Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 8 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,200All CVEsplus 19,120 rejected
- 493Last 24 hours2,813 in the last 7 days
- 16,882Last 30 days1,542 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 1 | 14 | 36 | 3 | 0 | 54 | 68 |
| 2025 | 0 | 1 | 0 | 0 | 0 | 1 | 14 |
| 2024 | 2 | 0 | 0 | 1 | 0 | 3 | 13 |
| 2023 | 0 | 0 | 6 | 0 | 0 | 6 | 10 |
| 2022 | 0 | 1 | 0 | 0 | 0 | 1 | 4 |
| 2021 | 1 | 1 | 0 | 0 | 0 | 2 | 3 |
| 2020 | 0 | 1 | 0 | 0 | 0 | 1 | 1 |
| Title | ||
|---|---|---|
| CVE-2026-117554 | Admidio before 5.0.17 Event Guest Restriction Bypass via events_function.phpadmidio · admidio | Medium5.3 |
| CVE-2026-111916 | Admidio before 5.0.16 Information Disclosure via rss/links.php Weblinks FeedAdmidio · admidio | Medium6.9 |
| CVE-2026-111914 | Admidio 5.0.11 before 5.0.16 Broken Access Control via inventory_data.phpAdmidio · admidio | High7.1 |
| CVE-2026-111913 | Admidio 5.0.0 before 5.0.16 Authorization Bypass via pdfl Mode in lists_show.phpAdmidio · admidio | Medium5.3 |
| CVE-2026-111912 | Admidio 5.0.0 before 5.0.16 IDOR via Forum Topic UpdateAdmidio · admidio | High7.1 |
| CVE-2026-109329 | Admidio 4.3.2 through 4.3.17 and 5.0.0 before 5.0.15 Cross-Organization Access Control Bypass via members_assignment.phpAdmidio · admidio | High8.5 |
| CVE-2026-109328 | Admidio 5.0.0 before 5.0.15 Unauthenticated Stored XSS via Registration NameAdmidio · admidio | Medium5.3 |
| CVE-2026-109327 | Admidio 4.0.12 through 4.3.17 and 5.0.0 before 5.0.15 Reflected XSS via system/redirect.phpAdmidio · admidio | Medium5.1 |
| CVE-2026-53760 | Admidio: CSRF on Plugin Install, Uninstall, and Update via Unprotected GET RequestsAdmidio · admidio | Medium5.2 |
| CVE-2026-82658 | Admidio before 5.0.12 Broken Access Control via profile_function.phpAdmidio · admidio | Medium5.3 |
| CVE-2026-82657 | Admidio before 5.0.12 Authentication Bypass via RSS feedsAdmidio · admidio | High8.7 |
| CVE-2026-82656 | Admidio before 5.0.12 Path Traversal via Photo ZIP DownloadAdmidio · admidio | Low2.1 |
| CVE-2026-82655 | Admidio before 5.0.12 SQL Injection via relation_type_listAdmidio · admidio | High8.7 |
| CVE-2026-47234 | Admidio writes session IDs and auto-login cookie values to application logsAdmidio · admidio | Medium4.4 |
| CVE-2026-47233 | Admidio: Any logged-in user can delete inventory fields via `mode=field_delete` — incomplete fix of #2024Admidio · admidio | Medium6.5 |
| CVE-2026-47232 | Admidio PKCS#12 private key export action lacks CSRF protectionAdmidio · admidio | Medium4.3 |
| CVE-2026-47231 | Admidio has IDOR in `documents-files.php` `mode=move_save` that lets any folder-uploader exfiltrate files from private foldersAdmidio · admidio | High8.1 |
| CVE-2026-47230 | Admidio: IDOR in documents-files.php allows cross-folder file rename and description changes by unauthorized uploadersAdmidio · admidio | Medium6.5 |
| CVE-2026-47229 | Admidio: CSRF in SSO client `enable` action toggles SAML/OIDC clients without token validationAdmidio · admidio | Medium5.4 |
| CVE-2026-47228 | Admidio's CSRF in registration `send_login` mode resets arbitrary user passwordsAdmidio · admidio | Medium5.2 |
| CVE-2026-47227 | Admidio module-administrator can delete or reorder categories owned by other modules via dead authorization check in `modules/categories.php`Admidio · admidio | Medium6.5 |
| CVE-2026-47226 | Admidio: Authorization bypass in file_delete enables cross-folder file removal by authenticated users without delete privilegesAdmidio · admidio | Medium6.5 |
| CVE-2026-69094 | Admidio before 5.0.11 IDOR via save_temporary mylist_function.phpAdmidio · admidio | Medium5.3 |
| CVE-2026-69093 | Admidio before 5.0.11 CSRF via category-report preferencesAdmidio · admidio | High7.1 |
| CVE-2026-69092 | Admidio before 5.0.11 Reflected XSS via SSO/SAML EndpointAdmidio · admidio | Medium6.9 |
| CVE-2026-69091 | Admidio before 5.0.11 Authentication Bypass via forum.phpAdmidio · admidio | High8.7 |
| CVE-2026-69090 | Admidio before 5.0.11 Cross-Organization Role ModificationAdmidio · admidio | Medium6.9 |
| CVE-2018-25370 | Admidio 3.3.5 Cross-Site Request Forgery via roles_function.phpAdmidio · Admidio | Medium6.9 |
| CVE-2026-42194 | Incomplete fix for CVE-2026-32812: SSRF in admidioAdmidio · admidio | Medium6.8 |
| CVE-2026-41671 | Admidio: OIDC Token Introspection Endpoint Returns Active for All Tokens Without ValidationAdmidio · admidio | Medium6.8 |
| CVE-2026-41670 | Admidio: SAML Response Sent to Unvalidated Assertion Consumer Service URL from AuthnRequestAdmidio · admidio | High8.2 |
| CVE-2026-41669 | Admidio: SAML Signature Validation Result Ignored — Forged AuthnRequests and LogoutRequests ProcessedAdmidio · admidio | High8.2 |
| CVE-2026-41663 | Admidio: CSRF on Admin Preferences Triggers Unauthorized Backup, .htaccess Write, and Email SendAdmidio · admidio | Low3.5 |
| CVE-2026-41662 | Admidio: Missing Minimum Administrator Check in Role Membership RemovalAdmidio · admidio | Medium5.2 |
| CVE-2026-41661 | Admidio: Reflected XSS in msg_window.php via Square Bracket to HTML Tag ConversionAdmidio · admidio | Medium6.1 |
| CVE-2026-41660 | Admidio: Inverted 2FA Reset Authorization Check Lets Group Leaders Strip Admin TOTPAdmidio · admidio | High7.1 |
| CVE-2026-41659 | Admidio: Hidden Profile Field Values Leaked via Blind Search Oracle in Member AssignmentAdmidio · admidio | Low2.7 |
| CVE-2026-41658 | Admidio: Missing Authorization on Inventory Module Destructive Endpoints Allows Any Authenticated User to Delete ItemsAdmidio · admidio | Medium6.5 |
| CVE-2026-41657 | Admidio: Cross-Organization Member Data Exposure via Permission Check Mismatch in contacts_data.phpAdmidio · admidio | Medium4.9 |
| CVE-2026-41656 | Admidio: Path Traversal via Unvalidated `name` Parameter in Document Add Mode Enables Arbitrary Server File ReadAdmidio · admidio | Medium4.5 |
| CVE-2026-41655 | Admidio: Path Traversal in ECard Preview Allows Reading Arbitrary Server Files Including Database CredentialsAdmidio · admidio | Medium6.5 |
| CVE-2026-34384 | Admidio: Missing CSRF Protection on Registration Approval ActionsAdmidio · admidio | Medium4.5 |
| CVE-2026-34383 | Admidio: CSRF and Form Validation Bypass in Inventory Item Save via `imported` ParameterAdmidio · admidio | Medium4.3 |
| CVE-2026-34382 | Admidio: Missing CSRF Protection on Custom List Deletion in mylist_function.phpAdmidio · admidio | Medium4.6 |
| CVE-2026-34381 | Admidio: Unauthenticated Access to Role-Restricted documents via neutralized .htaccessAdmidio · admidio | High7.5 |
| CVE-2026-32813 | Admidio: Second-Order SQL Injection via List Configuration (lsc_special_field, lsc_sort, lsc_filter)Admidio · admidio | High8.0 |
| CVE-2026-32817 | Admidio is Missing Authorization and CSRF Protection on Document and Folder DeletionAdmidio · admidio | Critical9.1 |
| CVE-2026-32812 | Admidio Vulnerable to SSRF and Local File Read via Unrestricted URL Fetch in SSO Metadata EndpointAdmidio · admidio | Medium6.8 |
| CVE-2026-32757 | Admidio: HTMLPurifier Bypass in eCard Message Allows HTML Email InjectionAdmidio · admidio | Medium5.4 |
| CVE-2026-32756 | Admidio: Unrestricted File Upload via CSRF Token Validation Bypass in Documents & Files ModuleAdmidio · admidio | High8.8 |