Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 7 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,764All CVEsplus 19,141 rejected
- 677Last 24 hours3,064 in the last 7 days
- 17,175Last 30 days1,610 of them critical
- 1,769Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 10,288 | 37,588 | 38,072 | 3,583 | 3,356 | 92,887 | 401,764 |
| 2025 | 4,112 | 16,077 | 25,458 | 1,593 | 910 | 48,150 | 308,877 |
| 2024 | 3,797 | 14,238 | 20,399 | 1,473 | 17 | 39,924 | 260,727 |
| 2023 | 3,449 | 10,002 | 13,984 | 1,407 | 5 | 28,847 | 220,803 |
| 2022 | 3,784 | 9,612 | 10,564 | 1,035 | 4 | 24,999 | 191,956 |
| 2021 | 2,539 | 8,322 | 8,645 | 671 | 0 | 20,177 | 166,957 |
| 2020 | 2,641 | 7,534 | 7,664 | 524 | 0 | 18,363 | 146,780 |
| 2019 | 2,561 | 7,062 | 7,310 | 375 | 0 | 17,308 | 128,417 |
| 2018 | 2,530 | 7,395 | 6,336 | 249 | 0 | 16,510 | 111,109 |
| 2017 | 2,116 | 6,601 | 5,690 | 235 | 0 | 14,642 | 94,599 |
| 2016 | 883 | 2,905 | 2,448 | 221 | 0 | 6,457 | 79,957 |
| 2015 | 51 | 2,352 | 3,503 | 588 | 0 | 6,494 | 73,500 |
| 2014 | 27 | 1,926 | 5,318 | 657 | 0 | 7,928 | 67,006 |
| 2013 | 22 | 1,736 | 2,913 | 516 | 0 | 5,187 | 59,078 |
| 2012 | 25 | 1,720 | 3,035 | 508 | 0 | 5,288 | 53,891 |
| 2011 | 4 | 1,785 | 2,101 | 260 | 0 | 4,150 | 48,603 |
| 2010 | 27 | 2,093 | 2,241 | 278 | 0 | 4,639 | 44,453 |
| 2009 | 15 | 2,734 | 2,786 | 197 | 0 | 5,732 | 39,814 |
| 2008 | 19 | 2,854 | 2,613 | 187 | 0 | 5,673 | 34,082 |
| 2007 | 22 | 3,446 | 3,478 | 265 | 0 | 7,211 | 28,409 |
| 2006 | 12 | 2,828 | 3,491 | 554 | 0 | 6,885 | 21,198 |
| 2005 | 26 | 2,594 | 3,498 | 590 | 0 | 6,708 | 14,313 |
| 2004 | 6 | 829 | 630 | 147 | 0 | 1,612 | 7,605 |
| 2003 | 11 | 638 | 501 | 73 | 0 | 1,223 | 5,993 |
| 2002 | 8 | 862 | 705 | 115 | 0 | 1,690 | 4,770 |
| 2001 | 6 | 594 | 578 | 145 | 0 | 1,323 | 3,080 |
| 2000 | 2 | 715 | 564 | 156 | 0 | 1,437 | 1,757 |
| 1999 | 3 | 172 | 121 | 24 | 0 | 320 | 320 |
| Title | ||
|---|---|---|
| CVE-2026-123860 | WordPress JetFormBuilder plugin <= 3.6.8 - Content Injection vulnerabilityCrocoblock · JetFormBuilder | Medium5.3 |
| CVE-2026-123964 | OpenBMB Internet of Agents Collaboration Layer communication_layer.py launch_goal infinite loopOpenBMB · Internet of Agents | Medium5.3 |
| CVE-2026-123861 | WordPress JetFormBuilder – Hierarchical Select plugin <= 1.0.10 - Insecure Direct Object References (IDOR) vulnerabilityCrocoBlock · JetFormBuilder – Hierarchical Select | Medium5.3 |
| CVE-2026-120839 | WordPress WpTravelly plugin <= 2.3.8 - Local File Inclusion vulnerabilityMagepeople inc. · WpTravelly | High8.8 |
| CVE-2026-120841 | WordPress WpTravelly plugin <= 2.3.8 - Local File Inclusion vulnerabilityMagepeople inc. · WpTravelly | High8.8 |
| CVE-2026-121777 | WordPress Cool Formkit Lite plugin <= 2.7.10 - Content Injection vulnerabilityCool Plugins · Cool Formkit Lite | Medium5.3 |
| CVE-2026-123467 | WordPress Motors plugin <= 1.4.128 - Broken Access Control vulnerabilityStylemixThemes · Motors | Medium4.3 |
| CVE-2026-122659 | WordPress Fluent Booking plugin <= 2.5.0 - Broken Access Control vulnerabilityWP ManageNinja LLC · Fluent Booking | Medium5.4 |
| CVE-2026-121579 | WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.26 - Cross Site Scripting (XSS) vulnerabilityUnlimited Elements · Unlimited Elements For Elementor (Free Widgets, Addons, Templates) | Medium6.5 |
| CVE-2026-121575 | WordPress WP User Manager plugin <= 2.10.4 - Broken Access Control vulnerabilityWP User Manager · WP User Manager | Medium5.3 |
| CVE-2026-122660 | WordPress FloristPress plugin <= 7.8.5 - Broken Access Control vulnerabilityBAKKBONE Australia · FloristPress | Medium4.3 |
| CVE-2026-123483 | WordPress JetFormBuilder plugin <= 3.6.8 - Content Injection vulnerabilityCrocoblock · JetFormBuilder | Medium5.3 |
| CVE-2026-123183 | WordPress Active Products Tables for WooCommerce plugin <= 2.1.6 - Content Injection vulnerabilityPluginUs.Net · Active Products Tables for WooCommerce | Medium5.3 |
| CVE-2026-123474 | WordPress Premium Blocks – Gutenberg Blocks for WordPress plugin <= 2.3.18 - Broken Access Control vulnerabilityLeapWorx · Premium Blocks – Gutenberg Blocks for WordPress | Medium5.3 |
| CVE-2026-121775 | WordPress CURCY plugin <= 2.2.20 - Broken Access Control vulnerabilityVillaTheme · CURCY | Medium5.3 |
| CVE-2026-123462 | WordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerabilitymyCred · myCred | Medium5.3 |
| CVE-2026-122669 | WordPress Everest Forms plugin <= 3.6.3 - Cross Site Scripting (XSS) vulnerabilityEverest Forms · Everest Forms | Medium6.5 |
| CVE-2026-122663 | WordPress CURCY plugin <= 2.2.20 - Broken Access Control vulnerabilityVillaTheme · CURCY | Medium5.3 |
| CVE-2026-121784 | WordPress WpBookingly plugin <= 1.4.3 - Cross Site Scripting (XSS) vulnerabilityMagepeople inc. · WpBookingly | Medium6.5 |
| CVE-2026-123477 | WordPress JetEngine plugin <= 3.9.0.2 - Cross Site Scripting (XSS) vulnerabilityCrocoblock · JetEngine | Medium6.5 |
| CVE-2026-123963 | OpenBMB Internet of Agents Agent Registry app.py register missing authenticationOpenBMB · Internet of Agents | Medium6.9 |
| CVE-2026-120579 | Active Woot Products Tables for WooCommerce. 100% FREE <= 2.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'help_title' Shortcode Attributerealmag777 · Active Woot Products Tables for WooCommerce. 100% FREE | Medium6.4 |
| CVE-2026-109973 | Flipbox <= 3.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'flip-box-image-upload-url-01-alt' Parameteroxilab · Flipbox – Awesomes Flip Boxes Image Overlay | Medium6.4 |
| CVE-2026-122041 | Checkout Field Editor for WooCommerce (Pro) <= 3.8.0 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via 'attachment_id' Parameter via thwcfe_remove_uploaded AJAX ActionThemehigh · Checkout Field Editor for WooCommerce (Pro) | Critical9.1 |
| CVE-2026-119156 | Download Manager <= 7.5.9 - Unauthenticated Stored Cross-Site Scripting via Registration Form (WP_Error-as-ID) via Spotlight Template [author_name]codename065 · Download Manager | High7.2 |
| CVE-2026-119498 | WordPress Simple Cloudflare Turnstile plugin <= 1.44.4 - Broken Authentication vulnerabilityRelyWP · Simple Cloudflare Turnstile | Medium5.3 |
| CVE-2026-121765 | WordPress TranslatePress plugin <= 3.3.8 - Cross Site Scripting (XSS) vulnerabilityCozmoslabs · TranslatePress | High7.1 |
| CVE-2026-123776 | RRD::CGI::Image versions through 0.01 for Perl pass CGI query parameters containting "tz" to tzset(), , so a FIFO or device path blocks the CGI processRRD-CGI-Image | Not scored |
| CVE-2026-93429 | VikBooking Hotel Booking Engine & PMS <= 1.8.17 - Unauthenticated Stored Cross-Site Scripting via 'guests[][][documents]' Parametere4jvikwp · VikBooking Hotel Booking Engine & PMS | High7.2 |
| CVE-2026-121977 | JetFormBuilder <= 3.6.8 - Unauthenticated Stored Cross-Site Scripting via Dynamic Value Block `to_set` Propertyjetmonsters · JetFormBuilder — Dynamic Blocks Form Builder | Medium5.4 |
| CVE-2026-120509 | Real Testimonials <= 4.1.0 - Unauthenticated Stored Cross-Site Scripting via 'tpro_client_name' Parametershapedplugin · Real Testimonials – Testimonial Slider, Collect Customer Reviews and Video Testimonials | Medium4.7 |
| CVE-2026-115548 | Quttera ThreatSign <= 4.1.0.48 - Unauthenticated Stored Cross-Site Scripting via User-Agent Headerquttera · Quttera ThreatSign – Web Malware Scanner for WordPress | High7.2 |
| CVE-2026-111317 | JetFormBuilder <= 3.6.7 - Unauthenticated Stored Cross-Site Scripting via Form Record Preset Sourcejetmonsters · JetFormBuilder — Dynamic Blocks Form Builder | High7.2 |
| CVE-2026-109214 | User Frontend <= 4.3.13 - Unauthenticated Stored Cross-Site Scripting via Taxonomy Field Text-Inputwedevs · User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission | High7.2 |
| CVE-2026-111370 | WP Visitor Statistics (Real Time Traffic) <= 8.9.0 - Unauthenticated Stored Cross-Site Scripting via 'os' / 'browser' / 'res' Tracker Parametersosamaesh · WP Visitor Statistics (Real Time Traffic) | High7.2 |
| CVE-2026-109991 | FunnelKit Payment Gateway for Stripe WooCommerce <= 1.15.0.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via 'order-pay' URL Path Parameterteamfunnelkit · FunnelKit Payment Gateway for Stripe WooCommerce | High7.5 |
| CVE-2026-104014 | Naimur Email OTP Verification for WooCommerce <= 2.1.0 - Unauthenticated Authentication Bypass to Account Takeover via Abandoned Password Reset Finalizationnaimurrahmannahid · Naimur Email OTP Verification for WooCommerce | Critical9.8 |
| CVE-2026-118050 | Football Pool <= 2.13.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Shoutbox Messageantoineh · Football Pool | Medium6.4 |
| CVE-2026-118267 | WP Data Access <= 5.5.89 - Incorrect Authorization to Unauthenticated Privilege Escalation via 'key' and 'val' Parameters on app/update, app/delete, app/insertpeterschulznl · WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps | High8.1 |
| CVE-2026-123418 | Church Admin <= 5.1.7 - Unauthenticated Stored Cross-Site Scripting via 'lat' Parameterandy_moyle · Church Admin | High7.2 |
| CVE-2026-121976 | Modula Image Gallery <= 3.0.17 - Authenticated (Author+) Stored Cross-Site Scripting via 'items' Parameterwpchill · Modula Image Gallery – Photo Grid & Video Gallery | Medium6.4 |
| CVE-2026-122231 | WS Form LITE <= 1.12.18 - Unauthenticated Stored Cross-Site Scripting via Text Field Array Valuewestguard · WS Form LITE – Drag & Drop Contact Form Builder | High7.2 |
| CVE-2026-120685 | Real Testimonials <= 4.1.0 - Unauthenticated Stored Cross-Site Scripting via JPEG IPTC Caption + '[gallery]' Shortcode Chainshapedplugin · Real Testimonials – Testimonial Slider, Collect Customer Reviews and Video Testimonials | Medium5.4 |
| CVE-2026-109230 | WP Visitor Statistics (Real Time Traffic) <= 8.7.1 - Unauthenticated Stored Cross-Site Scripting via 'browser' Parameterosamaesh · WP Visitor Statistics (Real Time Traffic) | High7.2 |
| CVE-2026-93766 | Happyforms Pro <= 1.38.9 - Unauthenticated Stored Cross-Site Scripting via 'happyforms_client_referer' ParameterHappyforms · Happyforms Pro | High7.2 |
| CVE-2026-119075 | Registration Form for WooCommerce <= 1.1.4 - Unauthenticated Privilege Escalation to 'user_roles' Parameter at Checkoutthemegrill · Registration Form for WooCommerce | Critical9.8 |
| CVE-2026-104746 | Motors <= 1.4.125 - Authenticated (Subscriber+) Arbitrary File Deletion via 'stm_user_avatar_path' User Metastylemix · Motors – Car Dealership & Classified Listings Plugin | High8.1 |
| CVE-2026-104768 | AutomatorWP <= 6.0.4 - Unauthenticated Privilege Escalation to Insufficient Role Validation in Anonymous Automation 'Role' Optionrubengc · AutomatorWP – No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI | High7.5 |
| CVE-2026-120683 | Real Testimonials <= 4.1.0 - Unauthenticated Stored Cross-Site Scripting via Testimonial Submission Form 'tpro_client_testimonial' Parametershapedplugin · Real Testimonials – Testimonial Slider, Collect Customer Reviews and Video Testimonials | Medium5.4 |
| CVE-2026-104760 | weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot <= 2.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'modalPlaceholder' Block Attributewedevs · weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot | Medium6.4 |