Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 5 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,298All CVEsplus 19,140 rejected
- 453Last 24 hours2,722 in the last 7 days
- 16,916Last 30 days1,557 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 10 | 9 | 11 | 1 | 0 | 31 | 34 |
| 2025 | 0 | 0 | 1 | 0 | 0 | 1 | 3 |
| 2024 | 2 | 0 | 0 | 0 | 0 | 2 | 2 |
| Title | ||
|---|---|---|
| CVE-2026-122032 | SPIP before 4.4.29 Authenticated SQL Injection via where ParameterSPIP · SPIP | High7.1 |
| CVE-2026-109378 | SPIP before 4.4.18 SSRF via HTTP Redirects in recuperer_urlSPIP · SPIP | Medium5.3 |
| CVE-2026-104070 | SPIP Crayons Plugin < 3.5.0 Authorization Bypass RCESPIP · SPIP Crayons Plugin | Critical9.3 |
| CVE-2026-72710 | SPIP < 4.4.18 RCE via editer_objet.php Job Queue InjectionSPIP · SPIP | Critical9.3 |
| CVE-2026-72709 | SPIP < 4.4.18 Missing Authorization via ecrire/action/SPIP · SPIP | Critical9.3 |
| CVE-2026-72708 | SPIP < 4.4.18 Unauthenticated Blind SQL Injection via sitemap.xml.htmlSPIP · SPIP | High8.7 |
| CVE-2026-77806 | SPIP before 4.4.21 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is related to code…SPIP · SPIP | Critical9.8 |
| CVE-2026-77647 | SPIP before 4.4.20 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is related to incorrect…SPIP · SPIP | Critical9.8 |
| CVE-2026-66738 | SPIP < 4.4.18 Code Injection via Navigation Endpoint on SQLiteSPIP · SPIP | High7.7 |
| CVE-2026-48832 | action/cookie.php in ecrire in SPIP before 4.4.15 is prone to an open redirect vulnerability.SPIP · SPIP | Low3.5 |
| CVE-2026-8430 | SPIP < 4.4.14 Remote Code Execution via nginxSPIP · SPIP | Critical9.2 |
| CVE-2026-8429 | SPIP < 4.4.14 Remote Code Execution via Private SpaceSPIP · SPIP | High8.7 |
| CVE-2026-33549 | SPIP 4.4.10 through 4.4.12 before 4.4.13 allows unintended privilege assignment (of administrator privileges) during the editing of an author data structure…SPIP · SPIP | Medium6.7 |
| CVE-2026-22205 | SPIP < 4.4.10 Authentication Bypass via PHP Type JugglingSPIP · SPIP | High8.7 |
| CVE-2026-22206 | SPIP < 4.4.10 SQL Injection RCE via Union & PHP TagsSPIP · SPIP | High8.7 |
| CVE-2026-27743 | SPIP referer_spam < 1.3.0 Unauthenticated SQL InjectionSPIP · referer_spam | Critical9.3 |
| CVE-2026-27744 | SPIP tickets < 4.3.3 Unauthenticated RCESPIP · tickets | Critical9.3 |
| CVE-2026-27745 | SPIP interface_traduction_objets < 2.2.2 Authenticated RCESPIP · interface_traduction_objets | High8.7 |
| CVE-2026-27746 | SPIP jeux < 4.1.1 Reflected XSS via index ParametersSPIP · jeux | Medium5.1 |
| CVE-2026-27747 | SPIP interface_traduction_objets < 2.2.2 Authenticated SQL InjectionSPIP · interface_traduction_objets | High7.1 |
| CVE-2026-27475 | SPIP < 4.4.9 Insecure DeserializationSPIP · SPIP | Critical9.2 |
| CVE-2026-27474 | SPIP < 4.4.9 Cross-Site Scripting in Private Area (Incomplete Fix)SPIP · SPIP | Medium4.8 |
| CVE-2026-27473 | SPIP < 4.4.9 Stored Cross-Site Scripting via Syndicated SitesSPIP · SPIP | Medium5.1 |
| CVE-2026-27472 | SPIP < 4.4.9 Blind Server-Side Request Forgery via Syndicated SitesSPIP · SPIP | Medium5.3 |
| CVE-2026-26223 | SPIP < 4.4.8 Cross-Site Scripting via Iframe Tags in Private AreaSPIP · SPIP | Medium5.1 |
| CVE-2026-26345 | SPIP < 4.4.8 Cross-Site Scripting in Public AreaSPIP · SPIP | High8.6 |
| CVE-2025-71244 | SPIP < 4.4.5 Open Redirect via Login FormSPIP · SPIP | Medium5.1 |
| CVE-2025-71243 | SPIP Saisies Plugin < 5.11.1 Remote Code ExecutionSPIP · Saisies pour formulaire | Critical9.3 |
| CVE-2025-71242 | SPIP < 4.3.6 Authorization Bypass Leading to Content DisclosureSPIP · SPIP | Medium5.3 |
| CVE-2025-71241 | SPIP < 4.3.6 Cross-Site Scripting in Private AreaSPIP · SPIP | Medium4.8 |
| CVE-2025-71240 | SPIP < 4.2.15 Cross-Site Scripting via Code TagsSPIP · SPIP | Medium4.8 |
| CVE-2023-53900 | Spip 4.1.10 Admin Account Spoofing via Malicious SVG Uploadspip · spip | Medium4.8 |
| CVE-2024-8517 | SPIP Bigup Multipart File Upload OS Command InjectionSPIP · SPIP | Critical9.8 |
| CVE-2024-7954 | SPIP porte_plume Plugin Arbitrary PHP ExecutionSPIP · SPIP | Critical9.8 |