Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 3 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 400,995All CVEsplus 19,118 rejected
- 427Last 24 hours2,851 in the last 7 days
- 16,813Last 30 days1,542 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 4 | 10 | 15 | 3 | 0 | 32 | 43 |
| 2025 | 0 | 0 | 0 | 0 | 0 | 0 | 11 |
| 2024 | 0 | 0 | 0 | 0 | 0 | 0 | 11 |
| 2023 | 1 | 3 | 6 | 1 | 0 | 11 | 11 |
| Title | ||
|---|---|---|
| CVE-2026-111048 | FOSSBilling: Low-privileged staff can run JavaScript in administrators' browsers via stored XSS in support ticket notesFOSSBilling · FOSSBilling | High8.4 |
| CVE-2026-112374 | FOSSBilling before 0.8.9 Login CSRF via Staff Guest Login APIFOSSBilling · FOSSBilling | Medium5.1 |
| CVE-2026-111056 | FOSSBilling: Unauthenticated client account enumeration via guest signup endpointFOSSBilling · FOSSBilling | Medium6.9 |
| CVE-2026-111053 | FOSSBilling: Unauthenticated attacker can probe existence of arbitrary files via guest/system/template_existsFOSSBilling · FOSSBilling | Medium6.9 |
| CVE-2026-111046 | FOSSBilling: Low-privileged staff can read and modify configuration of deactivated extensionsFOSSBilling · FOSSBilling | Low2.3 |
| CVE-2026-53648 | FOSSBilling: Downloadable product files can be overwritten through filename collisionsFOSSBilling · FOSSBilling | Medium5.1 |
| CVE-2026-53647 | FOSSBilling vulnerable to unauthenticated API key configuration disclosure via guest Serviceapikey get_info endpointFOSSBilling · FOSSBilling | Medium6.9 |
| CVE-2026-53646 | FOSSBilling: Client password reset token reuse allows persistent account takeoverFOSSBilling · FOSSBilling | High7.7 |
| CVE-2026-53645 | FOSSBilling's missing self-edit prevention in staff permission management allows persistent privilege escalationFOSSBilling · FOSSBilling | High8.5 |
| CVE-2026-53644 | FOSSBilling's missing order-state validation allows clients to read and reset API key secrets for non-active ordersFOSSBilling · FOSSBilling | High8.6 |
| CVE-2026-53643 | FOSSBilling allows low-privileged staff accounts to perform unauthorized actions via admin API endpointsFOSSBilling · FOSSBilling | High8.7 |
| CVE-2026-53642 | FOSSBilling: Unverified clients can access client-area pages when email confirmation is requiredFOSSBilling · FOSSBilling | Medium5.3 |
| CVE-2026-53641 | FOSSBilling has stored XSS in client email views via unescaped content in JavaScript template literalFOSSBilling · FOSSBilling | Medium4.8 |
| CVE-2026-53640 | FOSSBilling missing authorization checks on read-only admin API endpoints expose sensitive staff, client, and redirect dataFOSSBilling · FOSSBilling | Low2.3 |
| CVE-2026-43928 | FOSSBilling: Payment amount not validated in PayPalEmail adapter allows invoice underpaymentFOSSBilling · FOSSBilling | Low2.3 |
| CVE-2026-43927 | FOSSBilling has race condition in cart checkout that bypasses promo code usage limitsFOSSBilling · FOSSBilling | Medium6.9 |
| CVE-2026-43925 | FOSSBilling: Mass assignment of group_id in guest client registration allows unauthorized promo code useFOSSBilling · FOSSBilling | Medium6.9 |
| CVE-2026-43921 | FOSSBilling vulnerable to arbitrary PHP code injection via unescaped config serializationFOSSBilling · FOSSBilling | High8.9 |
| CVE-2026-43918 | Suspended or inactive FOSSBilling accounts can retain or regain access through existing sessions, API tokens, and password reset flowsFOSSBilling · FOSSBilling | High8.7 |
| CVE-2026-42331 | FOSSBilling missing authorization in guest Invoice API endpointsFOSSBilling · FOSSBilling | High7.7 |
| CVE-2026-33734 | FOSSBilling has improper SQL neutralization in `Massmailer` recipient filtersFOSSBilling · FOSSBilling | Medium6.9 |
| CVE-2026-42341 | FOSSBilling has an unauthenticated payment bypass via IPN callback forgeryFOSSBilling · FOSSBilling | Critical9.2 |
| CVE-2026-43920 | FOSSBilling: Unauthenticated update patcher endpoint allows remote maintenance executionFOSSBilling · FOSSBilling | Medium6.9 |
| CVE-2026-33543 | FOSSBilling: Authentication bypass allows unauthenticated administrator creationFOSSBilling · FOSSBilling | Critical9.3 |
| CVE-2026-27708 | FOSSBilling: IDOR in Servicecustom Client API allows cross-client data accessFOSSBilling · FOSSBilling | High7.1 |
| CVE-2026-23513 | FOSSBilling: Broken Authorization in Client Transaction and Order ListingsFOSSBilling · FOSSBilling | High7.1 |
| CVE-2025-64105 | FOSSBilling: IDOR Vulnerability in Support Ticket CreationFOSSBilling · FOSSBilling | Medium5.1 |
| CVE-2026-27604 | FOSSBilling: Improper API Role Validation (system) Enables Unauthenticated Access to Privileged Admin FunctionsFOSSBilling · FOSSBilling | Critical10.0 |
| CVE-2026-28496 | FOSSBilling: Server-side template injection in Twig template rendering enables information disclosure and RCEFOSSBilling · FOSSBilling | Critical9.4 |
| CVE-2026-43926 | FOSSBilling's password reset confirmation endpoint lacks rate limitingFOSSBilling · FOSSBilling | Medium6.3 |
| CVE-2026-43924 | FOSSBilling has an open redirect via administrator-configured redirect targetsFOSSBilling · FOSSBilling | Medium4.8 |
| CVE-2026-40495 | FOSSBilling version exposed via asset cache busterFOSSBilling · FOSSBilling | Medium6.9 |
| CVE-2023-4005 | Insufficient Session Expiration in fossbilling/fossbillingfossbilling · fossbilling/fossbilling | Low3.8 |
| CVE-2023-3521 | Cross-site Scripting (XSS) - Reflected in fossbilling/fossbillingfossbilling · fossbilling/fossbilling | Medium5.4 |
| CVE-2023-3493 | Improper Neutralization of Formula Elements in a CSV File in fossbilling/fossbillingfossbilling · fossbilling/fossbilling | High7.7 |
| CVE-2023-3491 | Unrestricted Upload of File with Dangerous Type in fossbilling/fossbillingfossbilling · fossbilling/fossbilling | High8.0 |
| CVE-2023-3490 | SQL Injection in fossbilling/fossbillingfossbilling · fossbilling/fossbilling | Critical9.8 |
| CVE-2023-3394 | Session Fixation in fossbilling/fossbillingfossbilling · fossbilling/fossbilling | Medium6.8 |
| CVE-2023-3393 | Code Injection in fossbilling/fossbillingfossbilling · fossbilling/fossbilling | High8.0 |
| CVE-2023-3230 | Missing Authorization in fossbilling/fossbillingfossbilling · fossbilling/fossbilling | Medium4.6 |
| CVE-2023-3229 | Business Logic Errors in fossbilling/fossbillingfossbilling · fossbilling/fossbilling | Medium5.4 |
| CVE-2023-3228 | Business Logic Errors in fossbilling/fossbillingfossbilling · fossbilling/fossbilling | Medium5.4 |
| CVE-2023-3227 | Insufficient Granularity of Access Control in fossbilling/fossbillingfossbilling · fossbilling/fossbilling | Medium5.4 |