Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 5 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 400,898All CVEsplus 19,117 rejected
- 447Last 24 hours2,915 in the last 7 days
- 16,799Last 30 days1,554 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 2 | 31 | 45 | 4 | 0 | 82 | 88 |
| 2025 | 0 | 0 | 0 | 0 | 0 | 0 | 6 |
| 2024 | 0 | 0 | 1 | 0 | 0 | 1 | 6 |
| 2023 | 0 | 1 | 1 | 0 | 0 | 2 | 5 |
| 2022 | 0 | 0 | 0 | 0 | 0 | 0 | 3 |
| 2021 | 0 | 0 | 3 | 0 | 0 | 3 | 3 |
| Title | ||
|---|---|---|
| CVE-2026-63115 | ActivityPub Undo handler can unfollow or remove reposts on behalf of other accountsTryGhost · ActivityPub | Medium5.3 |
| CVE-2026-105683 | Ghost: Path Traversal Vulnerability in Ghost ImageSize ServiceTryGhost · Ghost | Low3.8 |
| CVE-2026-105682 | Ghost: Server-Side Request Forgery in Webhook TriggerTryGhost · Ghost | Low2.7 |
| CVE-2026-105681 | Ghost: Authorization Bypass in Comments FeatureTryGhost · Ghost | Medium6.5 |
| CVE-2026-105680 | Ghost: Authorization Issue Allowed Author Role to Delete any PostTryGhost · Ghost | Medium6.5 |
| CVE-2026-105679 | Ghost: Stored XSS via File Uploads on Local StorageTryGhost · Ghost | High7.3 |
| CVE-2026-105678 | Ghost: Editors Could Promote Staff Users to Their Own RoleTryGhost · Ghost | Medium4.3 |
| CVE-2026-105677 | Ghost: Remote Code Execution via Theme Translation FilesTryGhost · Ghost | High7.2 |
| CVE-2026-105676 | Ghost: Path Traversal via Locale SettingTryGhost · Ghost | Medium4.9 |
| CVE-2026-105675 | Ghost: Invite Token Disclosure in Ghost Admin APITryGhost · Ghost | High7.5 |
| CVE-2026-105652 | Ghost: Password Hash Ordering Disclosure in Ghost Admin APITryGhost · Ghost | Low3.1 |
| CVE-2026-105651 | Ghost: Stored XSS via Bookmark Card ImagesTryGhost · Ghost | High7.3 |
| CVE-2026-105650 | Ghost: Stored XSS via oEmbed Photo ResponsesTryGhost · Ghost | High8.1 |
| CVE-2026-105649 | Ghost: Stored XSS via SVG Uploads Bypassing SanitizationTryGhost · Ghost | High7.3 |
| CVE-2026-105648 | Ghost: Private IP Filtering Bypass via IPv6 Transition AddressesTryGhost · Ghost | Medium4.0 |
| CVE-2026-105647 | Ghost: Server-Side Request Forgery in Bookmark FetchingTryGhost · Ghost | Medium4.0 |
| CVE-2026-105646 | Ghost: Regular Expression Denial of Service in Content ImportTryGhost · Ghost | Medium4.9 |
| CVE-2026-105645 | Ghost: Regular Expression Denial of Service in External Media InlinerTryGhost · Ghost | Medium4.9 |
| CVE-2026-105644 | Ghost: Stored XSS via SVG Files in Content ImportsTryGhost · Ghost | Medium6.8 |
| CVE-2026-105643 | Ghost: Stored XSS via Embed Card PreviewsTryGhost · Ghost | High7.3 |
| CVE-2026-105642 | Ghost: Remote Code Execution via Bookmark Card ImagesTryGhost · Ghost | High8.8 |
| CVE-2026-104418 | Ghost from 6.10.3 before 6.64.0 RCE via Theme Translation FilesTryGhost · Ghost | High8.6 |
| CVE-2026-104417 | Ghost 1.20.0 before 6.64.0 Path Traversal via Locale SettingTryGhost · Ghost | Medium6.9 |
| CVE-2026-104416 | Ghost 4.39.0 before 6.64.0 Invite Token Disclosure via Admin APITryGhost · Ghost | High7.7 |
| CVE-2026-104415 | Ghost 0.7.2 before 6.64.0 Password Hash Ordering Disclosure via Admin APITryGhost · Ghost | Low2.3 |
| CVE-2026-104414 | Ghost from 2.5.0 before 6.64.0 Stored XSS via oEmbed Photo ResponsesTryGhost · Ghost | High8.6 |
| CVE-2026-104413 | Ghost 5.94.0 before 6.64.0 Stored XSS via Bookmark Card ImagesTryGhost · Ghost | High8.5 |
| CVE-2026-104412 | Ghost 0.5.0 before 6.64.0 Privilege Escalation via Staff Role AssignmentTryGhost · Ghost | Medium5.3 |
| CVE-2026-104411 | Ghost 6.22.1 before 6.64.0 Stored XSS via Local Storage File UploadsTryGhost · Ghost | High8.5 |
| CVE-2026-103292 | Ghost 0.5.3 before 6.50.0 Cross-Site Scripting via ghost_headTryGhost · Ghost | High8.6 |
| CVE-2026-103291 | Ghost 3.20.2 before 6.51.0 SSRF via image-size fetchTryGhost · Ghost | Medium5.3 |
| CVE-2026-103290 | Ghost 6.14.0 before 6.27.0 Path Traversal via ImageSizeTryGhost · Ghost | Medium5.1 |
| CVE-2026-103289 | Ghost 5.9.0 before 6.44.1 Authorization Bypass via CommentsTryGhost · Ghost | High7.1 |
| CVE-2026-103288 | Ghost 5.9.0 before 6.44.1 Authorization Bypass via Comment LikeTryGhost · Ghost | High7.1 |
| CVE-2026-103287 | Ghost 1.18.0 before 6.27.0 Server-Side Request Forgery via WebhookTryGhost · Ghost | Medium5.1 |
| CVE-2026-103286 | Ghost 2.21.0 before 6.56.0 Privilege Escalation via NotificationsTryGhost · Ghost | High8.5 |
| CVE-2026-103285 | Ghost 5.19.0 before 6.57.1 Cross-Site Request ForgeryTryGhost · Ghost | Medium5.3 |
| CVE-2026-103284 | Ghost 5.125.1 before 6.57.1 Information Disclosure via FeedbackTryGhost · Ghost | Medium5.3 |
| CVE-2026-103283 | Ghost 6.20.0 before 6.57.1 Authentication Bypass via Session HandlingTryGhost · Ghost | High8.6 |
| CVE-2026-103282 | Ghost 0.5.0 before 6.23.0 Multiple Account Creation via Invite TokenTryGhost · Ghost | Medium5.3 |
| CVE-2026-103281 | Ghost 3.23.0 before 6.23.0 API Key Exposure via Admin APITryGhost · Ghost | Medium5.3 |
| CVE-2026-103280 | Ghost 0.8.0 before 6.23.0 Information Disclosure via Setup EndpointTryGhost · Ghost | Medium6.9 |
| CVE-2026-103279 | Ghost 3.10.0 before 6.34.0 Session Invalidation BypassTryGhost · Ghost | High7.6 |
| CVE-2026-103278 | Ghost 5.8.0 before 6.34.0 Staff Account Takeover via Admin iframeTryGhost · Ghost | High8.5 |
| CVE-2026-103277 | Ghost 2.5.0 before 6.34.0 Untrusted Script Execution via oEmbedTryGhost · Ghost | High8.6 |
| CVE-2026-103276 | Ghost before 6.20.0 File Read via URL Encoding BypassTryGhost · Ghost | Medium6.9 |
| CVE-2026-103275 | Ghost 5.42.2 before 6.58.0 Password Hash DisclosureTryGhost · Ghost | Medium5.3 |
| CVE-2026-103274 | Ghost 5.3.0 before 6.58.0 Unauthenticated Comment ReadTryGhost · Ghost | Medium6.9 |
| CVE-2026-103273 | Ghost 4.3.0 before 6.58.0 Incorrect Authorization via Staff TokenTryGhost · Ghost | Medium5.3 |
| CVE-2026-103272 | Ghost 2.10.0 before 6.63.0 Staff Enumeration via Content APITryGhost · Ghost | High8.7 |