Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 3 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,933All CVEsplus 19,141 rejected
- 327Last 24 hours3,187 in the last 7 days
- 17,003Last 30 days1,575 of them critical
- 1,769Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 5 | 22 | 55 | 1 | 0 | 83 | 146 |
| 2025 | 0 | 2 | 12 | 0 | 0 | 14 | 63 |
| 2024 | 2 | 12 | 27 | 0 | 0 | 41 | 49 |
| 2023 | 0 | 3 | 3 | 0 | 0 | 6 | 8 |
| 2022 | 0 | 0 | 1 | 0 | 0 | 1 | 2 |
| 2021 | 0 | 0 | 0 | 1 | 0 | 1 | 1 |
| Title | ||
|---|---|---|
| CVE-2026-93779 | Tutor LMS <= 4.1.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Exposure via REST API Endpointsthemeum · Tutor LMS – eLearning and online course solution | Medium6.5 |
| CVE-2026-112348 | Kirki WordPress Plugin < 6.2.5 reCAPTCHA Bypass via Missing TokenThemeum · Kirki | Medium6.9 |
| CVE-2026-112347 | Kirki WordPress Plugin < 6.4.1 Broken Object-Level Access Control via Page APIThemeum · Kirki | High7.2 |
| CVE-2026-118083 | WordPress WP Crowdfunding plugin <= 2.2.2 - Sensitive Data Exposure vulnerabilityThemeum · WP Crowdfunding | High7.5 |
| CVE-2026-42692 | WordPress WP Crowdfunding plugin <= 2.2.2 - Cross Site Scripting (XSS) vulnerabilityThemeum · WP Crowdfunding | High7.1 |
| CVE-2026-42694 | WordPress Kirki plugin <= 6.4.0 - Content Injection vulnerabilityThemeum · Kirki | Medium4.3 |
| CVE-2026-75891 | Kirki <= 6.2.5 - Authenticated (Subscriber+) PHP Object Injection to Administrator Account Takeover via 'get-single-symbol' AJAX Endpointthemeum · Kirki – Freeform Page Builder, Website Builder & Customizer | High8.8 |
| CVE-2026-111407 | WordPress Tutor LMS plugin <= 4.1.2 - Cross Site Scripting (XSS) vulnerabilityThemeum · Tutor LMS | Medium6.5 |
| CVE-2026-92715 | Tutor LMS <= 4.1.0 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Course Modification and Ownership Takeover via 'ID' Parameterthemeum · Tutor LMS – eLearning and online course solution | Medium4.3 |
| CVE-2026-104734 | Kirki <= 6.3.2 - Authenticated (Administrator+) PHP Object Injection via Deserialization of Untrusted Input via ZIP Template Importthemeum · Kirki – Freeform Page Builder, Website Builder & Customizer | High7.2 |
| CVE-2026-107762 | Kirki <= 6.3.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via Context Smuggling via 'context' Parameterthemeum · Kirki – Freeform Page Builder, Website Builder & Customizer | High7.5 |
| CVE-2026-93681 | Tutor LMS <= 4.1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via display_name Parameterthemeum · Tutor LMS – eLearning and online course solution | Medium6.4 |
| CVE-2026-88963 | Tutor LMS <= 4.0.8 - Authenticated (Subscriber+) Reflected DOM-Based Cross-Site Scripting via 'redirect_url' Parameterthemeum · Tutor LMS – eLearning and online course solution | Medium6.1 |
| CVE-2026-14572 | Kirki <= 6.2.0 - Authenticated (Custom+) Stored Cross-Site Scripting via Page Builder Text Contentthemeum · Kirki – Freeform Page Builder, Website Builder & Customizer | Medium6.4 |
| CVE-2026-100193 | Tutor LMS <= 4.1.0 - Reflected Cross-Site Scripting via 'tab' Parameterthemeum · Tutor LMS – eLearning and online course solution | Medium4.7 |
| CVE-2026-42702 | WordPress Tutor LMS plugin <= 4.1.0 - Cross Site Scripting (XSS) vulnerabilityThemeum · Tutor LMS | High7.1 |
| CVE-2026-102291 | Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.3.1 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'display_name'themeum · Kirki – Freeform Page Builder, Website Builder & Customizer | Medium5.4 |
| CVE-2026-42698 | WordPress Tutor LMS plugin <= 4.1.1 - Race Condition vulnerabilityThemeum · Tutor LMS | Medium5.3 |
| CVE-2026-102173 | Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.3.1 - Unauthenticated Stored Cross-Site Scripting via Registration Metadatathemeum · Kirki – Freeform Page Builder, Website Builder & Customizer | High7.2 |
| CVE-2026-103065 | WordPress Kirki plugin <= 6.3.1 - Arbitrary Code Execution vulnerabilityThemeum · Kirki | High8.2 |
| CVE-2026-18335 | Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.2.0 - Unauthenticated Blind Server-Side Request Forgery via 'kirki_data' Parameterthemeum · Kirki – Freeform Page Builder, Website Builder & Customizer | Medium5.4 |
| CVE-2026-18439 | Tutor LMS <= 4.0.7 - Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Quiz Question/Answer Modification and Deletion via 'payload' Parameterthemeum · Tutor LMS – eLearning and online course solution | Medium4.3 |
| CVE-2026-89081 | Tutor LMS <= 4.0.8 - Reflected Cross-Site Scripting via 'back_url' and 'search' Parametersthemeum · Tutor LMS – eLearning and online course solution | Medium6.1 |
| CVE-2026-88944 | Tutor LMS <= 4.0.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion via 'lesson_id' Parameterthemeum · Tutor LMS – eLearning and online course solution | Medium4.3 |
| CVE-2026-89333 | Tutor LMS <= 4.0.8 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Exposure via 'student_id' Parameterthemeum · Tutor LMS – eLearning and online course solution | Medium6.5 |
| CVE-2026-92465 | WordPress WP Mega Menu plugin <= 1.4.2 - SQL Injection vulnerabilityThemeum · WP Mega Menu | High7.6 |
| CVE-2026-78175 | Tutor LMS <= 4.0.7 - Authenticated (Subscriber+) PHP Object Injection to Remote Code Executionthemeum · Tutor LMS – eLearning and online course solution | High8.8 |
| CVE-2026-17037 | Kirki <= 6.2.0 - Unauthenticated Stored Cross-Site Scripting via 'comment' Parameterthemeum · Kirki – Freeform Page Builder, Website Builder & Customizer | High7.2 |
| CVE-2026-19945 | WP Crowdfunding <= 2.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'first_name' Parameterthemeum · WP Crowdfunding | Medium6.4 |
| CVE-2026-19944 | WP Crowdfunding <= 2.2.1 - Authenticated (Shop Manager+) SQL Injection via 'wpneo_reward' Post Metathemeum · WP Crowdfunding | Medium4.9 |
| CVE-2026-16759 | Tutor LMS <= 4.0.5 - Unauthenticated Remote Code Execution via 'template' and 'data' POST Parametersthemeum · Tutor LMS – eLearning and online course solution | Medium6.5 |
| CVE-2026-66629 | WordPress Kirki plugin <= 6.2.3 - Cross Site Scripting (XSS) vulnerabilityThemeum · Kirki | High7.1 |
| CVE-2026-18347 | Kirki <= 6.1.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via 'context' Parameterthemeum · Kirki – Freeform Page Builder, Website Builder & Customizer | Medium4.3 |
| CVE-2026-17604 | Kirki <= 6.1.1 - Authenticated (Editor+) Path Traversal to Arbitrary File Read via 'data' Parameterthemeum · Kirki – Freeform Page Builder, Website Builder & Customizer | Medium4.9 |
| CVE-2026-16974 | Kirki - Freeform Page Builder, Website Builder & Customizer <= 6.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via post_meta Shortcodethemeum · Kirki – Freeform Page Builder, Website Builder & Customizer | Medium6.4 |
| CVE-2026-15601 | Kirki <= 6.0.13 - Authenticated (Editor+) Path Traversal to Arbitrary File Write (Zip Slip)themeum · Kirki – Freeform Page Builder, Website Builder & Customizer | Medium4.9 |
| CVE-2026-15444 | Tutor LMS <= 4.0.1 - Authenticated (Administrator+) SQL Injection via 'coupon_code' Parameterthemeum · Tutor LMS – eLearning and online course solution | Medium4.9 |
| CVE-2026-65436 | WordPress Kirki plugin <= 6.0.13 - Arbitrary File Deletion vulnerabilityThemeum · Kirki | Medium6.8 |
| CVE-2026-13464 | Kirki <= 6.0.14 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'context' Parameterthemeum · Kirki – Freeform Page Builder, Website Builder & Customizer | Medium5.3 |
| CVE-2026-65531 | WordPress Qubely plugin <= 1.8.14 - Broken Access Control vulnerabilityThemeum · Qubely | Medium4.8 |
| CVE-2026-1372 | Tutor LMS Elementor Addons <= 4.0.0 - Missing Authorization to Authenticated (Subscriber+) Tutor LMS and Elementor Plugin Activationthemeum · Tutor LMS Elementor Addons | Medium4.3 |
| CVE-2026-15457 | Kirki <= 6.0.13 - Authenticated (Editor+) Path Traversal to Arbitrary Directory Deletion via 'family' Parameterthemeum · Kirki – Freeform Page Builder, Website Builder & Customizer | Medium4.9 |
| CVE-2026-15022 | Tutor LMS <= 4.0.0 - Authenticated (Subscriber+) SQL Injection via Stored Quiz Answer Arraythemeum · Tutor LMS – eLearning and online course solution | Medium6.5 |
| CVE-2026-57724 | WordPress Kirki plugin <= 6.0.12 - PHP Object Injection vulnerabilityThemeum · Kirki | Critical9.8 |
| CVE-2026-57725 | WordPress Kirki plugin <= 6.0.11 - Cross Site Scripting (XSS) vulnerabilityThemeum · Kirki | High7.1 |
| CVE-2026-57726 | WordPress Kirki plugin <= 6.0.12 - SQL Injection vulnerabilityThemeum · Kirki | Critical9.3 |
| CVE-2026-57727 | WordPress Kirki plugin <= 6.2.0 - Broken Access Control vulnerabilityThemeum · Kirki | High7.5 |
| CVE-2026-57694 | WordPress Tutor LMS plugin <= 3.9.13 - Insecure Direct Object References (IDOR) vulnerabilityThemeum · Tutor LMS | Medium6.5 |
| CVE-2026-57680 | WordPress Kirki plugin <= 6.0.11 - Insecure Direct Object References (IDOR) vulnerabilityThemeum · Kirki | Medium6.5 |
| CVE-2026-12472 | Kirki <= 6.0.11 - Missing Authorization to Unauthenticated Arbitrary Email Content Injection (Mail Relay / Phishing) via 'emailBody' and 'emailSubject' Parametersthemeum · Kirki – Freeform Page Builder, Website Builder & Customizer | Medium5.3 |