Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 10 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 400,189All CVEsplus 18,875 rejected
- 800Last 24 hours3,212 in the last 7 days
- 17,393Last 30 days1,564 of them critical
- 1,767Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 137 | 507 | 1,177 | 201 | 39 | 2,061 | 6,131 |
| 2025 | 21 | 105 | 412 | 59 | 0 | 597 | 4,070 |
| 2024 | 33 | 121 | 604 | 16 | 0 | 774 | 3,473 |
| 2023 | 52 | 165 | 710 | 9 | 0 | 936 | 2,699 |
| 2022 | 89 | 200 | 825 | 11 | 0 | 1,125 | 1,763 |
| 2021 | 38 | 149 | 436 | 1 | 0 | 624 | 638 |
| 2020 | 0 | 0 | 0 | 0 | 0 | 0 | 14 |
| 2019 | 0 | 1 | 0 | 0 | 0 | 1 | 14 |
| 2018 | 6 | 6 | 1 | 0 | 0 | 13 | 13 |
| Title | ||
|---|---|---|
| CVE-2026-118983 | VikWidgetsLoader < 1.12.3 - Contributor+ Stored XSS via Speakers and Cookies Policy BlocksUnknown · VikWidgetsLoader | Not scored |
| CVE-2026-118783 | All-in-One Video Gallery < 5.0.0 - Contributor+ Stored XSS via Shortcode AttributeUnknown · All-in-One Video Gallery | Not scored |
| CVE-2026-118637 | Simple Download Monitor < 4.1.3 - Contributor+ Private Download Item Title and Description Disclosure via [sdm_show_download_info] ShortcodeUnknown · Simple Download Monitor | Not scored |
| CVE-2026-118523 | EventPrime < 4.3.6.1 - Unauthenticated Pending Post Disclosure via Public Post Status OverrideUnknown · EventPrime | Not scored |
| CVE-2026-118422 | Stape Conversion Tracking 2.3.0 - 2.3.10 - Unauthenticated SSRF and Same-Origin XSS via Proxy Sub-PathUnknown · Stape Conversion Tracking | Not scored |
| CVE-2026-118407 | Premium Packages < 7.3.1 - Subscriber+ Guest Order TakeoverUnknown · Premium Packages | Not scored |
| CVE-2026-118404 | Premium Packages < 7.3.1 - Unauthenticated Cross-User Saved Cart Disclosure via IDORUnknown · Premium Packages | Not scored |
| CVE-2026-118403 | Premium Packages < 7.3.1 - Unauthenticated Guest Order Status DisclosureUnknown · Premium Packages | Not scored |
| CVE-2026-115426 | WPvivid Backup & Migration < 0.9.138 - Admin+ Path Traversal via Local Backup Directory SettingUnknown · WPvivid — Backup, Migration & Staging | Not scored |
| CVE-2026-115262 | Duplicator < 5.1.0 - Subscriber+ SQLi via Charset and Collation Rewriter During RestoreUnknown · Duplicator | Not scored |
| CVE-2026-115257 | WP Roster < 2.36 - Unauthenticated Roster Data ModificationUnknown · WP Roster | Not scored |
| CVE-2026-115250 | Text Typing < 2.2.2 - Contributor+ Stored XSSUnknown · Text Typing | Not scored |
| CVE-2026-115243 | WPvivid Backup & Migration 0.9.117 - 0.9.136 - Admin+ Arbitrary File Upload via wpvivid_upload_import_filesUnknown · WPvivid — Backup, Migration & Staging | Not scored |
| CVE-2026-115242 | WPvivid Backup & Migration < 0.9.137 - Admin+ Path Traversal via Staging Site PathUnknown · WPvivid — Backup, Migration & Staging | Not scored |
| CVE-2026-115241 | WPvivid Backup & Migration < 0.9.137 - Admin+ Arbitrary Database Table Deletion via Snapshot IDUnknown · WPvivid — Backup, Migration & Staging | Not scored |
| CVE-2026-114431 | Enable Media Replace < 4.2.3 - Author+ Stored XSS via SVG UploadUnknown · Enable Media Replace | Not scored |
| CVE-2026-112244 | Duplicator 5.0.0 - 5.0.6 - Unauthenticated Full Path Disclosure via Installer Entry PointsUnknown · Duplicator | Not scored |
| CVE-2026-112243 | Duplicator < 5.1.0 - Reflected XSS via 'logname' ParameterUnknown · Duplicator | Not scored |
| CVE-2026-111962 | WP Remote Users Sync < 2.2.0 - Unauthenticated Sensitive Data Disclosure via Public User Export FileUnknown · WP Remote Users Sync | Not scored |
| CVE-2026-111740 | Post Duplicator < 3.0.17 - Contributor+ Draft and Private Post Title DisclosureUnknown · Post Duplicator | Not scored |
| CVE-2026-110964 | Essential Real Estate 4.4.3 - 5.3.4 - Subscriber+ Arbitrary Media Attachment Deletion via IDORUnknown · Essential Real Estate | Not scored |
| CVE-2026-110692 | PowerPack Addons for Elementor 2.10.0 - 3.1.2 - Contributor+ SSRF via Charts Widget CSV ImportUnknown · PowerPack Addons for Elementor: Widgets, Form Styler and Templates | Not scored |
| CVE-2026-108068 | FV Flowplayer Video Player 7.4.44.727 - 7.5.55.7212 - Contributor+ Bulk Video Record Disclosure and Modification via Migration WizardUnknown · FV Flowplayer Video Player | Not scored |
| CVE-2026-108067 | FV Flowplayer Video Player < 7.5.56.7212 - Contributor+ Arbitrary Video and Meta Record Deletion, Video Modification and Meta Disclosure via IDORUnknown · FV Flowplayer Video Player | Not scored |
| CVE-2026-108041 | SEOPress < 10.4 - Authenticated Stored XSS via Analytics Tracking SettingsUnknown · SEOPress | Not scored |
| CVE-2026-106649 | Kali Forms < 2.4.29 - Author+ Stored XSS via Button Click ActionUnknown · Kali Forms — Contact Form & Drag-and-Drop Builder | Not scored |
| CVE-2026-106000 | Booking Package < 1.7.34 - Unauthenticated Payment BypassUnknown · Booking Package | Not scored |
| CVE-2026-105413 | Form Maker by 10Web < 1.15.51 - Unauthenticated Stored XSS via Submission Field ValuesUnknown · Form Maker by 10Web | Not scored |
| CVE-2026-105191 | WP ERP < 1.17.11 - Subscriber+ Sensitive Data Disclosure via Audit LogUnknown · ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce | Not scored |
| CVE-2026-104719 | CookieYes < 3.5.8 - Contributor+ Stored XSS via Cookie Category ScriptsUnknown · CookieYes | Not scored |
| CVE-2026-101166 | Mollie Payments for WooCommerce < 8.2.0 - Unauthenticated Unpublished Product Purchase via mollie_paypal_create_orderUnknown · Mollie Payments for WooCommerce | Not scored |
| CVE-2026-101165 | Mollie Payments for WooCommerce < 8.2.0 - Unauthenticated Payment Surcharge Bypass via update_surcharge_order_payUnknown · Mollie Payments for WooCommerce | Not scored |
| CVE-2026-91075 | Eupago Gateway For Woocommerce 4.5.0 - 4.7.5 - Unauthenticated Payment Confirmation BypassUnknown · Eupago Gateway For Woocommerce | Medium5.3 |
| CVE-2026-103327 | CryptoCloud - Crypto Payment Gateway 3.0.0 - 3.0.1 - Unauthenticated Arbitrary Order Payment Forgery via Empty-Default Webhook SecretUnknown · CryptoCloud | Medium5.3 |
| CVE-2026-104647 | weMail <= 2.1.6 - Editor+ Incorrect Authorization via User::can()Unknown · weMail | Not scored |
| CVE-2026-104648 | weMail <= 2.1.6 - Editor+ API Key DisclosureUnknown · weMail | Not scored |
| CVE-2026-103379 | WATI Chat and Notification <= 1.1.8 - Unauthenticated Customer Order PII Disclosure via Leaked API TokenUnknown · WATI Chat and Notification | Not scored |
| CVE-2026-105967 | Gallery for Social Photo <= 1.0.0.41 - Unauthenticated SSRF via next_url ParameterUnknown · Gallery for Social Photo | Not scored |
| CVE-2026-106004 | DT LMS <= 1.2 - Unauthenticated Arbitrary Course Completion RevocationUnknown · DT LMS | Not scored |
| CVE-2026-105993 | DT Directory Lite Addon <= 1.1 - Unauthenticated Plugin Settings UpdateUnknown · DT Directory Lite Addon | Not scored |
| CVE-2026-115205 | AZEXO Store Locator <= 1.4 - Subscriber+ Arbitrary Post Deletion via azt_delete_itemUnknown · AZEXO Store Locator | Not scored |
| CVE-2026-103310 | PayHere Payment Gateway 2.4.0 - 2.4.5 - Unauthenticated Payment Bypass via Unverified Payment NotificationUnknown · PayHere Payment Gateway | Medium5.3 |
| CVE-2026-118168 | MapPress Maps for WordPress < 2.97.15 - Unauthenticated Email Address DisclosureUnknown · MapPress | Medium5.3 |
| CVE-2026-113482 | Media Library Assistant < 3.44 - Contributor+ Stored XSS via mla_item_parameter Shortcode AttributeUnknown · Media Library Assistant | Medium6.8 |
| CVE-2026-113481 | Media Library Assistant < 3.44 - Subscriber+ Missing Authorization via mla-fill-compat-fieldsUnknown · Media Library Assistant | Medium4.3 |
| CVE-2026-107343 | Kali Forms < 2.4.30 - Subscriber+ Email Sending and Sender SpoofingUnknown · Kali Forms — Contact Form & Drag-and-Drop Builder | Medium4.3 |
| CVE-2026-107342 | Kali Forms < 2.4.30 - Subscriber+ User Email Address DisclosureUnknown · Kali Forms — Contact Form & Drag-and-Drop Builder | Medium4.3 |
| CVE-2026-94361 | PAYable IPG < 1.3.1 - Unauthenticated Order Payment Forgery via Unsigned CallbackUnknown · Payable Payment Gateway for WooCommerce | Medium5.3 |
| CVE-2026-82214 | Quick Event Manager 8.4.6 - 9.18 - Unauthenticated Private and Draft Content Disclosure via ICS DownloadUnknown · Quick Event Manager | Medium5.3 |
| CVE-2026-118638 | Mapster WP Maps < 2.0.6 - Unauthenticated Arbitrary Post Modification via save-mapmaker REST RouteUnknown · Mapster WP Maps | High7.5 |