Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 4 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,955All CVEsplus 19,141 rejected
- 311Last 24 hours3,207 in the last 7 days
- 16,987Last 30 days1,575 of them critical
- 1,769Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 14 | 97 | 147 | 13 | 0 | 271 | 503 |
| 2025 | 2 | 31 | 101 | 4 | 1 | 139 | 232 |
| 2024 | 2 | 9 | 30 | 1 | 0 | 42 | 93 |
| 2023 | 1 | 3 | 10 | 3 | 0 | 17 | 51 |
| 2022 | 0 | 1 | 6 | 1 | 0 | 8 | 34 |
| 2021 | 1 | 2 | 4 | 1 | 0 | 8 | 26 |
| 2020 | 4 | 0 | 5 | 1 | 0 | 10 | 18 |
| 2019 | 0 | 0 | 2 | 0 | 0 | 2 | 8 |
| 2018 | 1 | 2 | 2 | 0 | 0 | 5 | 6 |
| 2017 | 0 | 0 | 0 | 0 | 0 | 0 | 1 |
| 2016 | 0 | 0 | 0 | 0 | 0 | 0 | 1 |
| 2015 | 0 | 0 | 0 | 0 | 0 | 0 | 1 |
| 2014 | 0 | 0 | 0 | 0 | 0 | 0 | 1 |
| 2013 | 0 | 0 | 1 | 0 | 0 | 1 | 1 |
| Title | ||
|---|---|---|
| CVE-2026-123551 | OpenAM 14.0.0 before 16.1.4 Session Token Disclosure via Notification WebSocketOpenIdentityPlatform · OpenAM | Critical10.0 |
| CVE-2026-123513 | Vikunja before 2.7.1 Auth Token Leak via API URL Changego-vikunja · vikunja | High7.6 |
| CVE-2026-119465 | WordPress Elementor Addon Elements plugin <= 1.15 - Sensitive Data Exposure vulnerabilityWPVibes · Elementor Addon Elements | Medium5.3 |
| CVE-2026-71863 | SecureDrop: Onion Service client auth credentials copied to Monitor Serverfreedomofpress · securedrop | Low2.6 |
| CVE-2026-123290 | In JetBrains Datalore before 2026.4 hidden notebook code was exposed to unauthenticated users via the public interactive report content endpointJetBrains · Datalore | Medium5.3 |
| CVE-2026-119499 | WordPress FloristPress plugin <= 7.8.4 - Sensitive Data Exposure vulnerabilityBAKKBONE Australia · FloristPress | High7.5 |
| CVE-2026-111753 | Angular: XSRF Token Leakage via URL Parsing Discrepancy in Angular HTTP Client (Incomplete fix for CVE-2025-66035)angular · angular | Medium5.9 |
| CVE-2026-120716 | Insertion of sensitive information into sent data in the identity provider user synchronization in Devolutions Server 2026.3.13.0 and earlier allows an…Devolutions · Server | Medium6.5 |
| CVE-2026-114183 | WordPress AnyWhere Elementor plugin <= 1.3.0 - Sensitive Data Exposure vulnerabilityWPVibes · AnyWhere Elementor | Medium6.5 |
| CVE-2026-115293 | Insertion of Sensitive Information Into Sent Data in Kibana Leading to Credential DisclosureElastic · Kibana | Medium6.5 |
| CVE-2026-121554 | cordova-plugin-advanced-http 1.5.0 through 3.3.1 Cookie Leak via Cross-Origin Redirectssilkimen · cordova-plugin-advanced-http | High8.2 |
| CVE-2026-88811 | Rancher credentials disclosed to third-party hosts by the Rancher Manager meta proxySUSE · Rancher | Critical9.1 |
| CVE-2026-116861 | WordPress Flexible Chat plugin <= 1.1.0 - Sensitive Data Exposure vulnerabilitywpdesk · Flexible Chat | High7.5 |
| CVE-2026-115947 | WordPress HUSKY plugin <= 1.4.6 - Sensitive Data Exposure vulnerabilityRealMag777 · HUSKY | Medium6.5 |
| CVE-2026-119564 | Plausible Analytics through 3.2.1 Site Takeover via Exposed Invitation IDsPlausible · Plausible Analytics | Medium6.0 |
| CVE-2026-107268 | Two Factor Authentication - TFA / Passwordless Login - Moderately critical - Information disclosure - SA-CONTRIB-2026-207Drupal · Two Factor Authentication - TFA / Passwordless Login | Medium4.3 |
| CVE-2026-45049 | OpenAM Session Hijacking via CDSSOOpenIdentityPlatform · OpenAM | High8.3 |
| CVE-2026-118083 | WordPress WP Crowdfunding plugin <= 2.2.2 - Sensitive Data Exposure vulnerabilityThemeum · WP Crowdfunding | High7.5 |
| CVE-2026-48200 | WordPress Document Library Lite plugin <= 1.3.0 - Sensitive Data Exposure vulnerabilityBarn2 Plugins · Document Library Lite | Medium5.3 |
| CVE-2026-114173 | The Ortto plugin for WordPress before 1.0.25 did not filter the WooCommerce product data it embedded in public storefront pages. An unauthenticated threat…canva · ortto | Medium5.3 |
| CVE-2026-115591 | WordPress Contact Form by Supsystic plugin <= 1.10.5 - Sensitive Data Exposure vulnerabilitySupsystic · Contact Form by Supsystic | High7.5 |
| CVE-2026-116689 | follow-redirects: Cross-realm sensitiveHeaders arrays are discarded and custom credentials can follow redirectsPublic exploitfollow-redirects · follow-redirects | Medium5.9 |
| CVE-2026-115594 | WordPress Media LIbrary Assistant plugin <= 3.42 - Sensitive Data Exposure vulnerabilityDavid Lingren · Media LIbrary Assistant | Medium6.5 |
| CVE-2026-114190 | WordPress LiteSpeed Cache plugin <= 7.9 - Sensitive Data Exposure vulnerabilityHai Zheng / Lite Speed Cache · LiteSpeed Cache | Medium5.9 |
| CVE-2026-53920 | odhcpd DHCPv6 Short IA_NA/IA_PD Body Stack Disclosureopenwrt · odhcpd | High8.7 |
| CVE-2026-114485 | Insufficient protection of sensitive information in the user list endpoint in Devolutions Server 2026.3.10.0 and earlier allows an authenticated attacker with…Devolutions · Server | Medium4.3 |
| CVE-2026-105777 | Insertion of Sensitive Information Into Sent Data in GitLabPublic exploitGitLab · GitLab | Medium4.3 |
| CVE-2026-87863 | HSTS response erases persisted entriesPublic exploitcurl · curl | High8.1 |
| CVE-2026-87862 | HSTS cache import drops longer-lived childPublic exploitcurl · curl | High8.1 |
| CVE-2026-87861 | cross-origin reuse of a Negotiate connectionPublic exploitcurl · curl | Critical9.1 |
| CVE-2026-86415 | auto client cert connection reuse mixupcurl · curl | High7.5 |
| CVE-2026-86414 | leaking host credentials to HTTP proxyPublic exploitcurl · curl | Critical9.1 |
| CVE-2026-86413 | Negotiate credentials sent to redirected originPublic exploitcurl · curl | Critical9.1 |
| CVE-2026-86409 | stale SigV4 headers sent unintendedPublic exploitcurl · curl | High8.1 |
| CVE-2026-113459 | Sensitive Data Exposure in extension "TYPO3 AI Integration Extension" (ns_t3ai)TYPO3 · Extension "TYPO3 AI Integration Extension" | High7.1 |
| CVE-2026-19603 | Private channel ID disclosure via user status endpointsMattermost · Mattermost | Medium4.3 |
| CVE-2026-19601 | Disclosure of AD/LDAP bind password via Test ConnectionMattermost · Mattermost | Medium4.9 |
| CVE-2026-19541 | Outgoing OAuth connection client secret exposure during connection validationMattermost · Mattermost | Medium6.5 |
| CVE-2026-110361 | WordPress Infinite Uploads plugin <= 3.4.1 - Sensitive Data Exposure vulnerabilityClikIT · Infinite Uploads | Medium6.5 |
| CVE-2026-109695 | WordPress FluentCart plugin <= 1.7.1 - Sensitive Data Exposure vulnerabilityWPManageNinja · FluentCart | High7.5 |
| CVE-2026-75559 | The smartphone application "Vehicle Inspection Certificate Viewer" contains a vulnerability in which sensitive information may be included in data transmitted…Ministry of Land, Infrastructure, Transport and Tourism · Vehicle Inspection Certificate Viewer (for Android) | Medium6.9 |
| CVE-2026-66822 | .NET Information Disclosure VulnerabilityMicrosoft · .NET 10.0 runtime | Medium5.9 |
| CVE-2026-89203 | A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly restrict access to various database queries,…Siemens · RUGGEDCOM CROSSBOW | Medium5.3 |
| CVE-2026-108489 | WordPress Active Products Tables for WooCommerce plugin <= 2.1.3 - Sensitive Data Exposure vulnerabilityPluginUs.Net · Active Products Tables for WooCommerce | Medium5.3 |
| CVE-2026-52394 | DeepSeek V4 is vulnerable to Incorrect Access Control via a crafted input.Public exploit | Critical9.1 |
| CVE-2023-25996 | WordPress Booster Elite for WooCommerce plugin < 8.4.0 - Authenticated Arbitrary WordPress Option Disclosure vulnerabilityPluggabl LLC. · Booster Elite for WooCommerce | Medium6.5 |
| CVE-2026-107761 | Channel tokens and organization API key exposed in API responsesGitroomHQ · postiz-app | Medium5.3 |
| CVE-2026-62043 | WordPress Contact Form 7 – Dynamic Text Extension plugin <= 5.0.7 - Sensitive Data Exposure vulnerabilitysevenspark · Contact Form 7 – Dynamic Text Extension | High7.5 |
| CVE-2026-42630 | WordPress Web Plura Backup & Restore Manager plugin <= 0.2.25 - Sensitive Data Exposure vulnerabilityWeb Plura · Web Plura Backup & Restore Manager | High7.5 |
| CVE-2026-42419 | WordPress Swish Migrate and Backup plugin <= 1.4.0 - Sensitive Data Exposure vulnerabilitySwishFolio · Swish Migrate and Backup | Medium5.9 |