Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 10 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 400,561All CVEsplus 18,890 rejected
- 402Last 24 hours3,029 in the last 7 days
- 17,425Last 30 days1,598 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 9 | 24 | 14 | 0 | 0 | 47 | 77 |
| 2025 | 0 | 0 | 2 | 0 | 0 | 2 | 30 |
| 2024 | 1 | 1 | 0 | 0 | 0 | 2 | 28 |
| 2023 | 7 | 1 | 11 | 1 | 0 | 20 | 26 |
| 2022 | 0 | 1 | 4 | 1 | 0 | 6 | 6 |
| Title | ||
|---|---|---|
| CVE-2026-121436 | Froxlor 2.3.8 before 2.3.15 API Key Disclosure via api_keys.phpfroxlor · froxlor | High8.6 |
| CVE-2026-121435 | Froxlor before 2.3.15 Authorization Bypass via Mysqls.add APIfroxlor · froxlor | Medium5.3 |
| CVE-2026-121434 | Froxlor 2.3.0 before 2.3.15 Authorization Bypass via Certificates.update APIfroxlor · froxlor | Medium5.3 |
| CVE-2026-113678 | Froxlor before 2.3.15 Symlink Following Privilege Escalation via Traffic Cronfroxlor · froxlor | Critical9.4 |
| CVE-2026-113677 | Froxlor 0.10.0 before 2.3.15 Missing Authorization via SubDomains.delete APIfroxlor · froxlor | Medium5.3 |
| CVE-2026-113676 | Froxlor 0.10.0 before 2.3.15 Authorization Bypass via Admins.get APIfroxlor · froxlor | Medium5.3 |
| CVE-2026-109963 | Froxlor before 2.3.14 IDOR in Email Template Editor via admin_templates.phpfroxlor · froxlor | Medium5.3 |
| CVE-2026-109962 | Froxlor 0.10.0 before 2.3.14 Missing Authorization in MysqlServer and Cronjobs APIfroxlor · froxlor | Medium5.3 |
| CVE-2026-109961 | Froxlor 0.10.0 before 2.3.14 Newline Injection via Ftps.add additional_membersfroxlor · froxlor | High8.4 |
| CVE-2026-109960 | Froxlor 2.0.0 before 2.3.14 Stored XSS via Customer Theme Valuefroxlor · froxlor | High8.7 |
| CVE-2026-100720 | Froxlor before 2.3.12 Stored XSS via SSL certificate issuerfroxlor · froxlor | Critical9.3 |
| CVE-2026-100719 | Froxlor before 2.3.12 Credential Disclosure via DirProtections APIfroxlor · froxlor | High7.1 |
| CVE-2026-100718 | Froxlor before 2.3.12 Authentication Bypass via EmailSender.addfroxlor · froxlor | High7.1 |
| CVE-2026-100717 | froxlor before 2.3.12 CRLF Injection via validateUrl userinfofroxlor · froxlor | High8.5 |
| CVE-2026-100716 | Froxlor before 2.3.12 Privilege Escalation via Symlinkfroxlor · froxlor | Critical9.4 |
| CVE-2026-100715 | Froxlor before 2.3.12 Arbitrary File Deletion via Symlinkfroxlor · froxlor | High8.5 |
| CVE-2026-100714 | Froxlor before 2.3.12 Command Injection via letsencryptchallengepathfroxlor · froxlor | Critical9.4 |
| CVE-2026-100713 | Froxlor before 2.3.12 Privilege Escalation via SSH Key Syncfroxlor · froxlor | High7.1 |
| CVE-2026-100712 | froxlor before 2.3.12 Two-Factor Authentication Bypass via CSRFfroxlor · froxlor | High7.1 |
| CVE-2026-100711 | froxlor before 2.3.12 Authentication Bypass via Session Persistencefroxlor · froxlor | High8.7 |
| CVE-2026-100710 | Froxlor before 2.3.12 DKIM Private Key Disclosure via APIfroxlor · froxlor | Medium6.9 |
| CVE-2026-100709 | Froxlor before 2.3.11 2FA Bypass via Namespace Confusionfroxlor · froxlor | High7.7 |
| CVE-2026-100708 | Froxlor before 2.3.13 Private Key Disclosure via Certificates APIfroxlor · froxlor | High7.1 |
| CVE-2026-90937 | froxlor before 2.2.5 nginx/Apache Configuration Injection via subdomain redirect URLfroxlor · froxlor | Critical9.4 |
| CVE-2026-90936 | Froxlor before 2.3.7 Information Disclosure via customer_email.phpfroxlor · froxlor | Medium5.3 |
| CVE-2026-90935 | Froxlor before 2.3.7 Authorization Bypass via Mysqls.add APIfroxlor · froxlor | Medium5.3 |
| CVE-2024-58383 | Froxlor before 2.2.0 Insecure File Permissions mysql.conffroxlor · froxlor | High8.4 |
| CVE-2026-90767 | Froxlor before 2.3.12 SSH Key Injection via authorized_keysfroxlor · Froxlor | High7.1 |
| CVE-2026-55593 | Froxlor: CSRF Vulnerability in Froxlor AJAX Endpoint — Missing Cross-Site Request Forgery Protectionfroxlor · froxlor | Medium6.5 |
| CVE-2026-54347 | Froxlor: Stored XSS in DNS TXT Record Content Allows Customer-to-Admin Account Takeoverfroxlor · froxlor | High8.7 |
| CVE-2026-54348 | Froxlor: Second-Order SQL Injection via `Admins.add` `ipaddress` Parameter Allows Full Database Exfiltrationfroxlor · froxlor | High7.2 |
| CVE-2026-54543 | Froxlor DomainZones.add allows DNS zone-file RR injection via record/type fieldsfroxlor · froxlor | Medium5.4 |
| CVE-2026-62988 | Froxlor: Credential and 2FA secret disclosure via Froxlor API endpointsfroxlor · froxlor | Critical9.0 |
| CVE-2026-52793 | Froxlor: API Authentication bypasses 2FA Authenticationfroxlor · froxlor | High8.1 |
| CVE-2026-41237 | Froxlor has an incomplete fix for CVE-2026-30932froxlor · froxlor | High8.6 |
| CVE-2026-41236 | Froxlor has privilege escalation in SSH key synchronization via symlinked `authorized_keys` pathfroxlor · froxlor | High8.8 |
| CVE-2026-41235 | Froxlor has an authorization bypass in FTP shell assignment via missing server-side `available_shells` enforcementfroxlor · froxlor | High8.6 |
| CVE-2026-41234 | Froxlor: BIND Zone File Injection via TXT Record Contentfroxlor · froxlor | High7.6 |
| CVE-2026-41233 | Froxlor has a Reseller Domain Quota Bypass via Unvalidated adminid Parameter in Domains.add()froxlor · froxlor | Medium5.4 |
| CVE-2026-41232 | Froxlor has an Email Sender Alias Domain Ownership Bypass via Wrong Array Index that Allows Cross-Customer Email Spoofingfroxlor · froxlor | Medium5.0 |
| CVE-2026-41231 | Froxlor has Incomplete Symlink Validation in DataDump.add() that Allows Arbitrary Directory Ownership Takeover via Cronfroxlor · froxlor | High7.5 |
| CVE-2026-41230 | Froxlor has a BIND Zone File Injection via Unsanitized DNS Record Content in DomainZones::add()froxlor · froxlor | High8.5 |
| CVE-2026-41229 | Froxlor has a PHP Code Injection via Unescaped Single Quotes in userdata.inc.php Generation (MysqlServer API)froxlor · froxlor | Critical9.1 |
| CVE-2026-41228 | Froxlor has Local File Inclusion via path traversal in API `def_language` parameter that leads to Remote Code Executionfroxlor · froxlor | Critical10.0 |
| CVE-2026-30932 | Froxlor is vulnerable to BIND zone file injection via unsanitized DNS record content in DomainZones APIfroxlor · froxlor | High8.6 |
| CVE-2026-26279 | Froxlor Admin-to-Root Privilege Escalation via Input Validation Bypass + OS Command Injectionfroxlor · Froxlor | Critical9.1 |
| CVE-2020-36978 | Froxlor Froxlor Server Management Panel 0.10.16 - Persistent Cross-Site ScriptingFroxlor · Froxlor Froxlor Server Management Panel | Medium5.1 |
| CVE-2025-48958 | Froxlor has an HTML Injection Vulnerabilityfroxlor · Froxlor | Medium5.5 |
| CVE-2025-29773 | Froxlor allows Multiple Accounts to Share the Same Email Address Leading to Potential Privilege Escalation or Account Takeoverfroxlor · Froxlor | Medium5.8 |
| CVE-2024-34070 | Froxlor Vulnerable to Blind XSS Leading to Froxlor Application Compromisefroxlor · Froxlor | Critical9.7 |