Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 9 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 400,893All CVEsplus 19,117 rejected
- 444Last 24 hours2,910 in the last 7 days
- 16,794Last 30 days1,551 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 1 | 8 | 10 | 4 | 0 | 23 | 27 |
| 2025 | 0 | 0 | 4 | 0 | 0 | 4 | 4 |
| Title | ||
|---|---|---|
| CVE-2026-117538 | REDAXO before 5.21.0 Reflected XSS via Packages API function Parameterredaxo · core | Low2.1 |
| CVE-2026-117537 | REDAXO before 5.21.0 Reflected XSS via Metainfo API type Parameterredaxo · core | Low2.1 |
| CVE-2026-117536 | REDAXO before 5.21.3 CSRF Token Bypass via users/users Privilege Escalationredaxo · core | High8.6 |
| CVE-2026-117535 | REDAXO before 5.21.3 Reflected XSS via opener_link in Media Poolredaxo · core | Medium5.1 |
| CVE-2026-117534 | REDAXO before 5.21.3 CSRF in Article History Pluginredaxo · core | Medium5.1 |
| CVE-2026-117533 | REDAXO 5.18.0 before 5.21.4 Stored XSS via Unsanitized Mediapool SVG Uploadsredaxo · core | Low2.1 |
| CVE-2026-117532 | REDAXO Core 5.3.0 before 5.21.4 Authentication Bypass via History Pluginredaxo · core | Critical9.3 |
| CVE-2026-116900 | REDAXO before 5.21.4 Stored XSS via Media and Link Input Widgetsredaxo · core | Medium5.1 |
| CVE-2026-116899 | REDAXO before 5.21.4 Broken Access Control in Slice Operationsredaxo · core | High7.1 |
| CVE-2026-116898 | REDAXO before 5.21.4 Missing Authorization in Media Pool Bulk Moveredaxo · core | High7.1 |
| CVE-2026-116897 | REDAXO before 5.21.4 Missing Authorization in Version and History Previewsredaxo · core | High7.1 |
| CVE-2026-116896 | REDAXO before 5.21.5 Privilege Escalation via Backup Export of Authentication Tablesredaxo · core | High7.7 |
| CVE-2026-116895 | REDAXO before 5.21.5 CSRF via Safe Mode Toggle Parameterredaxo · core | Medium5.1 |
| CVE-2026-116894 | REDAXO before 5.21.5 Insufficient Session Expiration on Password Changeredaxo · core | Low2.3 |
| CVE-2026-116893 | REDAXO core before 5.21.5 Missing Authorization in rex_api_package APIredaxo · core | Medium6.1 |
| CVE-2026-63000 | REDAXO: Missing CSRF Protection on Package Update Action Allows Forced Addon Updatesredaxo · core | Medium6.4 |
| CVE-2026-62998 | REDAXO: Unwhitelisted ORDER BY Column in rex_list Allows Authenticated Column Enumerationredaxo · core | Medium4.3 |
| CVE-2026-63002 | REDAXO: Stored XSS in Mediapool Sync Page via Unescaped Filesystem Filenamesredaxo · core | Medium4.8 |
| CVE-2026-63001 | REDAXO: Stored XSS via Unescaped Media Manager Type Name in `mediaIsInUse()`redaxo · core | Medium4.8 |
| CVE-2026-53599 | Redaxo has a Mediapool isAllowedExtension bypass via multi-segment filename that leads to authenticated RCE on Apache mod_php multi-extension handlersredaxo · core | High7.5 |
| CVE-2018-25353 | Redaxo CMS Mediapool Addon 5.5.1 Arbitrary File UploadRedaxo · Redaxo CMS Mediapool | High8.7 |
| CVE-2016-20053 | Redaxo CMS 5.2 Cross-Site Request Forgery via users endpointRedaxo · Redaxo CMS | Medium6.9 |
| CVE-2026-21857 | Redaxo has Path Traversal in Backup Addon Leading to Arbitrary File Readredaxo · redaxo | High8.3 |
| CVE-2025-66026 | REDAXO is Vulnerable to Reflected XSS in Mediapool Info Banner via args[types]redaxo · redaxo | Medium6.1 |
| CVE-2025-27412 | REDAXO allows Authenticated Reflected Cross Site Scripting - packages installationredaxo · redaxo | Medium6.1 |
| CVE-2025-27411 | REDAXO allows Arbitrary File Upload in the mediapool pageredaxo · redaxo | Medium5.4 |
| CVE-2024-13209 | Redaxo CMS Structure Management Page index.php cross site scriptingRedaxo · CMS | Medium5.1 |