Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 2 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,765All CVEsplus 19,141 rejected
- 667Last 24 hours3,065 in the last 7 days
- 17,158Last 30 days1,610 of them critical
- 1,769Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 5 | 6 | 17 | 0 | 0 | 28 | 55 |
| 2025 | 0 | 2 | 6 | 0 | 0 | 8 | 27 |
| 2024 | 1 | 7 | 9 | 0 | 0 | 17 | 19 |
| 2023 | 0 | 0 | 1 | 0 | 0 | 1 | 2 |
| 2022 | 0 | 1 | 0 | 0 | 0 | 1 | 1 |
| Title | ||
|---|---|---|
| CVE-2026-115346 | Avada | Website Builder For WordPress & WooCommerce <= 7.16.2 - Unauthenticated Arbitrary File Upload via Avada Form Upload FieldThemeFusion · Avada | Website Builder For WordPress & WooCommerce | High8.1 |
| CVE-2026-104729 | Avada (Fusion) Builder <= 3.16.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tab_index' and 'empty_notice' Shortcode Attributesthemefusion · Avada (Fusion) Builder | Medium6.4 |
| CVE-2026-97471 | Avada (Fusion) Builder <= 3.16.1 - Unauthenticated Sensitive Information Exposure in 'args[link_target]' Parameter via {user_meta} Dynamic Data Tokenthemefusion · Avada (Fusion) Builder | Medium5.3 |
| CVE-2026-97340 | Avada | Website Builder For WordPress & WooCommerce <= 7.16.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'author_facebook' User Profile FieldThemeFusion · Avada | Website Builder For WordPress & WooCommerce | Medium6.4 |
| CVE-2026-97670 | Avada (Fusion) Builder <= 7.16.1 - Unauthenticated Arbitrary WordPress Action Invocation via '{action_hook}' Dynamic-Data Token in Form Fieldthemefusion · Avada (Fusion) Builder | Critical9.1 |
| CVE-2026-84925 | Avada | Website Builder For WordPress & WooCommerce <= 7.16.1 - Reflected Cross-Site Scripting via 'lang' ParameterThemeFusion · Avada | Website Builder For WordPress & WooCommerce | Medium6.1 |
| CVE-2026-16654 | Avada (Fusion) Builder <= 3.15.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'size' Shortcode Attributethemefusion · Avada (Fusion) Builder | Medium6.4 |
| CVE-2026-18431 | Avada <= 7.16 and Fusion Builder <= 3.16 - Unauthenticated Remote Code Execution via Arbitrary File Writethemefusion · Avada (Fusion) Builder | Critical9.8 |
| CVE-2026-65524 | WordPress Avada Custom Branding plugin <= 1.2 - Broken Access Control vulnerabilityThemeFusion · Avada Custom Branding | Medium4.3 |
| CVE-2026-12536 | Avada Builder <= 3.15.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Module Titlethemefusion · Avada (Fusion) Builder | Medium6.4 |
| CVE-2026-56008 | WordPress Fusion Builder plugin <= 3.15.4 - Privilege Escalation vulnerabilityThemeFusion · Fusion Builder | High8.8 |
| CVE-2026-8713 | Avada (Fusion) Builder <= 3.15.3 - Unauthenticated Arbitrary File Deletion via Form Entry Valuethemefusion · Avada (Fusion) Builder | Critical9.1 |
| CVE-2026-54193 | WordPress Fusion Builder plugin <= 3.15.4 - Arbitrary File Deletion vulnerabilityThemeFusion · Fusion Builder | High7.7 |
| CVE-2026-12256 | WordPress Fusion Builder plugin <= 3.15.3 - PHP Object Injection vulnerabilityThemeFusion · Fusion Builder | High8.8 |
| CVE-2026-54194 | WordPress Fusion Builder plugin <= 3.15.4 - PHP Object Injection vulnerabilityThemeFusion · Fusion Builder | Critical9.8 |
| CVE-2026-1543 | Avada (Fusion) Builder <= 3.15.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Multiple Shortcodesthemefusion · Avada (Fusion) Builder | Medium6.4 |
| CVE-2026-6279 | Avada (Fusion) Builder <= 3.15.2 - Unauthenticated Remote Code Execution via PHP Function Injection via 'render_logics' Shortcode Attribute via Widget AJAX Handlerthemefusion · Avada (Fusion) Builder | Critical9.8 |
| CVE-2026-4782 | Avada Builder <= 3.15.2 - Authenticated (Subscriber+) Arbitrary File Read via 'custom_svg' Shortcode Parameterthemefusion · Avada (Fusion) Builder | Medium6.5 |
| CVE-2026-4798 | Avada Builder <= 3.15.1 - Unauthenticated SQL Injection via 'product_order' Parameterthemefusion · Avada (Fusion) Builder | High7.5 |
| CVE-2025-58922 | WordPress Avada theme < 7.13.2 - Cross Site Request Forgery (CSRF) vulnerabilityThemeFusion · Avada | Medium4.3 |
| CVE-2026-1509 | Avada (Fusion) Builder <= 3.15.1 - Authenticated (Subscriber+) Limited Arbitrary WordPress Action Executionthemefusion · Avada (Fusion) Builder | Medium5.4 |
| CVE-2026-1541 | Avada (Fusion) Builder <= 3.15.1 - Authenticated (Subscriber+) Sensitive Information Exposure via Insecure Direct Object Referencethemefusion · Avada (Fusion) Builder | Medium4.3 |
| CVE-2026-32542 | WordPress Fusion Builder plugin < 3.15.0 - Reflected Cross Site Scripting (XSS) vulnerabilityThemeFusion · Fusion Builder | High7.1 |
| CVE-2026-32454 | WordPress Avada Core plugin < 5.15.0 - Cross Site Scripting (XSS) vulnerabilityThemeFusion · Avada Core | Medium6.5 |
| CVE-2026-32453 | WordPress Avada Core plugin < 5.15.0 - Broken Access Control vulnerabilityThemeFusion · Avada Core | Medium5.3 |
| CVE-2026-32452 | WordPress Fusion Builder plugin < 3.15.0 - Broken Access Control vulnerabilityThemeFusion · Fusion Builder | Medium5.3 |
| CVE-2026-32451 | WordPress Fusion Builder plugin < 3.15.0 - Broken Access Control vulnerabilityThemeFusion · Fusion Builder | Medium6.5 |
| CVE-2026-25472 | WordPress Fusion Builder plugin <= 3.14.1 - Cross Site Scripting (XSS) vulnerabilityThemeFusion · Fusion Builder | Medium6.5 |
| CVE-2025-64634 | WordPress Avada theme <= 7.13.2 - Broken Access Control vulnerabilityThemeFusion · Avada | Medium5.3 |
| CVE-2025-49940 | WordPress Fusion Builder plugin <= 3.13.2 - Cross Site Scripting (XSS) vulnerabilityThemeFusion · Fusion Builder | Medium6.5 |
| CVE-2025-6747 | Avada (Fusion) Builder <= 3.12.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodethemefusion · Avada (Fusion) Builder | Medium6.4 |
| CVE-2025-24748 | WordPress Avada theme <= 7.11.10 - Broken Access Control vulnerabilityThemeFusion · Avada | Medium5.3 |
| CVE-2025-1665 | Avada Builder <= 3.11.14 - Authenticated (Contributor+) Stored Cross-Site Scriptingthemefusion · Avada (Fusion) Builder | Medium6.4 |
| CVE-2024-13345 | Avada Builder <= 3.11.13 - Unauthenticated Arbitrary Shortcode Executionthemefusion · Avada (Fusion) Builder | High7.3 |
| CVE-2024-13346 | Avada Theme <= 7.11.13 - Unauthenticated Arbitrary Shortcode ExecutionThemeFusion · Avada | Website Builder For WordPress & WooCommerce | High7.3 |
| CVE-2024-12477 | Avada Builder <= 3.11.11 - Authenticated (Contributor+) Stored Cross-Site Scripting in Multiple Widgetsthemefusion · Avada (Fusion) Builder | Medium6.4 |
| CVE-2024-12335 | Avada Builder <= 3.11.12 - Authenticated (Contributor+) Protected Post Disclosurethemefusion · Avada (Fusion) Builder | Medium4.3 |
| CVE-2024-54357 | WordPress Avada theme <= 7.11.10 - Cross Site Request Forgery (CSRF) vulnerabilityThemeFusion · Avada | Medium4.3 |
| CVE-2024-5628 | Avada | Website Builder For WordPress & eCommerce <= 3.11.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via fusion_button Shortcodethemefusion · Avada (Fusion) Builder | Medium6.4 |
| CVE-2023-39312 | WordPress Avada theme <= 7.11.1 - Auth. Unrestricted Zip Extraction vulnerabilityThemeFusion · Avada | Critical9.1 |
| CVE-2023-39310 | WordPress Avada Builder plugin <= 3.11.1 - Authenticated Broken Access Control vulnerabilityThemeFusion · Fusion Builder | Medium5.4 |
| CVE-2023-39922 | WordPress Avada theme <= 7.11.1 - Authenticated Broken Access Control vulnerabilityThemeFusion · Avada | Medium4.3 |
| CVE-2024-2311 | Avada <= 7.11.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeThemeFusion · Avada | Website Builder For WordPress & WooCommerce | Medium6.4 |
| CVE-2024-2344 | Avada <= 7.11.6 - Authenticated (Admin+) SQL Injection via entryThemeFusion · Avada | Website Builder For WordPress & WooCommerce | High7.2 |
| CVE-2024-2340 | Avada <= 7.11.6 - Unauthenticated Sensitive Information Exposure via Form Uploads Directory ListingThemeFusion · Avada | Website Builder For WordPress & WooCommerce | Medium5.3 |
| CVE-2024-2343 | Avada <= 7.11.6 - Authenticated (Contributor+) Server-Side Request Forgery via form_to_url_actionThemeFusion · Avada | Website Builder For WordPress & WooCommerce | Medium6.4 |
| CVE-2023-39309 | WordPress Avada Builder plugin <= 3.11.1 - Auth. SQL Injection vulnerabilityThemeFusion · Fusion Builder | High8.5 |
| CVE-2023-39313 | WordPress Avada theme <= 7.11.1 - Authenticated Server Side Request Forgery (SSRF) vulnerabilityThemeFusion · Avada | High7.7 |
| CVE-2023-39311 | WordPress Avada Builder plugin <= 3.11.1 - Cross Site Request Forgery (CSRF) vulnerabilityThemeFusion · Fusion Builder | High7.1 |
| CVE-2023-39306 | WordPress Avada Builder plugin <= 3.11.1 - Reflected Cross Site Scripting (XSS) vulnerabilityThemeFusion · Fusion Builder | High7.1 |