Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 6 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 400,944All CVEsplus 19,118 rejected
- 380Last 24 hours2,815 in the last 7 days
- 16,800Last 30 days1,547 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 3 | 15 | 32 | 0 | 0 | 50 | 79 |
| 2025 | 1 | 12 | 2 | 0 | 0 | 15 | 29 |
| 2024 | 1 | 3 | 10 | 0 | 0 | 14 | 14 |
| Title | ||
|---|---|---|
| CVE-2026-104674 | WordPress Booktics plugin <= 1.0.31 - Broken Access Control vulnerabilityArraytics · Booktics | Medium4.3 |
| CVE-2026-62122 | WordPress Booktics plugin <= 1.0.31 - Broken Access Control vulnerabilityArraytics · Booktics | Medium5.3 |
| CVE-2026-116860 | WordPress Timetics plugin <= 1.0.65 - Broken Access Control vulnerabilityArraytics · Timetics | Medium5.3 |
| CVE-2026-112844 | WordPress WP Event Solution plugin <= 4.1.26 - Cross Site Scripting (XSS) vulnerabilityArraytics · WP Event Solution | High7.1 |
| CVE-2026-112829 | WordPress Booktics plugin <= 1.0.30 - Broken Access Control vulnerabilityArraytics · Booktics | Medium5.3 |
| CVE-2026-109895 | WordPress Booktics plugin <= 1.0.29 - Cross Site Scripting (XSS) vulnerabilityArraytics · Booktics | High7.1 |
| CVE-2026-109894 | WordPress Booktics plugin <= 1.0.29 - SQL Injection vulnerabilityArraytics · Booktics | Critical9.3 |
| CVE-2026-110380 | WordPress WP Event Solution plugin <= 4.1.26 - Broken Access Control vulnerabilityArraytics · WP Event Solution | Medium5.3 |
| CVE-2026-109898 | WordPress WP Event Solution plugin <= 4.1.25 - Broken Access Control vulnerabilityArraytics · WP Event Solution | Medium5.3 |
| CVE-2026-107418 | WordPress Booktics plugin <= 1.0.28 - Broken Access Control vulnerabilityArraytics · Booktics | Medium5.4 |
| CVE-2026-108477 | WordPress Booktics plugin <= 1.0.28 - Broken Access Control vulnerabilityArraytics · Booktics | Medium5.3 |
| CVE-2026-104390 | WordPress Booktics plugin <= 1.0.27 - Broken Access Control vulnerabilityArraytics · Booktics | Medium4.3 |
| CVE-2026-97300 | WordPress WP Event Solution plugin <= 4.1.25 - Broken Access Control vulnerabilityArraytics · WP Event Solution | Medium6.5 |
| CVE-2026-97304 | WordPress Timetics plugin <= 1.0.63 - Broken Access Control vulnerabilityArraytics · Timetics | Medium6.5 |
| CVE-2026-103684 | WordPress WP Event Solution plugin <= 4.1.25 - Broken Access Control vulnerabilityArraytics · WP Event Solution | Medium5.3 |
| CVE-2026-105073 | WordPress WP Event Solution plugin <= 4.1.25 - Sensitive Data Exposure vulnerabilityArraytics · WP Event Solution | Medium5.3 |
| CVE-2026-11601 | WPCafe <= 3.0.19 - Missing Authorization to Unauthenticated Arbitrary Email Notification Flow Read/Create/Update/Deletearraytics · WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System | Medium5.3 |
| CVE-2026-75028 | WPCafe <= 3.0.18 - Authenticated (Contributor+) Local File Inclusion via 'food_menu_style' Elementor Widget Settingarraytics · WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System | High7.5 |
| CVE-2026-75983 | Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce <= 4.1.23 - Authenticated (Subscriber+) Privilege Escalation via map_meta_cap Filterarraytics · Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce | High7.5 |
| CVE-2026-15402 | Eventin <= 4.1.23 - Authenticated (Custom+) Stored Cross-Site Scripting via 'etn_shedule_objective' schedule_slot Parameterarraytics · Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce | Medium6.4 |
| CVE-2026-62135 | WordPress Booktics plugin <= 1.0.24 - Broken Access Control vulnerabilityArraytics · Booktics | Medium5.3 |
| CVE-2026-11446 | Booktics – Booking Calendar for Appointments and Service Businesses <= 1.0.23 - Missing Authorizationarraytics · Booktics – Appointment Booking Calendar for Service Businesses | Medium5.3 |
| CVE-2026-11821 | Eventin <= 4.1.17 - Missing Authorization to Authenticated (Subscriber+) Notification Flow Management via notification-flow REST API Endpointarraytics · Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce | Medium5.4 |
| CVE-2026-15667 | Eventin <= 4.1.22 - Authenticated (Contirbutor+) Local File Inclusion via 'event_layout' Parameterarraytics · Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce | High7.5 |
| CVE-2026-15406 | Eventin <= 4.1.22 - Authenticated (Custom+) Local File Inclusion via 'event_layout' Parameterarraytics · Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce | High7.5 |
| CVE-2026-12956 | Eventin <= 4.1.22 - Missing Authorization to Unauthenticated Arbitrary Order Creation and Status Manipulation via 'status' Parameterarraytics · Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce | Medium5.3 |
| CVE-2026-84215 | WordPress Timetics plugin <= 1.0.61 - Broken Access Control vulnerabilityArraytics · Timetics | Medium6.5 |
| CVE-2026-82223 | WordPress WP Event SOlution plugin <= 4.1.22 - Broken Access Control vulnerabilityArraytics · WP Event SOlution | Medium6.5 |
| CVE-2026-28002 | WordPress Booktics plugin 1.0.22 - SQL Injection vulnerabilityArraytics · Booktics | High8.5 |
| CVE-2026-28174 | WordPress WP Event SOlution plugin <= 4.1.18 - Sensitive Data Exposure vulnerabilityArraytics · WP Event SOlution | Medium6.5 |
| CVE-2026-28173 | WordPress WP Event SOlution plugin <= 4.1.19 - Arbitrary Content Deletion vulnerabilityArraytics · WP Event SOlution | High7.1 |
| CVE-2026-66451 | WordPress WP Event SOlution plugin <= 4.1.9 - Broken Authentication vulnerabilityArraytics · WP Event SOlution | Medium6.5 |
| CVE-2026-13039 | Eventin 4.0.26 - 4.1.15 - Missing Authorization to Unauthenticated Payment Bypass via REST APIarraytics · Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) | Medium5.3 |
| CVE-2026-12924 | Eventin <= 4.1.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'etn_faq_content' Parameterarraytics · Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) | Medium6.4 |
| CVE-2026-11818 | WPCafe <= 3.0.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via REST APIarraytics · WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System | Medium5.4 |
| CVE-2026-57674 | WordPress Timetics plugin <= 1.0.58 - Cross Site Scripting (XSS) vulnerabilityArraytics · Timetics | High7.1 |
| CVE-2026-57621 | WordPress Booktics plugin <= 1.0.21 - PHP Object Injection vulnerabilityArraytics · Booktics | Critical9.8 |
| CVE-2026-57622 | WordPress WPCafe plugin <= 3.0.14 - Broken Access Control vulnerabilityArraytics · WPCafe | Medium4.3 |
| CVE-2025-68045 | WordPress WP Event SOlution plugin <= 4.1.12 - Broken Access Control vulnerabilityArraytics · WP Event Solution | High7.5 |
| CVE-2026-40776 | WordPress Eventin plugin <= 4.1.8 - Broken Access Control vulnerabilityArraytics · WP Event SOlution | High7.5 |
| CVE-2026-39432 | WordPress Timetics plugin <= 1.0.53 - Broken Access Control vulnerabilityArraytics · Timetics | High8.2 |
| CVE-2026-4109 | Eventin – Events Calendar, Event Booking, Ticket & Registration (AI Powered) <= 4.1.8 Missing Authorization to Authenticated (Subscriber+) Order Information Exposurearraytics · Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) | Medium4.3 |
| CVE-2026-39585 | WordPress Booktics plugin <= 1.0.16 - Broken Access Control vulnerabilityArraytics · Booktics | Medium5.3 |
| CVE-2026-27071 | WordPress WPCafe plugin <= 3.0.7 - Broken Access Control vulnerabilityArraytics · WPCafe | Critical9.1 |
| CVE-2026-1919 | Booktics <= 1.0.16 - Missing Authorization to Get Items via REST API endpointsarraytics · Booktics – Booking Calendar for Appointments and Service Businesses | Medium5.3 |
| CVE-2026-1920 | Booktics <= 1.0.16 - Missing Authorization to Addon Plugin Installationarraytics · Booktics – Booking Calendar for Appointments and Service Businesses | Medium5.3 |
| CVE-2025-68047 | WordPress Eventin plugin <= 4.1.3 - PHP Object Injection vulnerabilityArraytics · Eventin | High8.8 |
| CVE-2025-14657 | Eventin – Event Manager, Event Booking, Calendar, Tickets and Registration Plugin (AI Powered) <= 4.0.51 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting via 'post_settings'arraytics · Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) | High7.2 |
| CVE-2025-67915 | WordPress Timetics plugin <= 1.0.46 - Broken Authentication vulnerabilityArraytics · Timetics | High8.8 |
| CVE-2025-5919 | Appointment Booking and Scheduling Calendar Plugin – WP Timetics <= 1.0.36 - Missing Authorization to Unauthenticated Booking Details View And Modificationarraytics · Timetics – Appointment Booking & Scheduling | Medium6.5 |