Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 5 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 399,982All CVEsplus 18,869 rejected
- 683Last 24 hours3,262 in the last 7 days
- 17,348Last 30 days1,523 of them critical
- 1,766Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 14 | 17 | 187 | 32 | 77 | 327 | 585 |
| 2025 | 17 | 48 | 124 | 7 | 0 | 196 | 258 |
| 2024 | 3 | 2 | 4 | 0 | 0 | 9 | 62 |
| 2023 | 0 | 4 | 4 | 0 | 0 | 8 | 53 |
| 2022 | 2 | 3 | 7 | 0 | 0 | 12 | 45 |
| 2021 | 1 | 2 | 4 | 0 | 0 | 7 | 33 |
| 2020 | 1 | 1 | 0 | 0 | 0 | 2 | 26 |
| 2019 | 2 | 3 | 5 | 0 | 0 | 10 | 24 |
| 2018 | 2 | 3 | 5 | 0 | 0 | 10 | 14 |
| 2017 | 0 | 4 | 0 | 0 | 0 | 4 | 4 |
| Title | ||
|---|---|---|
| CVE-2026-110176 | File Force Download for Drupal 7 Access Bypass via Unconditional Download HeadersDrupal · File Force Download | High8.7 |
| CVE-2026-77152 | Field Collection for Drupal 7 access bypass via missing parent entity access checkDrupal · Field Collection for Drupal 7 | Medium5.3 |
| CVE-2026-107249 | Block AJAX - Highly critical - PHP object injection - SA-CONTRIB-2026-192Drupal · Block AJAX | Critical9.8 |
| CVE-2026-107250 | ECA Helper - Critical - Unsupported - SA-CONTRIB-2026-193Drupal · ECA Helper | Medium5.9 |
| CVE-2026-107251 | Entity Reference Manager (Merge entities) - Critical - Access bypass - SA-CONTRIB-2026-194Drupal · Entity Reference Manager (Merge entities) | Medium6.5 |
| CVE-2026-107252 | MathJax: LaTeX for Drupal - Critical - Cross site scripting - SA-CONTRIB-2026-195Drupal · MathJax: LaTeX for Drupal | Medium5.4 |
| CVE-2026-107253 | Orphans Media - Critical - Unsupported - SA-CONTRIB-2026-196Drupal · Orphans Media | Medium5.9 |
| CVE-2026-107254 | Authenticator Login Plus (2FA) - Critical - Improper authentication - SA-CONTRIB-2026-197Drupal · Authenticator Login Plus (2FA) | Medium4.8 |
| CVE-2026-107257 | Actstream - Critical - Access bypass - SA-CONTRIB-2026-198Drupal · Actstream | Medium6.5 |
| CVE-2026-107258 | Inline Entity Form Dialog - Moderately critical - Access bypass - SA-CONTRIB-2026-199Drupal · Inline Entity Form Dialog | Medium5.4 |
| CVE-2026-107259 | Linked Field - Moderately critical - Server-side template injection - SA-CONTRIB-2026-200Drupal · Linked Field | Medium5.4 |
| CVE-2026-107261 | Authenticator Login Plus (2FA) - Moderately critical - Improper authentication - SA-CONTRIB-2026-201Drupal · Authenticator Login Plus (2FA) | Medium4.2 |
| CVE-2026-107263 | Gutenberg - Moderately critical - Access bypass - SA-CONTRIB-2026-202Drupal · Gutenberg | Medium5.4 |
| CVE-2026-107264 | Inline Formatter Field - Moderately critical - Server-side template injection - SA-CONTRIB-2026-203Drupal · Inline Formatter Field | Medium5.4 |
| CVE-2026-107265 | Leaflet - Moderately critical - Cross site scripting - SA-CONTRIB-2026-204Drupal · Leaflet | Medium5.4 |
| CVE-2026-107266 | Views Share - Moderately critical - Access bypass - SA-CONTRIB-2026-205Drupal · Views Share | Not scored |
| CVE-2026-96389 | Xray Audit - Moderately critical - Access bypass - SA-CONTRIB-2026-206Drupal · Xray Audit | Medium6.5 |
| CVE-2026-107268 | Two Factor Authentication - TFA / Passwordless Login - Moderately critical - Information disclosure - SA-CONTRIB-2026-207Drupal · Two Factor Authentication - TFA / Passwordless Login | Medium4.3 |
| CVE-2026-107267 | DKAN - Moderately critical - Access bypass - SA-CONTRIB-2026-208Drupal · DKAN | Medium5.3 |
| CVE-2026-107306 | Menu Link Attributes - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-209Drupal · Menu Link Attributes | Low3.8 |
| CVE-2026-107307 | SmartLinker AI - Moderately critical - Information disclosure - SA-CONTRIB-2026-210Drupal · SmartLinker AI | Medium4.3 |
| CVE-2026-107308 | Country - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-211Drupal · Country | Low3.1 |
| CVE-2026-107309 | Easy Breadcrumb - Moderately critical - Information disclosure - SA-CONTRIB-2026-212Drupal · Easy Breadcrumb | Low3.7 |
| CVE-2026-107310 | Freelinking - Moderately critical - Information Disclosure - SA-CONTRIB-2026-213Drupal · Freelinking | Medium4.3 |
| CVE-2026-107311 | Permissions by Term - Moderately critical - Information disclosure - SA-CONTRIB-2026-214Drupal · Permissions by Term | Low3.7 |
| CVE-2026-107312 | Examples for Developers - Less critical - Allocation of resources without limits or throttling - SA-CONTRIB-2026-215Drupal · Examples for Developers | Medium4.3 |
| CVE-2026-107255 | Restrict route by IP - Critical - Access bypass - SA-CONTRIB-2026-216Drupal · Restrict route by IP | Not scored |
| CVE-2026-107262 | Advanced Filesystem - Moderately critical - Cross-Site Request Forgery - SA-CONTRIB-2026-217Drupal · Advanced Filesystem | Medium5.3 |
| CVE-2026-108097 | Drupal core - Critical - Remote code execution - SA-CORE-2026-014Drupal · Drupal core | Not scored |
| CVE-2026-110738 | Gin Admin Theme - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-219Drupal · Gin Admin Theme | Not scored |
| CVE-2026-108515 | Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-015Drupal · Drupal core | Not scored |
| CVE-2026-108514 | Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-016Drupal · Drupal core | Not scored |
| CVE-2026-108099 | Entity List - Critical - Remote code execution - SA-CONTRIB-2026-218Drupal · Entity List | Not scored |
| CVE-2026-114523 | Ffmpeg Image Toolkit - Highly critical - Remote Code Execution - SA-CONTRIB-2026-220Drupal · Ffmpeg Image Toolkit | Not scored |
| CVE-2026-114527 | UI Icons - Critical - Cross site scripting - SA-CONTRIB-2026-221Drupal · UI Icons | Not scored |
| CVE-2026-114528 | Zero Point - Critical - Cross-site scripting - SA-CONTRIB-2026-222Drupal · Zero Point | Not scored |
| CVE-2026-114526 | Black Hole - Critical - Cross-site scripting - SA-CONTRIB-2026-223Drupal · Black Hole | Not scored |
| CVE-2026-114525 | ABC - Critical - Cross-site scripting - SA-CONTRIB-2026-224Drupal · ABC | Not scored |
| CVE-2026-114524 | Custom Formatters - Critical - Remote code execution - SA-CONTRIB-2026-225Drupal · Custom Formatters | Not scored |
| CVE-2026-114529 | CSV Field - Moderately critical - Cross site Scripting - SA-CONTRIB-2026-226Drupal · CSV Field | Not scored |
| CVE-2026-114530 | Dopup - Critical - Information disclosure - SA-CONTRIB-2026-227Drupal · Dopup | Not scored |
| CVE-2026-114531 | Swiper formatter - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-228Drupal · Swiper formatter | Not scored |
| CVE-2026-107260 | Sector Distribution - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-229Drupal · Sector Distribution | Not scored |
| CVE-2026-114532 | UI Icons - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-230Drupal · UI Icons | Not scored |
| CVE-2026-114533 | Ágora Transparency Theme - Moderately critical - Information disclosure - SA-CONTRIB-2026-231Drupal · Ágora Transparency Theme | Not scored |
| CVE-2026-114534 | Block Attributes - Moderately critical - Cross site Scripting - SA-CONTRIB-2026-232Drupal · Block Attributes | Not scored |
| CVE-2026-114535 | Swiper formatter - Moderately critical - Information disclosure - SA-CONTRIB-2026-233Drupal · Swiper formatter | Not scored |
| CVE-2026-114536 | USWDS Paragraph Components - Moderately critical - Cross site scripting - SA-CONTRIB-2026-234Drupal · USWDS Paragraph Components | Not scored |
| CVE-2026-114537 | View Unpublished - Moderately critical - Access bypass - SA-CONTRIB-2026-235Drupal · View Unpublished | Not scored |
| CVE-2026-114538 | Bootstrap - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-236Drupal · Bootstrap | Not scored |