Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 10 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 400,109All CVEsplus 18,875 rejected
- 790Last 24 hours3,264 in the last 7 days
- 17,391Last 30 days1,568 of them critical
- 1,767Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 0 | 7 | 36 | 1 | 0 | 44 | 52 |
| 2025 | 1 | 0 | 5 | 0 | 0 | 6 | 8 |
| 2024 | 1 | 0 | 0 | 0 | 0 | 1 | 2 |
| 2023 | 0 | 0 | 0 | 1 | 0 | 1 | 1 |
| Title | ||
|---|---|---|
| CVE-2026-121733 | Bagisto before 2.4.5 Stored XSS via RMA Conversation Attachment UploadWebkul · Bagisto | Low2.1 |
| CVE-2026-115326 | QloApps through 1.7.0 IDOR via OrderDetailController Refund RequestWebkul · QloApps | Medium5.3 |
| CVE-2026-112193 | Webkul Aureus ERP UserForm.php weak passwordWebkul · Aureus ERP | Medium6.3 |
| CVE-2026-112190 | Webkul Aureus ERP composer.json insertion of sensitive information into debugging codeWebkul · Aureus ERP | Medium6.9 |
| CVE-2026-111284 | Aureus ERP through 1.6.0 Stored XSS via Time Off Holiday Action ModalWebkul · Aureus ERP | Medium5.1 |
| CVE-2026-110229 | QloApps through 1.7.0 Missing Hotel Access Restriction in Credit SlipsWebkul · QloApps | Medium5.3 |
| CVE-2026-110226 | QloApps through 1.7.0 Authorization Bypass via id_hotel in Room Type CreationWebkul · QloApps | Medium5.3 |
| CVE-2026-110224 | QloApps through 1.7.0 Reflected XSS via Search Alias Validation ErrorsWebkul · QloApps | Medium5.1 |
| CVE-2026-110221 | QloApps through 1.7.0 Reflected XSS via Advanced Price Rule Name and Impact ValueWebkul · QloApps | Medium5.1 |
| CVE-2026-110219 | QloApps through 1.7.0 Reflected XSS via Additional Facility Price FieldWebkul · QloApps | Medium5.1 |
| CVE-2026-110218 | Aureus ERP through 1.6.0 Unpublished Blog Post Disclosure via Direct URLWebkul · Aureus ERP | Medium6.3 |
| CVE-2026-109393 | QloApps through 1.7.0 Insecure Direct Object Reference in Back-Office AJAX HandlersWebkul · QloApps | Medium5.3 |
| CVE-2026-107702 | QloApps through 1.7.0 Authorization Bypass via id_hotel in Admin Room BookingWebkul · QloApps | Medium5.3 |
| CVE-2026-105836 | QloApps through 1.7.0 Authorization Bypass via ajaxProcessBulkUpdateRoomsWebkul · QloApps | Medium5.3 |
| CVE-2026-103590 | QloApps through 1.7.0 Reflected XSS via Length of Stay FieldsWebkul · QloApps | Medium5.1 |
| CVE-2026-103589 | QloApps through 1.7.0 Reflected XSS via Room Type EditorWebkul · QloApps | Medium5.1 |
| CVE-2026-103588 | QloApps through 1.7.0 Reflected XSS via exceptions fieldWebkul · QloApps | Medium5.1 |
| CVE-2026-103587 | QloApps through 1.7.0 Reflected XSS via Book Now Search ParametersWebkul · QloApps | Medium5.1 |
| CVE-2026-101139 | Webkul Bagisto Invoice Mass Status Update state authorizationWebkul · Bagisto | Medium5.1 |
| CVE-2026-97062 | Aureus ERP 1.6.0 Stored XSS via SVG File UploadWebkul · Aureus ERP | Medium5.1 |
| CVE-2026-95655 | Aureus ERP before 1.5.0 Unscoped Message Access via ChatterPanelWebkul · Aureus ERP | High8.6 |
| CVE-2026-94387 | Aureus ERP before 1.6.0 Stored XSS via Chatter Field-Change LogWebkul · Aureus ERP | Medium5.1 |
| CVE-2026-93988 | QloApps through 1.7.0 Arbitrary File Read via getEmailHTMLwebkul · qloapps | High7.1 |
| CVE-2026-93454 | Aureus ERP through 1.6.0 Stored XSS via Payment Term NoteWebkul · Aureus ERP | Medium5.1 |
| CVE-2026-92234 | QloApps through 1.7.0 Reflected XSS via Hotel Feature Validation ErrorsWebkul · QloApps | Medium5.1 |
| CVE-2026-89268 | QloApps through 1.7.0 Reflected XSS via List Filter ParametersWebkul · QloApps | Medium5.1 |
| CVE-2026-75498 | Webkul QloApps SQL injectionWebkul · QloApps | High8.6 |
| CVE-2026-75497 | Webkul QloApps SQL injectionWebkul · QloApps | High8.6 |
| CVE-2026-75496 | Webkul QloApps improper file upload validationWebkul · QloApps | High8.6 |
| CVE-2026-75082 | Webkul Bagisto Customer-Registration Notification Email register cross site scriptingWebkul · Bagisto | Medium5.3 |
| CVE-2026-75081 | Webkul Bagisto store behavioral workflowWebkul · Bagisto | Medium5.3 |
| CVE-2026-19997 | Webkul Bagisto Backend Sales RMA Endpoint requests authorizationWebkul · Bagisto | Medium5.1 |
| CVE-2026-19996 | Webkul Bagisto Backend Customer Behavior Data Endpoint customers privileges managementWebkul · Bagisto | Medium5.3 |
| CVE-2026-19995 | Webkul Bagisto RMA Message send-message cross site scriptingWebkul · Bagisto | Medium5.1 |
| CVE-2026-19994 | Webkul Bagisto Configuration Management execute authorizationWebkul · Bagisto | Medium5.3 |
| CVE-2026-19993 | Webkul Bagisto RMA State Validation update-status behavioral workflowWebkul · Bagisto | Medium5.3 |
| CVE-2026-19838 | Webkul Bagisto Backend Reporting Endpoint sales authorizationWebkul · Bagisto | Medium5.3 |
| CVE-2026-19837 | Webkul Bagisto Customer Search search information disclosureWebkul · Bagisto | Medium5.1 |
| CVE-2026-19836 | Webkul Bagisto Backend Customer Detail Feature view authorizationWebkul · Bagisto | Medium5.3 |
| CVE-2026-19835 | Webkul Bagisto Customer Item Deletion Endpoint access controlWebkul · Bagisto | Medium5.1 |
| CVE-2026-19834 | Webkul Bagisto Admin Customer Impersonation Feature login-as-customer authorizationWebkul · Bagisto | Medium5.1 |
| CVE-2026-60120 | Bagisto < 2.4.4 Stored XSS via CSTI in create.blade.phpWebkul · Bagisto | Medium5.1 |
| CVE-2017-20262 | Joomla! Component Ajax Quiz 1.8 SQL InjectionWebkul · Ajax Quiz | High8.8 |
| CVE-2026-9506 | Path Traversal Vulnerability in BagistoWebkul · Bagisto | High8.7 |
| CVE-2025-10759 | Webkul QloApps CSRF Token authorizationWebkul · QloApps | Medium6.9 |
| CVE-2025-29009 | WordPress Medical Prescription Attachment Plugin for WooCommerce <= 1.2.3 - Arbitrary File Upload VulnerabilityWebkul · Medical Prescription Attachment Plugin for WooCommerce | Critical10.0 |
| CVE-2025-6173 | Webkul QloApps ajax_products_list.php sql injectionWebkul · QloApps | Medium5.1 |
| CVE-2025-3568 | Webkul Krayin CRM SVG File edit cross site scriptingWebkul · Krayin CRM | Medium5.1 |
| CVE-2025-1155 | Webkul QloApps Your Location Search stores cross site scriptingWebkul · QloApps | Medium5.3 |
| CVE-2025-1074 | Webkul QloApps URL mylogout cross-site request forgeryWebkul · QloApps | Medium5.3 |