Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 5 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 400,903All CVEsplus 19,118 rejected
- 375Last 24 hours2,802 in the last 7 days
- 16,790Last 30 days1,548 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 1 | 0 | 6 | 0 | 0 | 7 | 14 |
| 2025 | 1 | 0 | 3 | 0 | 0 | 4 | 7 |
| 2024 | 1 | 0 | 2 | 0 | 0 | 3 | 3 |
| Title | ||
|---|---|---|
| CVE-2026-14876 | Smart Slider 3 <= 3.5.1.38 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-href' Attribute in Custom HTML Blocknextendweb · Smart Slider 3 | Medium6.4 |
| CVE-2026-15798 | Smart Slider 3 <= 3.5.1.38 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'slider' Block Attributenextendweb · Smart Slider 3 | Medium6.4 |
| CVE-2026-12385 | Smart Slider 3 <= 3.5.1.37 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via WP_Query Parameter Injection via 'keyword' Parameternextendweb · Smart Slider 3 | Medium4.3 |
| CVE-2026-9197 | Smart Slider 3 <= 3.5.1.36 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'src'/'srcset' Attribute in HTML Exportnextendweb · Smart Slider 3 | Medium4.9 |
| CVE-2026-34424 | Smart Slider 3 Pro 3.5.1.35 Supply Chain Attack Remote Access ToolkitNextendweb · Smart Slider 3 Pro for WordPress | Critical9.3 |
| CVE-2026-4065 | Smart Slider 3 <= 3.5.1.33 - Missing Authorization to Authenticated (Contributor+) Slider Data Read and Image Record Manipulationnextendweb · Smart Slider 3 | Medium5.4 |
| CVE-2026-3098 | Smart Slider 3 <= 3.5.1.33 - Authenticated (Subscriber+) Arbitrary File Read via actionExportAllnextendweb · Smart Slider 3 | Medium6.5 |
| CVE-2025-13737 | Nextend Social Login and Register <= 3.1.21 - Cross-Site Request Forgery to Unlink User Social Loginnextendweb · Nextend Social Login and Register | Medium4.3 |
| CVE-2025-58031 | WordPress Nextend Facebook Connect Plugin <= 3.1.19 - Cross Site Scripting (XSS) VulnerabilityNextendweb · Nextend Facebook Connect | Medium6.5 |
| CVE-2025-6348 | Smart Slider 3 <= 3.5.1.28 - Authenticated (Administrator+) SQL Injection via `sliderid` Parameternextendweb · Smart Slider 3 | Medium4.9 |
| CVE-2025-1061 | Nextend Social Login Pro <= 3.1.16 - Authentication Bypass via Apple OAuth providernextendweb · Nextend Social Login Pro | Critical9.8 |
| CVE-2024-9893 | Nextend Social Login Pro <= 3.1.14 - Authentication Bypass via WordPress.com OAuth providernextendweb · Nextend Social Login Pro | Critical9.8 |
| CVE-2024-3027 | Smart Slider 3 <= 3.5.1.22 - Missing Authorization to Limited File Uploadnextendweb · Smart Slider 3 | Medium6.4 |
| CVE-2024-1775 | Nextend Social Login and Register <= 3.1.12 - Reflected Self-Based Cross-Site Scripting via error_descriptionnextendweb · Nextend Social Login and Register | Medium5.4 |