Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 7 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 400,710All CVEsplus 19,114 rejected
- 426Last 24 hours2,845 in the last 7 days
- 17,138Last 30 days1,582 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 11 | 45 | 28 | 0 | 1 | 85 | 97 |
| 2025 | 0 | 0 | 0 | 0 | 0 | 0 | 12 |
| 2024 | 0 | 0 | 0 | 0 | 0 | 0 | 12 |
| 2023 | 3 | 7 | 0 | 0 | 0 | 10 | 12 |
| 2022 | 0 | 0 | 0 | 0 | 0 | 0 | 2 |
| 2021 | 0 | 0 | 0 | 0 | 0 | 0 | 2 |
| 2020 | 0 | 0 | 2 | 0 | 0 | 2 | 2 |
| Title | ||
|---|---|---|
| CVE-2026-45146 | Chamilo LMS: Blind SQL Injection in model.ajax.php via filters[groupOp] authentificatedchamilo · chamilo-lms | High7.2 |
| CVE-2026-44344 | Chamilo LMS: Conditional PHP execution through vendored QuickForm evalchamilo · chamilo-lms | Medium6.6 |
| CVE-2026-45141 | Chamilo LMS: CSRF in destructive skill-management AJAX actionschamilo · chamilo-lms | Medium6.5 |
| CVE-2026-45145 | Chamilo LMS: Database-backed PHP object injection in career deserializationchamilo · chamilo-lms | High7.5 |
| CVE-2026-45144 | Chamilo LMS: Stored XSS in public user-profile fieldschamilo · chamilo-lms | High8.9 |
| CVE-2026-114390 | Chamilo LMS 2.0.0-alpha.1 before 2.0.0-RC.3 Missing Authorization in AJAX Handlerschamilo · chamilo-lms | Medium6.9 |
| CVE-2026-114389 | Chamilo LMS 2.0.0-alpha.4 before 2.0.0-RC.3 Missing Authorization via openAnswerGradechamilo · chamilo-lms | Medium5.3 |
| CVE-2026-114388 | Chamilo LMS 2.0.0-alpha.1 before 2.0.0-RC.3 Missing Authorization via GradebookControllerchamilo · chamilo-lms | Medium6.9 |
| CVE-2026-112031 | Chamilo LMS Ticket TicketManager.php addProject cross site scriptingChamilo · LMS | Medium5.1 |
| CVE-2026-45140 | Chamilo LMS CStudio upload flow allows unauthenticated remote code executionchamilo · chamilo-lms | Critical9.8 |
| CVE-2026-45143 | Chamilo LMS: Student-to-admin stored XSS in private messages via v-htmlchamilo · chamilo-lms | Critical9.0 |
| CVE-2026-82535 | Chamilo LMS Stored XSS via Survey Answer Submission in reporting.phpchamilo · chamilo-lms | Medium5.3 |
| CVE-2026-34239 | Chamilo Authenticated Remote Code Executionchamilo · chamilo-lms | High7.5 |
| CVE-2026-39878 | Chamilo stored XSS via user registration leads to admin account takeoverchamilo · chamilo-lms | Critical9.3 |
| CVE-2026-40291 | Chamilo LMS has Privilege Escalation via API User Role Modificationchamilo · chamilo-lms | High8.8 |
| CVE-2026-35196 | Chamilo LMS has OS Command Injection via export_all_certificates actionchamilo · chamilo-lms | High8.8 |
| CVE-2026-34602 | Chamilo LMS: IDOR in /api/course_rel_users Allows Unauthorized Enrollment of Arbitrary Users into Courseschamilo · chamilo-lms | High7.1 |
| CVE-2026-34370 | Chamilo LMS: IDOR in the Notebook Module allows an attacker to view other users' private noteschamilo · chamilo-lms | Medium6.5 |
| CVE-2026-34161 | Chamilo LMS: Stored XSS via Malicious File Upload in Social Post Attachments Leads to Arbitrary JavaScript Executionchamilo · chamilo-lms | Medium5.1 |
| CVE-2026-34160 | Chamilo LMS: Unauthenticated SSRF via PENS Plugin allows attacker to probe internal network and reach cloud metadata serviceschamilo · chamilo-lms | High8.6 |
| CVE-2026-33715 | Chamilo LMS has Unauthenticated SSRF and Open Email Relay via install.ajax.php test_mailer actionchamilo · chamilo-lms | High7.2 |
| CVE-2026-33714 | Chamilo LMS has Authenticated SQL Injection in statistics.ajax.php users_active action (2.0 RC2)chamilo · chamilo-lms | High7.1 |
| CVE-2026-33737 | Chamilo LMS has an XML External Entity (XXE) Injectionchamilo · chamilo-lms | Medium5.3 |
| CVE-2026-33736 | Chamilo LMS has an Insecure Direct Object Reference (IDOR) - User Data Exposurechamilo · chamilo-lms | Medium6.5 |
| CVE-2026-33710 | Chamilo LMS has Weak REST API Key Generation (Predictable)chamilo · chamilo-lms | High7.5 |
| CVE-2026-33708 | Chamilo LMS has REST API PII Exposure via get_user_info_from_usernamechamilo · chamilo-lms | Medium6.5 |
| CVE-2026-33707 | Weak Password Recovery Mechanism for Forgotten Password in chamilo/chamilo-lmschamilo · chamilo-lms | Critical9.4 |
| CVE-2026-33706 | Chamilo LMS has a REST API Self-Privilege Escalation (Student → Teacher)chamilo · chamilo-lms | High7.1 |
| CVE-2026-33705 | Chamilo LMS has unauthenticated access to Twig template source files exposes application logicchamilo · chamilo-lms | Medium5.3 |
| CVE-2026-33704 | Chamilo LMS Affected by Authenticated Arbitrary File Write via BigUpload endpointchamilo · chamilo-lms | High7.1 |
| CVE-2026-33703 | Chamilo LMS Critical IDOR: Any Authenticated User Can Extract All Users’ Personal Data and API Tokenschamilo · chamilo-lms | High7.1 |
| CVE-2026-33702 | Chamilo LMS has an Insecure Direct Object Reference (IDOR)chamilo · chamilo-lms | High7.1 |
| CVE-2026-33698 | Chamilo LMS affected by unauthenticated RCE in main/install folderchamilo · chamilo-lms | Critical9.3 |
| CVE-2026-33618 | Chamilo LMS Affected by Remote Code Execution via eval() in Platform Settingschamilo · chamilo-lms | High8.8 |
| CVE-2026-33141 | Chamilo LMS has an IDOR in REST API Stats Endpoint Exposes Any User's Learning Datachamilo · chamilo-lms | Medium6.5 |
| CVE-2026-32892 | OS Command Injection in Chamilo LMS 1.11.36chamilo · chamilo-lms | Critical9.1 |
| CVE-2026-32932 | Chamilo LMS has an Open Redirect via Unvalidated 'page' Parameter in Session Course Editchamilo · chamilo-lms | Medium4.7 |
| CVE-2026-32931 | Chamilo LMS has Arbitrary File Upload via MIME-Only Validation in Exercise Sound Upload Leads to RCEchamilo · chamilo-lms | High7.5 |
| CVE-2026-32930 | Chamilo LMS has an IDOR in Gradebook Allows Cross-Course Evaluation Edit Without Ownership Checkchamilo · chamilo-lms | High7.1 |
| CVE-2026-32894 | Chamilo LMS has an IDOR in Gradebook Allows Cross-Course Deletion of Any Student's Grade Resultchamilo · chamilo-lms | High7.1 |
| CVE-2026-32893 | Chamilo LMS has Reflected XSS via Unsanitized http_build_query() in Exercise Question List Paginationchamilo · chamilo-lms | Medium5.4 |
| CVE-2026-31941 | Server-Side Request Forgery (SSRF) in Chamilo LMSchamilo · chamilo-lms | High7.7 |
| CVE-2026-31940 | Session Fixation in Chamilo LMSchamilo · chamilo-lms | High7.5 |
| CVE-2026-31939 | Path Traversal (Arbitrary File Delete) in Chamilo LMSchamilo · chamilo-lms | High8.3 |
| CVE-2025-66447 | Chamilo LMS has validation-less redirect on login pagechamilo · chamilo-lms | None0.0 |
| CVE-2026-30882 | Chamilo LMS: Reflected XSS in the session category listing pagechamilo · chamilo-lms | Medium6.1 |
| CVE-2026-30881 | Chamilo LMS: SQL Injection in the statistics AJAX endpointchamilo · chamilo-lms | High8.8 |
| CVE-2026-30876 | Chamilo LMS: User enumeration vulnerability via responsechamilo · chamilo-lms | Medium6.3 |
| CVE-2026-30875 | Chamilo LMS: Authenticated RCE via H5P Importchamilo · chamilo-lms | High8.8 |
| CVE-2026-28430 | Chamilo LMS Vulnerable to Unauthenticated SQL Injection in chamiko-lms model.ajax.phpchamilo · chamilo-lms | Critical9.3 |