Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 7 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,074All CVEsplus 19,119 rejected
- 506Last 24 hours2,863 in the last 7 days
- 16,887Last 30 days1,546 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 0 | 4 | 7 | 1 | 0 | 12 | 22 |
| 2025 | 0 | 0 | 0 | 1 | 0 | 1 | 10 |
| 2024 | 0 | 0 | 0 | 0 | 0 | 0 | 9 |
| 2023 | 0 | 0 | 0 | 0 | 0 | 0 | 9 |
| 2022 | 5 | 2 | 2 | 0 | 0 | 9 | 9 |
| Title | ||
|---|---|---|
| CVE-2026-104905 | FacturaScripts < 2026.7 PHP Object Injection via WidgetSelectNeoRazorX · facturascripts | Medium6.1 |
| CVE-2026-42877 | FacturaScripts: Stored XSS via product reference in sales/purchasesNeoRazorX · facturascripts | Medium5.4 |
| CVE-2026-42879 | FacturaScripts: Authenticated Remote Code Execution (RCE) via GIF Image Upload in Product ImagesNeoRazorX · facturascripts | Medium6.3 |
| CVE-2026-42878 | FacturaScripts: Unauthenticated phpinfo() Disclosure via Installer Endpoint in FacturaScriptsNeoRazorX · facturascripts | Medium5.3 |
| CVE-2026-27964 | FacturaScripts: Reflected Cross-Site Scripting (XSS) via Cookie ManipulationNeoRazorX · facturascripts | Low3.9 |
| CVE-2026-27892 | FacturaScripts: Unstripped Image Metadata (EXIF) Leakage via Library Module File Upload/DownloadNeoRazorX · facturascripts | Medium6.5 |
| CVE-2026-27891 | Remote Code Execution (RCE) via Zip Slip in Plugin Upload MechanismNeoRazorX · facturascripts | High7.2 |
| CVE-2026-32699 | FacturaScripts unauthorized modification of immutable nick field via EditUser controllerNeoRazorX · facturascripts | Medium5.3 |
| CVE-2026-25513 | FacturaScripts has SQL Injection vulnerability in API ORDER BY ClauseNeoRazorX · facturascripts | High8.3 |
| CVE-2026-25514 | FacturaScripts has SQL Injection vulnerability in Autocomplete ActionsNeoRazorX · facturascripts | High8.7 |
| CVE-2026-23476 | FacturaScripts Affected by Reflected XSSNeoRazorX · facturascripts | Medium5.4 |
| CVE-2026-23997 | FacturaScripts has a Stored Cross-Site Scripting (XSS) in "Observations" field via History ViewNeoRazorX · facturascripts | High8.0 |
| CVE-2025-69210 | FacturaScripts vulnerable to Stored Cross-Site Scripting (XSS) via XML File UploadNeoRazorX · facturascripts | Low1.2 |
| CVE-2022-2066 | Cross-site Scripting (XSS) - Reflected in neorazorx/facturascriptsneorazorx · neorazorx/facturascripts | High7.1 |
| CVE-2022-2065 | Cross-site Scripting (XSS) - Stored in neorazorx/facturascriptsneorazorx · neorazorx/facturascripts | High8.6 |
| CVE-2022-2016 | Cross-site Scripting (XSS) - Reflected in neorazorx/facturascriptsneorazorx · neorazorx/facturascripts | Medium6.8 |
| CVE-2022-1988 | Cross-site Scripting (XSS) - Generic in neorazorx/facturascriptsneorazorx · neorazorx/facturascripts | Medium6.5 |
| CVE-2022-1715 | Account Takeover in neorazorx/facturascriptsneorazorx · neorazorx/facturascripts | Critical9.8 |
| CVE-2022-1682 | Reflected Xss using url based payload in neorazorx/facturascriptsneorazorx · neorazorx/facturascripts | Critical9.4 |
| CVE-2022-1571 | Cross-site scripting - Reflected in Create Subaccount in neorazorx/facturascriptsneorazorx · neorazorx/facturascripts | Critical9.9 |
| CVE-2022-1514 | Stored XSS via upload plugin functionality in zip format in neorazorx/facturascriptsneorazorx · neorazorx/facturascripts | Critical9.0 |
| CVE-2022-1457 | Store XSS in title parameter executing at EditUser Page & EditProducto page in neorazorx/facturascriptsneorazorx · neorazorx/facturascripts | Critical9.0 |