Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 4 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,803All CVEsplus 19,141 rejected
- 530Last 24 hours3,084 in the last 7 days
- 17,045Last 30 days1,600 of them critical
- 1,769Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 0 | 10 | 9 | 0 | 0 | 19 | 57 |
| 2025 | 1 | 2 | 10 | 1 | 0 | 14 | 38 |
| 2024 | 0 | 0 | 11 | 0 | 0 | 11 | 24 |
| 2023 | 5 | 0 | 3 | 0 | 0 | 8 | 13 |
| 2022 | 0 | 0 | 3 | 0 | 0 | 3 | 5 |
| 2021 | 0 | 0 | 1 | 0 | 0 | 1 | 2 |
| 2020 | 0 | 0 | 1 | 0 | 0 | 1 | 1 |
| Title | ||
|---|---|---|
| CVE-2026-85293 | InvoicePlane: Stored Cross-Site Scripting (XSS) via Client Email in Invoice and Quote Mailer FormsPublic exploitInvoicePlane · InvoicePlane | Medium4.8 |
| CVE-2026-79946 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutralization of Alternate…Dell · Secure Connect Gateway 5.0 - Application | Medium5.3 |
| CVE-2026-54002 | Kirby: Cross-site scripting (XSS) from incomplete HTML/XML sanitization in `Dom::sanitize()`getkirby · kirby | High8.5 |
| CVE-2026-55661 | TinaCMS rich-text (slatejson) rendering does not sanitize link/image URLs, allowing stored XSS via dangerous URL schemestinacms · tinacms | Medium4.8 |
| CVE-2026-55237 | AutoGPT SignUp Page has DOM-Based XSS and Open RedirectPublic exploitSignificant-Gravitas · AutoGPT | High8.8 |
| CVE-2026-46492 | md-fileserver: Stored/Reflected XSS when viewing Markdown (raw HTML allowed)Public exploitcommenthol · md-fileserver | High7.2 |
| CVE-2026-25688 | Apache Answer: XSS in AI Answer RenderingApache Software Foundation · Apache Answer | Medium6.1 |
| CVE-2026-45314 | Open WebUI: XSS via SVG in /api/v1/channels/webhooks/{webhook_id}/profile/imagePublic exploitopen-webui · open-webui | High7.4 |
| CVE-2026-42458 | Magento LTS: Reflected XSS - Import -> Data Flow (profiles)Public exploitOpenMage · magento-lts | Medium5.3 |
| CVE-2026-42235 | n8n: XSS via MCP OAuth clientn8n-io · n8n | High8.8 |
| CVE-2026-40321 | DotNetNuke.Core has stored cross-site-scripting (XSS) via SVG uploaddnnsoftware · Dnn.Platform | High8.1 |
| CVE-2025-14732 | Elementor Website Builder <= 3.35.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via REST APIelemntor · Elementor Website Builder – more than just a page builder | Medium6.4 |
| CVE-2026-22711 | Stored XSS through system messages in WikiLovePublic exploitThe Wikimedia Foundation · Mediawiki - Wikilove Extension | Medium6.9 |
| CVE-2026-35534 | ChurchCRM has Stored XSS in PersonView.php via Facebook Field Attribute InjectionPublic exploitChurchCRM · CRM | High7.6 |
| CVE-2026-33510 | DOM-Based XSS in Homarr /auth/login RedirectPublic exploithomarr-labs · homarr | High8.8 |
| CVE-2026-34598 | YesWiki has Persistant Blind XSS at "/?BazaR&vue=consulter"Public exploitYesWiki · yeswiki | High7.1 |
| CVE-2026-33506 | DOM-Based XSS in Ory Polis Login Pageory · polis | High8.8 |
| CVE-2025-52563 | Chamilo: Reflected XSS via page parameterchamilo · chamilo-lms | Medium5.1 |
| CVE-2026-27120 | Leaf-kit html escaping does not work on characters that are part of extended grapheme clusterPublic exploitvapor · leaf-kit | Medium6.1 |
| CVE-2025-54369 | Node-SAML SAML Authentication Bypassnode-saml · node-saml | Critical9.3 |
| CVE-2025-65961 | Contao is vulnerable to cross-site scripting in templatescontao · contao | Low3.3 |
| CVE-2025-48076 | Galette is vulnerable to Cross-site Scriptinggalette · galette | Medium5.3 |
| CVE-2025-62415 | bagisto - Cross Site Scripting (XSS) in TinyMCE Image Upload (HTML)Public exploitbagisto · bagisto | Medium6.9 |
| CVE-2025-62418 | bagisto - Cross Site Scripting (XSS) in TinyMCE Image Upload (SVG)Public exploitbagisto · bagisto | Medium6.9 |
| CVE-2025-62414 | bagisto - Cross Site Scripting (XSS) in Create New CustomerPublic exploitbagisto · bagisto | Medium6.9 |
| CVE-2025-8561 | Ova Advent <= 1.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodeovatheme · Ova Advent | Medium6.4 |
| CVE-2025-55291 | Shaarli allows reflected XSS via searchtags parameterPublic exploitshaarli · Shaarli | High7.1 |
| CVE-2025-48992 | Group-Office vulnerable to blind XSSPublic exploitIntermesh · groupoffice | Medium5.2 |
| CVE-2025-49137 | Hax CMS Stored Cross-Site Scripting vulnerabilityPublic exploithaxtheweb · issues | High8.5 |
| CVE-2025-48495 | Gokapi has stored XSS vulnerability in friendly name for API keysForceu · Gokapi | Medium4.8 |
| CVE-2025-48494 | Gokapi vulnerable to stored XSS via uploading file with malicious file nameForceu · Gokapi | Medium4.8 |
| CVE-2025-48366 | GroupOffice's Blind Stored XSS in Phone Number Field Enables Forced Redirect and Unauthorized ActionsPublic exploitIntermesh · groupoffice | Medium6.9 |
| CVE-2025-27793 | Vega vulnerable to Cross-site Scripting via RegExp.prototype[@@replace]vega · vega | Medium5.3 |
| CVE-2024-8505 | WordPress Infinite Scroll - Ajax Load More <= 7.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via button_label Parameterdcooney · Ajax Load More – Infinite Scroll, Load More, & Lazy Load | Medium6.4 |
| CVE-2024-43381 | reNgine vulnerable to Stored Cross-Site Scripting (XSS) via DNS Record PoisoningPublic exploityogeshojha · rengine | Medium5.0 |
| CVE-2024-4459 | Themesflat Addons For Elementor <= 2.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget Titlesthemesflat · Themesflat Addons For Elementor | Medium6.4 |
| CVE-2024-2657 | Font Farsi <= 1.6.6 - Authenticated (Administrator+) Stored Cross-Site Scriptingkhl32 · Font Farsi | Medium4.4 |
| CVE-2024-2618 | Elementor Header & Footer Builder <= 1.6.26 - Authenticated (Contributor+) Stored Cross-Site Scriptingbrainstormforce · Ultimate Addons for Elementor | Medium6.4 |
| CVE-2024-3666 | Opal Estate Pro – Property Management and Submission <= 1.7.6 - Authenticated (Contributor+) Stored Cross-Site Scriptingwpopal · Opal Estate Pro – Property Management and Submission | Medium6.4 |
| CVE-2024-3519 | Media Library Assistant <= 3.15 - Reflected Cross-Site Scripting via langdglingren · Media Library Assistant | Medium6.1 |
| CVE-2024-2750 | Exclusive Addons for Elementor <= 2.6.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widgettimstrifler · Exclusive Addons for Elementor | Medium6.4 |
| CVE-2024-3162 | Jeg Elementor Kit <= 2.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Testimonialjegtheme · Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress | Medium6.4 |
| CVE-2024-25640 | Improper Neutralization of Alternate XSS Syntax in iris-webdfir-iris · iris-web | Medium4.6 |
| CVE-2023-6446 | Calculated Fields Form <= 1.2.40 - Authenticated (Admin+) Stored Cross-Site Scriptingcodepeople · Calculated Fields Form | Medium4.4 |
| CVE-2023-50712 | Improper Neutralization of Alternate XSS Syntax in iris-webdfir-iris · iris-web | Medium4.6 |
| CVE-2023-20208 | A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to conduct an XSS attack against a user of the…Cisco · Cisco Identity Services Engine Software | Medium4.8 |
| CVE-2023-20188 | A vulnerability in the web-based management interface of Cisco Small Business 200 Series Smart Switches, Cisco Small Business 300 Series Managed Switches, and…Cisco · Cisco Small Business Smart and Managed Switches | Medium4.8 |
| CVE-2023-35161 | XWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in DeleteApplication pagexwiki · xwiki-platform | Critical9.7 |
| CVE-2023-35160 | XWiki Platform vulnerable to reflected cross-site scripting via back and xcontinue parameters in resubmit templatePublic exploitxwiki · xwiki-platform | Critical9.7 |
| CVE-2023-35159 | XWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in deletespace templatePublic exploitxwiki · xwiki-platform | Critical9.7 |