Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 2 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 400,022All CVEsplus 18,873 rejected
- 715Last 24 hours3,283 in the last 7 days
- 17,380Last 30 days1,556 of them critical
- 1,766Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 136 | 508 | 1,177 | 201 | 7 | 2,029 | 6,223 |
| 2025 | 19 | 104 | 413 | 59 | 0 | 595 | 4,194 |
| 2024 | 32 | 121 | 604 | 16 | 0 | 773 | 3,599 |
| 2023 | 50 | 165 | 711 | 9 | 0 | 935 | 2,826 |
| 2022 | 93 | 204 | 836 | 11 | 0 | 1,144 | 1,891 |
| 2021 | 48 | 183 | 514 | 2 | 0 | 747 | 747 |
| Title | ||
|---|---|---|
| CVE-2026-91075 | Eupago Gateway For Woocommerce 4.5.0 - 4.7.5 - Unauthenticated Payment Confirmation BypassUnknown · Eupago Gateway For Woocommerce | Medium5.3 |
| CVE-2026-103327 | CryptoCloud - Crypto Payment Gateway 3.0.0 - 3.0.1 - Unauthenticated Arbitrary Order Payment Forgery via Empty-Default Webhook SecretUnknown · CryptoCloud | Medium5.3 |
| CVE-2026-104647 | weMail <= 2.1.6 - Editor+ Incorrect Authorization via User::can()Unknown · weMail | Not scored |
| CVE-2026-104648 | weMail <= 2.1.6 - Editor+ API Key DisclosureUnknown · weMail | Not scored |
| CVE-2026-103379 | WATI Chat and Notification <= 1.1.8 - Unauthenticated Customer Order PII Disclosure via Leaked API TokenUnknown · WATI Chat and Notification | Not scored |
| CVE-2026-105967 | Gallery for Social Photo <= 1.0.0.41 - Unauthenticated SSRF via next_url ParameterUnknown · Gallery for Social Photo | Not scored |
| CVE-2026-106004 | DT LMS <= 1.2 - Unauthenticated Arbitrary Course Completion RevocationUnknown · DT LMS | Not scored |
| CVE-2026-105993 | DT Directory Lite Addon <= 1.1 - Unauthenticated Plugin Settings UpdateUnknown · DT Directory Lite Addon | Not scored |
| CVE-2026-115205 | AZEXO Store Locator <= 1.4 - Subscriber+ Arbitrary Post Deletion via azt_delete_itemUnknown · AZEXO Store Locator | Not scored |
| CVE-2026-103310 | PayHere Payment Gateway 2.4.0 - 2.4.5 - Unauthenticated Payment Bypass via Unverified Payment NotificationUnknown · PayHere Payment Gateway | Medium5.3 |
| CVE-2026-118168 | MapPress Maps for WordPress < 2.97.15 - Unauthenticated Email Address DisclosureUnknown · MapPress | Medium5.3 |
| CVE-2026-113482 | Media Library Assistant < 3.44 - Contributor+ Stored XSS via mla_item_parameter Shortcode AttributeUnknown · Media Library Assistant | Medium6.8 |
| CVE-2026-113481 | Media Library Assistant < 3.44 - Subscriber+ Missing Authorization via mla-fill-compat-fieldsUnknown · Media Library Assistant | Medium4.3 |
| CVE-2026-107343 | Kali Forms < 2.4.30 - Subscriber+ Email Sending and Sender SpoofingUnknown · Kali Forms — Contact Form & Drag-and-Drop Builder | Medium4.3 |
| CVE-2026-107342 | Kali Forms < 2.4.30 - Subscriber+ User Email Address DisclosureUnknown · Kali Forms — Contact Form & Drag-and-Drop Builder | Medium4.3 |
| CVE-2026-94361 | PAYable IPG < 1.3.1 - Unauthenticated Order Payment Forgery via Unsigned CallbackUnknown · Payable Payment Gateway for WooCommerce | Medium5.3 |
| CVE-2026-82214 | Quick Event Manager 8.4.6 - 9.18 - Unauthenticated Private and Draft Content Disclosure via ICS DownloadUnknown · Quick Event Manager | Medium5.3 |
| CVE-2026-118638 | Mapster WP Maps < 2.0.6 - Unauthenticated Arbitrary Post Modification via save-mapmaker REST RouteUnknown · Mapster WP Maps | High7.5 |
| CVE-2026-118629 | All-in-One Video Gallery < 5.0.0 - Unauthenticated Private and Draft Video DisclosureUnknown · All-in-One Video Gallery | Medium5.3 |
| CVE-2026-118438 | Firelight Lightbox < 2.3.24 - Contributor+ Stored XSS via Image 'src' AttributeUnknown · Firelight Lightbox | Medium6.8 |
| CVE-2026-118437 | BuddyForms 2.8.8 - 2.10.0 - Unauthenticated Guest Attachment DeletionUnknown · BuddyForms | Low3.7 |
| CVE-2026-118185 | Security Optimizer < 1.6.9 - 2FA Bypass via Missing Rate LimitingUnknown · Security Optimizer | High7.5 |
| CVE-2026-118184 | Premium Packages < 7.2.2 - Unauthenticated Order Total ManipulationUnknown · Premium Packages | Medium5.3 |
| CVE-2026-118043 | Bulk Media Register < 2.01 - Author+ Arbitrary File Move via Path TraversalUnknown · Bulk Media Register | High7.2 |
| CVE-2026-110808 | Essential Addons for Elementor 6.6.0 - 6.8.7 - Author+ Privilege Escalation via register_user_roleUnknown · Essential Addons for Elementor | Medium4.2 |
| CVE-2026-110042 | Payment Forms for Paystack < 4.0.6 - Contributor+ Sensitive Information Disclosure via Settings PageUnknown · Payment Forms for Paystack | Medium4.9 |
| CVE-2026-111578 | PDF Invoices & Packing Slips for WooCommerce 5.16.2 - 5.16.4 - Unauthenticated Stored XSS via Order Address and Customer Note FieldsUnknown · PDF Invoices & Packing Slips for WooCommerce | High7.5 |
| CVE-2026-118165 | Firelight Lightbox < 2.3.23 - Contributor+ Stored XSS via Lightbox Link 'href' AttributeUnknown · Firelight Lightbox | Medium6.8 |
| CVE-2026-118101 | BuddyForms < 2.10.1 - Subscriber+ Arbitrary Post ModificationUnknown · BuddyForms | Medium5.3 |
| CVE-2026-118100 | BuddyForms < 2.10.3 - Unauthenticated Form Configuration DisclosureUnknown · BuddyForms | Medium5.3 |
| CVE-2026-118072 | Fraud Prevention For WooCommerce and EDD < 2.3.6 - Subscriber+ Arbitrary Customer BlacklistingUnknown · Fraud Prevention For WooCommerce and EDD | Medium5.4 |
| CVE-2026-118071 | Joinchat 6.3.2 - 6.4.1 - Author+ Stored XSS via Button Block Message AttributeUnknown · Joinchat | Medium6.8 |
| CVE-2026-117572 | WP Visitor Statistics (Real Time Traffic) < 8.8 - Admin+ SQLi via 'order' ParameterUnknown · WP Visitor Statistics (Real Time Traffic) | Medium4.1 |
| CVE-2026-117571 | WP Visitor Statistics (Real Time Traffic) < 8.8 - Unauthenticated Stored XSS via Tracker Device ParametersUnknown · WP Visitor Statistics (Real Time Traffic) | High8.8 |
| CVE-2026-115277 | WP User Frontend < 4.3.14 - Reflected XSS via 'field_attr' ParameterUnknown · User Frontend | Medium4.7 |
| CVE-2026-114444 | Security by CleanTalk < 2.191 - Admin+ Sensitive Data Disclosure via FSWatcher File ViewerUnknown · Security Plugin, Firewall & Malware Scanner with Auto Removal | Medium4.4 |
| CVE-2026-114443 | Security by CleanTalk < 2.191 - Unauthenticated Authentication Bypass via Authenticator App CodeUnknown · Security Plugin, Firewall & Malware Scanner with Auto Removal | High7.5 |
| CVE-2026-114422 | Enable Media Replace 4.1.4 - 4.2.2 - Unauthenticated PHP Object Injection via Metadata ReplacerUnknown · Enable Media Replace | High7.5 |
| CVE-2026-115303 | Contact Form by Supsystic < 1.11.1 - Unauthenticated CRLF / Email Header Injection via Reply-To Field MappingUnknown · Contact Form by Supsystic | Low3.7 |
| CVE-2026-86794 | Community Events 1.4.9 - 1.5.9 - Unauthenticated Stored XSS via Event Submission FormUnknown · Community Events | High8.8 |
| CVE-2026-85007 | YT Player < 2.1.4 - Contributor+ Missing Authorization via ytp_ajaxUnknown · Video Player for YouTube | Low3.8 |
| CVE-2026-115259 | Photo Engine < 6.6.0 - Author+ Arbitrary Content Modification via IDORUnknown · Photo Engine (Media Organizer & Lightroom) | Medium4.9 |
| CVE-2026-115245 | Chat AI with Dispatcher < 2.4 - Unauthenticated Arbitrary File UploadUnknown · Chat AI with Dispatcher | Critical9.8 |
| CVE-2026-114270 | GeoDirectory < 2.8.197 - Unauthenticated Password-Protected Listing Content DisclosureUnknown · GeoDirectory | Medium5.3 |
| CVE-2026-113617 | Automated Import Products to Cart < 1.0.4 - Subscriber+ Arbitrary File Read and Deletion via Path TraversalUnknown · Automated Import Products to Cart | Critical9.9 |
| CVE-2026-113616 | LogixFast Auth < 1.0.4 - Unauthenticated Account Takeover via Password ResetUnknown · LogixFast Auth | Critical9.8 |
| CVE-2026-111739 | Two Factor Authentication < 1.17.0 and All-In-One Security (AIOS) < 5.5.0 - Subscriber+ 2FA Bypass via 'creds_user_id' ParameterUnknown · Two Factor Authentication | High7.5 |
| CVE-2026-110983 | WP Photo Album Plus < 9.3.04.004 - Photo Comment Deletion via CSRFUnknown · WP Photo Album Plus | Medium4.3 |
| CVE-2026-110505 | Enable SVG, WebP, and ICO Upload < 1.1.6 - Author+ Stored XSS via SMIL Animation BypassUnknown · Enable SVG, WebP, and ICO Upload | Medium6.8 |
| CVE-2026-110504 | Enable SVG, WebP, and ICO Upload 1.1.3 - 1.1.5 - Author+ Stored XSS via SVG Sanitization BypassUnknown · Enable SVG, WebP, and ICO Upload | Medium6.8 |