Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 1 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,638All CVEsplus 19,141 rejected
- 668Last 24 hours2,951 in the last 7 days
- 17,123Last 30 days1,606 of them critical
- 1,769Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 1 | 8 | 9 | 2 | 0 | 20 | 35 |
| 2025 | 1 | 1 | 5 | 1 | 0 | 8 | 15 |
| 2024 | 0 | 2 | 0 | 0 | 0 | 2 | 7 |
| 2023 | 2 | 0 | 1 | 0 | 0 | 3 | 5 |
| 2022 | 0 | 0 | 1 | 0 | 0 | 1 | 2 |
| 2021 | 0 | 0 | 0 | 0 | 0 | 0 | 1 |
| 2020 | 0 | 0 | 0 | 1 | 0 | 1 | 1 |
| Title | ||
|---|---|---|
| CVE-2026-112356 | GFI KerioConnect < 10.0.9p2 XSS via Link Auto-FormatterGFI USA, LLC · GFI KerioConnect | Medium5.1 |
| CVE-2026-112353 | GFI KerioConnect < 10.0.8p2 Stored XSS via SVG AttachmentGFI USA, LLC · GFI KerioConnect | Medium6.2 |
| CVE-2026-61791 | OCO-Server: Stored XSS through agent hostnames in command buttonsschorschii · OCO-Server | High7.4 |
| CVE-2026-58391 | OPNsense: Stored XSS in Firewall Rules/NAT pages via a HTML-attribute breakoutopnsense · core | Medium5.4 |
| CVE-2026-108260 | @tinacms/web-components: `tina-markdown` writes rich-text link URLs into `href` without scheme validation, allowing stored XSStinacms · tinacms | High7.6 |
| CVE-2026-91127 | File Viewer: DOM XSS via unsafe hyperlink schemes in the legacy DOC rendererflyfish-dev · file-viewer | High8.2 |
| CVE-2026-45118 | MyBB: Contact page reflected XSSmybb · mybb | Critical9.3 |
| CVE-2026-45733 | Trilium: Stored XSS in note icon rendering leads to Remote Code Execution in Electron desktop appTriliumNext · Trilium | High8.3 |
| CVE-2026-15920 | Potential cross-site scripting via URLField values in the admindjangoproject · Django | Medium5.1 |
| CVE-2026-62324 | Jodit has incomplete javascript: scheme normalization in sanitizeHTMLElement href check that allows link XSSxdan · jodit | Medium5.4 |
| CVE-2026-59727 | Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islandswithastro · astro | Low2.1 |
| CVE-2026-49276 | Kirby: Self cross-site scripting (self-XSS) in the writer fieldgetkirby · kirby | High7.4 |
| CVE-2026-58263 | Jodit Editor: Mutation XSS in jodit clean-html via a MathML/style rawtext carrierxdan · jodit | High7.2 |
| CVE-2026-48591 | Stored XSS via unescaped HTML attribute values in earmarkpragdave · earmark | Medium4.8 |
| CVE-2026-53841 | OpenClaw < 2026.5.12 - Cross-Site Scripting via Unsafe Markdown Links in Exported Session HTMLOpenClaw · OpenClaw | Low2.1 |
| CVE-2026-53722 | Nuxt: Reflected XSS in `<NuxtLink>` via unsanitised `javascript:` or `data:` URLnuxt · nuxt | Medium5.1 |
| CVE-2026-45669 | Nuxt: Reflected XSS in `navigateTo()` external redirectnuxt · nuxt | Medium5.3 |
| CVE-2026-8245 | Concrete CMS 9.5.0 and below is vulnerable to Reflected XSS in Legacy Pagination via HTML attribute injectionConcrete CMS · Concrete CMS | Medium6.0 |
| CVE-2026-23516 | CVAT vulnerable to XSS via skeleton SVG imagescvat-ai · cvat | High8.6 |
| CVE-2026-22849 | Saleor lacks proper HTML sanitization in rich text fieldssaleor · saleor | High7.2 |
| CVE-2025-67163 | A stored cross-site scripting (XSS) vulnerability in Simple Machines Forum v2.1.6 allows attackers to execute arbitrary web scripts or HTML via injecting a… | Medium6.1 |
| CVE-2025-11682 | Stored Cross-Site Scripting in Perx Customer Engagement & Loyalty PlatformPerx Technologies · Customer Engagement & Loyalty Platform | High7.1 |
| CVE-2025-4615 | PAN-OS: Improper Neutralization of Input in the Management Web InterfacePalo Alto Networks · Cloud NGFW | Medium5.4 |
| CVE-2025-58746 | Volkov Labs Business Links plugin vulnerable to privilege escalation attackVolkovLabs · business-links | Critical9.1 |
| CVE-2025-0137 | PAN-OS: Improper Neutralization of Input in the Management Web InterfacePalo Alto Networks · Cloud NGFW | Medium4.8 |
| CVE-2025-0125 | PAN-OS: Improper Neutralization of Input in the Management Web InterfacePalo Alto Networks · Cloud NGFW | Medium6.9 |
| CVE-2024-9103 | Persistent XSS in blocked messagesForcepoint · Email Security | Medium6.1 |
| CVE-2025-27145 | copyparty renders unsanitized filenames as HTML when user uploads empty files9001 · copyparty | Low3.6 |
| CVE-2024-52595 | HTML Cleaner allows crafted scripts in special contexts like svg or math to pass throughfedora-python · lxml_html_clean | High7.7 |
| CVE-2024-26283 | An attacker could have executed unauthorized scripts on top origin sites using a JavaScript URI when opening an external URL with a custom Firefox scheme. This…Mozilla · Firefox for iOS | High7.8 |
| CVE-2023-37908 | org.xwiki.rendering:xwiki-rendering-xml Improper Neutralization of Invalid Characters in Identifiers in Web Pages vulnerabilityxwiki · xwiki-rendering | Critical9.1 |
| CVE-2023-30958 | DOM XSS in Developer mode dashboard via redirect GET parameterPalantir · com.palantir.foundry:foundry-frontend | Medium4.7 |
| CVE-2023-32070 | Improper Neutralization of Script in Attributes in XWiki (X)HTML renderersxwiki · xwiki-rendering | Critical9.1 |
| CVE-2022-39262 | Stored Cross-Site Scripting (XSS) on login page in GLPIglpi-project · glpi | Medium5.2 |
| CVE-2020-14525 | Philips Clinical Collaboration Platform Improper Neutralization of Script in Attributes in a Web PagePhilips · Clinical Collaboration Platform | Low3.5 |