Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 10 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 400,561All CVEsplus 18,890 rejected
- 402Last 24 hours3,029 in the last 7 days
- 17,425Last 30 days1,598 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 21 | 24 | 19 | 4 | 0 | 68 | 591 |
| 2025 | 2 | 15 | 6 | 1 | 0 | 24 | 523 |
| 2024 | 10 | 22 | 11 | 2 | 0 | 45 | 499 |
| 2023 | 16 | 26 | 26 | 1 | 0 | 69 | 454 |
| 2022 | 5 | 16 | 12 | 0 | 0 | 33 | 385 |
| 2021 | 11 | 59 | 41 | 0 | 0 | 111 | 352 |
| 2020 | 8 | 46 | 44 | 1 | 0 | 99 | 241 |
| 2019 | 23 | 39 | 22 | 1 | 0 | 85 | 142 |
| 2018 | 13 | 16 | 23 | 0 | 0 | 52 | 57 |
| 2017 | 0 | 4 | 1 | 0 | 0 | 5 | 5 |
| Title | ||
|---|---|---|
| CVE-2026-119317 | Incorrect AuthorizationTenable, Inc. · Plugin Feed | Medium6.0 |
| CVE-2026-114437 | Chi Client IP Spoofing in ClientIPFromXFF via X-Forwarded-Forgo-chi · chi | Medium6.3 |
| CVE-2026-103946 | SQL InjectionTenable, Inc. · Nessus | High8.7 |
| CVE-2026-108125 | WordPress Post Author Authenticated SQLiwp-post-author | High7.1 |
| CVE-2026-108124 | WordPress Post Author Authenticated SQLiwp-post-author | Medium4.9 |
| CVE-2026-106126 | Command InjectionTenable, Inc. · Tenable Identity Exposure (SaaS) | Critical9.4 |
| CVE-2026-92626 | Control iD iDSecure Unauthenticated Denial of ServiceControl iD · iDSecure | High7.5 |
| CVE-2026-92625 | Control iD iDSecure Unauthenticated Denial of ServiceControl iD · iDSecure | High7.5 |
| CVE-2026-84860 | Scada-LTS DWR Authorization Bypass - SystemicScada-LTS · Scada-LTS | High8.8 |
| CVE-2026-84859 | Scada-LTS Authenticated Blind SQL InjectionScada-LTS · Scada-LTS | Medium6.5 |
| CVE-2026-84858 | Scada-LTS Authenticated Remote Code Execution via Scripting Sandbox BypassScada-LTS · Scada-LTS | High8.8 |
| CVE-2026-83492 | WordPress Kubio AI Website Builder - Denial Of ServiceExtend Themes · Kubio AI Website Builder | Medium6.9 |
| CVE-2026-82123 | WordPress Loops & Logic - Reflected XSSTangible · Loops & Logic | Medium6.5 |
| CVE-2026-19682 | Command InjectionTenable, Inc. · Security Center | Critical9.4 |
| CVE-2026-19681 | Command InjectionTenable, Inc. · Security Center | Critical9.4 |
| CVE-2026-19680 | SQL InjectionTenable, Inc. · Security Center | High7.1 |
| CVE-2026-19679 | Improper Input ValidationTenable, Inc. · Security Center | High8.7 |
| CVE-2026-19639 | Improper Access ControlTenable, Inc. · Security Center | Medium5.3 |
| CVE-2026-19636 | Insuffucient Protections Lead to Brute ForceTenable, Inc. · Security Center | Medium6.0 |
| CVE-2026-19635 | Local Privilege EscalationTenable, Inc. · Security Center | High8.5 |
| CVE-2026-19631 | SQL InjectionTenable, Inc. · Security Center | Medium6.9 |
| CVE-2026-19629 | Privilege EscalationTenable, Inc. · Security Center | High8.6 |
| CVE-2026-19628 | Remote Code ExecutionTenable, Inc. · Security Center | High8.6 |
| CVE-2026-19626 | Remote Code ExecutionTenable, Inc. · Security Center | Critical9.4 |
| CVE-2026-19657 | ScadaLTS Unauthenticated Reflected XSSSCADA-LTS · ScadaLTS | Medium6.1 |
| CVE-2026-19656 | ScadaLTS Authenticated Remote Code ExecutionSCADA-LTS · ScadaLTS | Critical9.9 |
| CVE-2026-19579 | Snipe-IT Checkout Request Cancellation IDORGrokability · Snipe-IT | Medium5.3 |
| CVE-2026-18667 | Sensor Proxy Version 1.4.2 Fixes One VulnerabilityTenable, Inc. · Sensor Proxy | Critical9.3 |
| CVE-2026-18197 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Link Library allows Cross-Site Scripting (XSS). This…Link Library | Medium6.4 |
| CVE-2026-64881 | Command InjectionTenable, Inc. · Security Center | High8.7 |
| CVE-2026-64880 | Blind SQL InjectionTenable, Inc. · Security Center | High7.1 |
| CVE-2026-64879 | Command InjectionTenable, Inc. · Security Center | Critical9.4 |
| CVE-2026-64878 | Command InjectionTenable, Inc. · Security Center | Critical9.4 |
| CVE-2026-64877 | An authenticated non-admin user can exploit a SQL injection flaw in the ticketing REST API to access sensitive data stored in the appliance database.Tenable, Inc. · Security Center | Critical9.4 |
| CVE-2026-15265 | Tenable Agent Path Traversal Leading to Remote Code Executiontenable · tenable_agent | Critical9.3 |
| CVE-2026-57588 | SQL Injection in Nessus via Malicious Scan Result File Importtenable · Nessus | Low1.6 |
| CVE-2026-57587 | SQL Injection in Nessus via Reverse DNS Lookuptenable · Nessus | Low2.1 |
| CVE-2026-13007 | Insecure Public Caching on REST API Endpoints in Tenable Identity Exposuretenable · Tenable Identity Exposure | High8.5 |
| CVE-2026-9646 | ScadaBR Unauthenticated Reflected Cross-Site ScriptingScadaBR · ScadaBR | Medium6.1 |
| CVE-2026-9645 | ScadaBR Authenticated Remote Code ExecutionScadaBR · ScadaBR | Critical9.9 |
| CVE-2026-8359 | Gladinet Triofox WOSHttpStatusModule.dll NULL Function Pointer Call DoSGladinet · Triofox | High7.5 |
| CVE-2026-8360 | Gladinet Triofox Unchecked Return Value to NULL Pointer Dereference DOSGladinet · Triofox | High7.5 |
| CVE-2026-8361 | Gladinet Triofox Path Traversal in WOSDefaultHttpModule.dllGladinet · Triofox | High7.5 |
| CVE-2026-8362 | Gladinet Triofox Stack-based Buffer Overflow in WOSDefaultHttpModule.dllGladinet · Triofox | Critical9.8 |
| CVE-2026-8363 | Gladinet Triofox Stack-based Buffer Overflow in WOSDeviceDropFolder.dllGladinet · Triofox | Critical9.8 |
| CVE-2026-8364 | Gladinet Triofox Missing Authentication for Critical FunctionsGladinet · Triofox | Critical9.8 |
| CVE-2026-9065 | Surecart - SQL Injectionbrainstormforce · Surecart | Critical9.3 |
| CVE-2026-9059 | NextGEN Gallery - SQL Injectionawesomemotive · NextGEN Gallery | Critical9.3 |
| CVE-2026-47358 | Terrascan v1.18.3 and prior are vulnerable to Server-Side Request Forgery (SSRF) via external URL resolution in uploaded IaC templates when running in server…tenable · Terrascan | Critical9.3 |
| CVE-2026-47357 | Terrascan v1.18.3 and prior are vulnerable to Server-Side Request Forgery (SSRF) via the remote_url parameter in the remote directory scan endpoint (POST…tenable · Terrascan | Critical9.3 |