 - Broken Access Control vulnerabilityWC Lovers · WCFM Marketplace | High7.5 |
| CVE-2026-119509 | WordPress ClickCease Click Fraud Protection plugin <= 3.3.0 - Broken Access Control vulnerabilityeranfl · ClickCease Click Fraud Protection | Medium5.3 |
| CVE-2026-97072 | WordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerabilitymyCred · myCred | Medium4.3 |
| CVE-2026-114187 | WordPress AnyWhere Elementor plugin <= 1.3.0 - Broken Access Control vulnerabilityWPVibes · AnyWhere Elementor | Medium5.3 |
| CVE-2026-103077 | WordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerabilitymyCred · myCred | Medium4.3 |
| CVE-2026-114185 | WordPress AnyWhere Elementor plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerabilityWPVibes · AnyWhere Elementor | Medium6.5 |
| CVE-2026-119485 | WordPress Dokan plugin <= 5.3.2 - Broken Access Control vulnerabilityweDevs · Dokan | Medium5.3 |
| CVE-2026-39777 | WordPress WCFM Membership plugin <= 2.12.0 - Broken Access Control vulnerabilityWC Lovers · WCFM Membership | Medium4.3 |
| CVE-2026-119487 | WordPress Dokan plugin <= 5.3.2 - Broken Access Control vulnerabilityweDevs · Dokan | Medium5.3 |
| CVE-2026-120843 | WordPress Posts Table with Search & Sort plugin <= 1.4.14 - Cross Site Scripting (XSS) vulnerabilityBarn2 Plugins · Posts Table with Search & Sort | Medium6.5 |
| CVE-2026-114183 | WordPress AnyWhere Elementor plugin <= 1.3.0 - Sensitive Data Exposure vulnerabilityWPVibes · AnyWhere Elementor | Medium6.5 |
| CVE-2026-116859 | WordPress Forminator plugin <= 1.58.3 - Broken Access Control vulnerabilityWPMU DEV · Forminator | Medium5.3 |
| CVE-2026-116858 | WordPress Forminator plugin <= 1.58.3 - Content Injection vulnerabilityWPMU DEV · Forminator | Medium4.3 |
| CVE-2026-39743 | WordPress WCFM Membership plugin <= 2.12.0 - Broken Access Control vulnerabilityWC Lovers · WCFM Membership | Medium5.3 |
| CVE-2026-120846 | WordPress Uncanny Automator plugin <= 7.7.1 - Broken Access Control vulnerabilityUncanny Owl · Uncanny Automator | Medium5.3 |
| CVE-2026-119521 | WordPress Paid Member Subscriptions plugin <= 3.1.3 - Cross Site Scripting (XSS) vulnerabilityCozmoslabs · Paid Member Subscriptions | Medium6.5 |
| CVE-2026-119495 | WordPress Better Search plugin <= 4.5.2 - Broken Access Control vulnerabilityWebberZone · Better Search | Medium5.3 |
| CVE-2026-66570 | WordPress WordPress File Upload plugin <= 5.2.1 - Cross Site Scripting (XSS) vulnerabilityNickboss · WordPress File Upload | High7.1 |
| CVE-2026-119480 | WordPress JetFormBuilder plugin <= 3.6.7.1 - Attachment Deletion Via Media-Field Preset vulnerabilityCrocoblock · JetFormBuilder | Medium6.5 |
| CVE-2026-62048 | WordPress BookIt plugin <= 2.6.0.6 - SQL Injection vulnerabilityLiquid Web / StellarWP · BookIt | Critical9.3 |
| CVE-2026-118090 | WordPress MasterStudy LMS plugin <= 3.7.55 - PHP Object Injection vulnerabilityStylemix · MasterStudy LMS | High8.8 |
| CVE-2026-118089 | WordPress Product Feed Manager plugin <= 7.14.1 - PHP Object Injection vulnerabilityRexTheme · Product Feed Manager | High7.2 |
| CVE-2026-118086 | WordPress WP BASE Booking plugin <= 6.5.2 - Privilege Escalation vulnerabilityHakan Ozevin · WP BASE Booking | High8.8 |
| CVE-2026-116862 | WordPress WP REST Cache plugin <= 2026.3.1 - Broken Access Control vulnerabilityAcato · WP REST Cache | High7.5 |
| CVE-2026-116861 | WordPress Flexible Chat plugin <= 1.1.0 - Sensitive Data Exposure vulnerabilitywpdesk · Flexible Chat | High7.5 |
| CVE-2026-116854 | WordPress WP Customer Area plugin <= 8.4.0 - Cross Site Scripting (XSS) vulnerabilityAguila Technologies · WP Customer Area | Medium6.5 |
| CVE-2026-116853 | WordPress GiveWP plugin <= 4.19.0.1 - Broken Access Control vulnerabilityNexcess · GiveWP | Medium6.5 |
| CVE-2026-116852 | WordPress Widget Options plugin <= 4.2.5 - Remote Code Execution (RCE) vulnerabilityMarketing Fire · Widget Options | Critical9.1 |
| CVE-2026-116851 | WordPress eCommerce Product Catalog plugin <= 3.6.5 - Cross Site Scripting (XSS) vulnerabilityimpleCode · eCommerce Product Catalog | High7.1 |
| CVE-2026-116847 | WordPress Mang Board WP plugin <= 2.4.6 - Cross Site Scripting (XSS) vulnerabilityKitae Park · Mang Board WP | High7.1 |
| CVE-2026-116410 | WordPress Masteriyo - LMS plugin <= 3.4.3 - Arbitrary Content Deletion vulnerabilitymasteriyo · Masteriyo - LMS | Medium6.5 |
| CVE-2026-116405 | WordPress VikRentCar plugin <= 1.4.9 - Cross Site Scripting (XSS) vulnerabilitye4jvikwp · VikRentCar | High7.1 |
| CVE-2026-116401 | WordPress HUSKY plugin <= 1.4.6 - Broken Access Control vulnerabilityRealMag777 · HUSKY | High7.5 |
| CVE-2026-116386 | WordPress SMS Alert Order Notifications plugin <= 4.0.2 - Privilege Escalation vulnerabilityCozy Vision Technologies Pvt. Ltd. · SMS Alert Order Notifications | Critical9.8 |
| CVE-2026-115947 | WordPress HUSKY plugin <= 1.4.6 - Sensitive Data Exposure vulnerabilityRealMag777 · HUSKY | Medium6.5 |
| CVE-2026-115604 | WordPress SureDash plugin <= 1.12.3 - Arbitrary File Deletion vulnerabilityBrainstorm Force · SureDash | Medium5.0 |
| CVE-2026-114711 | WordPress MultiVendorX plugin <= 5.0.20 - Cross Site Scripting (XSS) vulnerabilityMultiVendorX · MultiVendorX | Medium6.5 |
| CVE-2026-107868 | WordPress YITH WooCommerce Product Add-Ons plugin <= 4.34.0 - Bypass Vulnerability vulnerabilityYITHEMES · YITH WooCommerce Product Add-Ons | Medium5.3 |
| CVE-2026-105077 | WordPress Ad Inserter plugin <= 2.8.19 - Cross Site Scripting (XSS) vulnerabilitySpacetime · Ad Inserter | High7.1 |
| CVE-2026-94175 | WordPress All In One Login plugin <= 2.4.1 - Cross Site Scripting (XSS) vulnerabilitySaad Iqbal · All In One Login | High7.1 |
| CVE-2026-90888 | WordPress LeadSnap plugin <= 1.25 - PHP Object Injection vulnerabilityleadsnap · LeadSnap | Critical9.8 |
| CVE-2026-78527 | WordPress GS Testimonial Slider plugin <= 3.3.10 - PHP Object Injection vulnerabilityGS Plugins · GS Testimonial Slider | High8.8 |
| CVE-2026-73186 | WordPress Enable Media Replace plugin <= 4.2.2 - PHP Object Injection vulnerabilityShortPixel · Enable Media Replace | High8.8 |
| CVE-2026-54855 | WordPress Profile Builder plugin <= 4.0.5 - Cross Site Scripting (XSS) vulnerabilityCozmoslabs · Profile Builder | High7.1 |
| CVE-2026-54854 | WordPress Profile Builder plugin <= 4.0.5 - Privilege Escalation vulnerabilityCozmoslabs · Profile Builder | Medium6.3 |
| CVE-2026-54850 | WordPress Booking and Rental Manager plugin <= 2.8.2 - Broken Access Control vulnerabilitymagepeopleteam · Booking and Rental Manager | Medium6.5 |
| CVE-2026-48201 | WordPress Fast Velocity Minify plugin <= 3.5.7 - Cross Site Scripting (XSS) vulnerabilityRaul P. · Fast Velocity Minify | High7.1 |
| CVE-2026-39786 | WordPress BA Book Everything plugin <= 1.8.33 - Cross Site Scripting (XSS) vulnerabilitybookingalgorithms · BA Book Everything | High7.1 |
| CVE-2026-39738 | WordPress FunnelKit Automations plugin <= 3.8.6.1 - PHP Object Injection vulnerabilityAman · FunnelKit Automations | Critical9.8 |