Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 9 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,955All CVEsplus 19,141 rejected
- 330Last 24 hours3,207 in the last 7 days
- 17,014Last 30 days1,575 of them critical
- 1,769Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 682 | 1,624 | 1,765 | 66 | 4 | 4,141 | 21,607 |
| 2025 | 488 | 798 | 2,691 | 23 | 0 | 4,000 | 17,466 |
| 2024 | 640 | 716 | 1,296 | 29 | 0 | 2,681 | 13,466 |
| 2023 | 603 | 599 | 821 | 4 | 1 | 2,028 | 10,785 |
| 2022 | 760 | 740 | 228 | 10 | 0 | 1,738 | 8,757 |
| 2021 | 305 | 350 | 81 | 0 | 0 | 736 | 7,019 |
| 2020 | 212 | 165 | 86 | 2 | 0 | 465 | 6,283 |
| 2019 | 308 | 198 | 39 | 2 | 0 | 547 | 5,818 |
| 2018 | 331 | 138 | 31 | 2 | 0 | 502 | 5,271 |
| 2017 | 334 | 144 | 25 | 1 | 0 | 504 | 4,769 |
| 2016 | 34 | 48 | 12 | 0 | 0 | 94 | 4,265 |
| 2015 | 1 | 129 | 83 | 0 | 0 | 213 | 4,171 |
| 2014 | 1 | 186 | 108 | 0 | 0 | 295 | 3,958 |
| 2013 | 0 | 111 | 35 | 0 | 0 | 146 | 3,663 |
| 2012 | 0 | 188 | 48 | 0 | 0 | 236 | 3,517 |
| 2011 | 0 | 261 | 28 | 0 | 0 | 289 | 3,281 |
| 2010 | 0 | 463 | 52 | 0 | 0 | 515 | 2,992 |
| 2009 | 0 | 804 | 144 | 0 | 0 | 948 | 2,477 |
| 2008 | 2 | 931 | 160 | 1 | 0 | 1,094 | 1,529 |
| 2007 | 1 | 239 | 40 | 0 | 0 | 280 | 435 |
| 2006 | 1 | 81 | 16 | 1 | 0 | 99 | 155 |
| 2005 | 0 | 46 | 5 | 0 | 0 | 51 | 56 |
| 2004 | 0 | 1 | 0 | 0 | 0 | 1 | 5 |
| 2003 | 0 | 3 | 0 | 0 | 0 | 3 | 4 |
| 2002 | 0 | 1 | 0 | 0 | 0 | 1 | 1 |
| Title | ||
|---|---|---|
| CVE-2026-123990 | DataEase Chart Data ExtWhere2Str.java ExtWhere2Str.extWhere2sqlOjb sql injectionDataEase | Medium6.9 |
| CVE-2026-103914 | Dynific Addons for Elementor (formerly Anywhere Elementor) <= 1.3 - Authenticated (Subscriber+) SQL Injection via 'q' Parameterwpvibes · Dynific Addons for Elementor (formerly Anywhere Elementor) | Medium6.5 |
| CVE-2026-116751 | Amelia Pro <= 9.9.1 - Unauthenticated SQL Injection via 'tag' Parameter Array KeysAmelia · Booking for Appointments and Events Calendar – Amelia Pro | High7.5 |
| CVE-2026-121265 | SQL::Abstract versions before 2.000003 for Perl allow SQL injection via an arrayref column value in insert and updateSQL-Abstract | Not scored |
| CVE-2026-95870 | wpForo Forum <= 3.2.1 - Unauthenticated SQL Injection via 'data' Parametertomdever · wpForo Forum | High7.5 |
| CVE-2026-119155 | wpForo Forum <= 3.2.2 - Unauthenticated SQL Injection via 'href[locale]' Parametertomdever · wpForo Forum | High7.5 |
| CVE-2026-121792 | GamiPress <= 8.1.1 - Authenticated (Subscriber+) SQL Injection via 'Gravity Forms Name/List Field' Parameterrubengc · GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI | Medium6.5 |
| CVE-2026-120530 | WebToffee WP Backup and Migration <= 1.6.1 - Authenticated (Subscriber+) SQL Injection via User Profile Biographywebtoffee · WebToffee WP Backup and Migration | Medium5.7 |
| CVE-2026-121536 | WP Data Access <= 5.5.90 - Authenticated (Subscriber+) SQL Injection via 'engine' Parameterpeterschulznl · WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps | Medium5.3 |
| CVE-2026-121858 | Event Tickets with Ticket Scanner < 3.2.9 - Authenticated SQLi via DataTables SearchPublic exploitUnknown · Event Tickets with Ticket Scanner | Medium6.3 |
| CVE-2026-17411 | Multiple Vulnerabilities in IBM API ConnectIBM · API Connect | High7.6 |
| CVE-2026-17407 | Multiple Vulnerabilities in IBM API ConnectIBM · API Connect | High8.5 |
| CVE-2026-17400 | Multiple Vulnerabilities in IBM API ConnectIBM · API Connect | High7.7 |
| CVE-2026-17396 | Multiple Vulnerabilities in IBM API ConnectIBM · API Connect | Critical9.6 |
| CVE-2026-17363 | Multiple Vulnerabilities in IBM API ConnectIBM · API Connect | High7.7 |
| CVE-2026-17345 | Multiple Vulnerabilities in IBM API ConnectIBM · API Connect | High7.7 |
| CVE-2026-17336 | Multiple Vulnerabilities in IBM API ConnectIBM · API Connect | Critical9.9 |
| CVE-2026-17134 | Multiple Vulnerabilities in IBM API ConnectIBM · API Connect | Critical9.9 |
| CVE-2026-17132 | Multiple Vulnerabilities in IBM API ConnectIBM · API Connect | Critical9.9 |
| CVE-2026-16854 | Multiple Vulnerabilities in IBM API ConnectIBM · API Connect | High7.7 |
| CVE-2026-120043 | Affiliate Program Suite <= 1.2.14 - Unauthenticated SQL Injection via 'email' Parameteriovamihai · Affiliate Program Suite — SliceWP Affiliates | High7.5 |
| CVE-2026-54349 | Chartbrew SQL injection in dashboard filter substitutionchartbrew · chartbrew | Critical9.8 |
| CVE-2026-62856 | FreeScout: Cross-User Notification Data Disclosure via LIKE Wildcard Injection in Polycast Channel Queryfreescout-help-desk · freescout | High7.7 |
| CVE-2026-123859 | SQL Injection via unescaped DataFrame column names in Snowflake Connector for Python and Snowflake Connector for Python (Universal Core)Snowflake · Snowflake Connector for Python | High8.1 |
| CVE-2026-121881 | Posit Workbench code-server session-state RPC (get_last_seen) SQL injectionPosit Software, PBC · Posit Workbench | Medium5.7 |
| CVE-2026-123491 | Craft CMS 4.0.0 before 4.18.9 Unauthenticated SQL Injection via GraphQL Eager-Load Selectcraftcms · cms | High8.8 |
| CVE-2026-123489 | Craft CMS 4.0.0 before 4.18.9 Blind SQL Injection via getNext/getPrev Criteriacraftcms · cms | High7.1 |
| CVE-2026-123488 | Craft CMS 4.0.0 before 4.18.9 SQL Injection via Element Search Endpointcraftcms · cms | Critical9.3 |
| CVE-2026-112341 | Wazuh before 4.14.9 SQL Injection via WazuhDBBackend _substitute_paramswazuh · wazuh | High7.1 |
| CVE-2026-109977 | YaySMTP <= 2.7.8 - Authenticated (Administrator+) SQL Injection via 'params[searchKey]' Parameteryaycommerce · YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports | Medium4.9 |
| CVE-2026-123087 | SQL injection in Atmira’s SIRECAtmira · SIREC | High8.7 |
| CVE-2026-110532 | Mail Mage <= 0.0.25 - Unauthenticated SQLi via 'ewp_unsubscribe' ParameterPublic exploitUnknown · Mail Mage | High8.6 |
| CVE-2025-71458 | FTS3 Web Monitoring 3.12.0 through 3.13.2 and 3.14.0 SQL Injection via /linkinfocern-fts · fts-monitoring | High8.7 |
| CVE-2026-63774 | Subnet Solutions PowerSYSTEM Center SQL InjectionSubnet Solutions · PowerSYSTEM Center 2024 | Critical9.4 |
| CVE-2026-88985 | Kubeflow Pipelines: SQL injection through unvalidated pagination tokens in Kubeflow Pipelines API serverkubeflow · pipelines | Medium6.5 |
| CVE-2026-111492 | SQL injection in the push notification handler of the MatchPoint Android appTPC Software · Matchpoint | High8.6 |
| CVE-2026-33944 | Dolibarr: SQL Injection in societe/class/societe.class.php via localtax1_value parameterDolibarr · dolibarr | High8.8 |
| CVE-2026-100359 | SuiteCRM: Authenticated SQL Injection In action_get_end_date functionSuiteCRM · SuiteCRM | Medium6.5 |
| CVE-2026-97377 | SuiteCRM: Authenticated SQL Injection in SOAP Portal Method portal_get_entry_listSuiteCRM · SuiteCRM | High8.8 |
| CVE-2026-100365 | SuiteCRM: Time-Based Blind SQL Injection via AOR_Reports ORDER BY Clause Allows Data Exfiltration by Any Authenticated UserSuiteCRM · SuiteCRM | High8.8 |
| CVE-2026-71548 | SuiteCRM: Authenticated SQL Injection in AOR_Reports `parameter_value` (value_type=Field) allows any low-privileged user to read the full databaseSuiteCRM · SuiteCRM | High8.8 |
| CVE-2026-69134 | SuiteCRM: SQL Injection via REST API securexss() Bypass in Relationship ManagementSuiteCRM · SuiteCRM | High8.8 |
| CVE-2026-69141 | SuiteCRM: SQL injection via search param in modules/Cases/controller.phpSuiteCRM · SuiteCRM | High8.3 |
| CVE-2026-69142 | SuiteCRM: Authenticated SQL Injection in map_markers distance ParameterSuiteCRM · SuiteCRM | High8.8 |
| CVE-2026-69140 | SuiteCRM: SQL injection via get_latest_for_id param in GetLatestRevision.phpSuiteCRM · SuiteCRM | High8.3 |
| CVE-2026-69145 | SuiteCRM: AOR Reports aor_fields.field SQL InjectionSuiteCRM · SuiteCRM | Medium6.5 |
| CVE-2026-69136 | SuiteCRM: Authenticated SQL Injection In handleAttachments functionSuiteCRM · SuiteCRM | High7.1 |
| CVE-2026-69135 | SuiteCRM: Authenticated SQL Injection In Project ModuleSuiteCRM · SuiteCRM | High7.1 |
| CVE-2026-61648 | SuiteCRM: SQL injection via parameter_value[0] param in AOR_Report.phpSuiteCRM · SuiteCRM | High8.3 |
| CVE-2026-61653 | SuiteCRM: SQL injection via id param in modules/Campaigns/PopupCampaignRoi.phpSuiteCRM · SuiteCRM | High8.3 |