Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read just now.
At a glance
Published CVEs; rejected ones are not counted.
- 401,288All CVEsplus 19,140 rejected
- 453Last 24 hours2,729 in the last 7 days
- 16,934Last 30 days1,558 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 2 | 5 | 31 | 24 | 41 | 103 | 152 |
| 2025 | 3 | 5 | 28 | 6 | 3 | 45 | 49 |
| 2024 | 0 | 0 | 0 | 0 | 0 | 0 | 4 |
| 2023 | 0 | 0 | 0 | 0 | 0 | 0 | 4 |
| 2022 | 0 | 0 | 0 | 0 | 0 | 0 | 4 |
| 2021 | 0 | 0 | 0 | 0 | 0 | 0 | 4 |
| 2020 | 0 | 1 | 2 | 0 | 0 | 3 | 4 |
| 2019 | 0 | 0 | 1 | 0 | 0 | 1 | 1 |
| Title | ||
|---|---|---|
| CVE-2026-102796 | Unauthenticated SQL injection in UserPageViewTracker via filterusers and ignoreusers parametersWikimedia Foundation · Mediawiki - UserPageViewTracker Extension | High7.5 |
| CVE-2026-100245 | Stored XSS on Wikibase Special:SetSiteLink via unescaped system messageWikimedia Foundation · Mediawiki - Wikibase Extension | Medium6.1 |
| CVE-2026-100244 | CentralAuth exposes locally suppressed block information via globaluserinfo API and Special:CentralAuth (incomplete fix for CVE-2025-62669)Wikimedia Foundation · Mediawiki - CentralAuth Extension | High7.5 |
| CVE-2026-100243 | Stored XSS in WikiSEO author and image properties on action=infoWikimedia Foundation · Mediawiki - WikiSEO Extension | Medium6.1 |
| CVE-2026-100242 | DataTransfer depends on phpspreadsheet version vulnerable to CVE-2026-59933 (XLS/OLE memory exhaustion)Wikimedia Foundation · Mediawiki - DataTransfer Extension | High7.5 |
| CVE-2026-100241 | Private change tags exposed to anonymous users via revision-tags-change eventsWikimedia Foundation · Mediawiki - EventBus Extension | High7.5 |
| CVE-2026-100240 | TemplateSandbox does not check read permissions for the page being previewedWikimedia Foundation · Mediawiki - TemplateSandbox Extension | Critical9.1 |
| CVE-2026-100238 | Flow colon-separator and flow-guidedtour-optin-welcome-description messages allow stored XSSWikimedia Foundation · Mediawiki - Flow Extension | Medium6.1 |
| CVE-2026-100383 | Stored i18n XSS in WikiLambda's VisualEditor integrationWikimedia Foundation · Mediawiki - WikiLambda Extension | Medium4.8 |
| CVE-2026-100382 | Unauthenticated remote code execution through wikitext in ExternalDataWikimedia Foundation · Mediawiki - ExternalData Extension | Critical10.0 |
| CVE-2026-100381 | UploadWizard Flickr collection and set titles allow DOM XSSWikimedia Foundation · Mediawiki - UploadWizard Extension | Medium5.3 |
| CVE-2026-100380 | Reflected XSS in Wikibase Special:SetLabel language validationWikimedia Foundation · Mediawiki - Wikibase Extension | Medium5.3 |
| CVE-2026-100379 | Cross-request disclosure of CentralAuth cookies in Wikipedia Android AppWikimedia Foundation · Wikipedia Android App | Medium5.3 |
| CVE-2026-100378 | Missing permission check in the Translate sandbox doRemind actionWikimedia Foundation · Mediawiki - Translate Extension | Medium5.3 |
| CVE-2026-100376 | TemplateSandbox can be abused for XSS by asking another user to preview a page with a certain sandbox prefixWikimedia Foundation · Mediawiki - TemplateSandbox Extension | Medium4.8 |
| CVE-2026-100377 | Revision-deleted pages can be viewed through WikiLambda's action=edit and Special:ViewAbstractWikimedia Foundation · Mediawiki - WikiLambda Extension | Medium6.9 |
| CVE-2026-58025 | Remote Code Execution via Unsafe Deserialization in LogItem ImportWikimedia Foundation · MediaWiki | Medium5.9 |
| CVE-2026-58029 | Full Account Takeover from BotPasswords and OAuth via action=changeauthenticationdataWikimedia Foundation · MediaWiki | Medium5.3 |
| CVE-2026-58028 | Pretty-printed API output combined with centralauthtoken allows XSS with certain gadgetsWikimedia Foundation · MediaWiki | None0.0 |
| CVE-2026-58026 | $wgNonincludableNamespaces can be bypassed by embedding redirect in other namespacesWikimedia Foundation · MediaWiki | None0.0 |
| CVE-2026-8857 | Full RCE using EasyTimeline ExtensionWikimedia Foundation · timeline | None0.0 |
| CVE-2026-58038 | Stored XSS through javascript URLs in SVGs generated by EasyTimelineWikimedia Foundation · timeline | None0.0 |
| CVE-2026-58027 | QueryAbuseFilter API can be used to see the hit count of private filters, which is hidden in the UIWikimedia Foundation · AbuseFilter | Medium5.3 |
| CVE-2026-58030 | SyntaxHighlight stored XSS via unsanitized 'linelinks' attributeWikimedia Foundation · SyntaxHighlight_GeSHi | Medium5.3 |
| CVE-2026-58032 | mw.Api.getErrorMessage() may return injected HTML if used without errorformat=htmlWikimedia Foundation · MediaWiki | Medium5.3 |
| CVE-2026-58033 | "Total number of distinct authors" statistic at action=info does not exclude revisions where the author name was deletedWikimedia Foundation · MediaWiki | Medium5.3 |
| CVE-2026-58037 | Core log entries for exceptions and XSS issues in log entry formatting code that may be caused by user-controlled inputWikimedia Foundation · MediaWiki | None0.0 |
| CVE-2026-58036 | Users API leaks whether privileged users have their user groups disabled for lack of 2FAWikimedia Foundation · MediaWiki | Low2.1 |
| CVE-2026-58024 | API identification of users on private wikisWikimedia Foundation · MediaWiki | Medium5.1 |
| CVE-2026-13707 | Session fixation attacks on improperly configured OAuth 1.0a toolsWikimedia Foundation · OAuth | None0.0 |
| CVE-2026-13706 | UrlShortener extension url validation can be bypassed due to difference between php url parsing and WHATWGWikimedia Foundation · UrlShortener | None0.0 |
| CVE-2026-58031 | Stored i18n XSS in Special:ApiSandbox when a deprecated module is selectedWikimedia Foundation · MediaWiki | None0.0 |
| CVE-2026-58034 | Stored XSS through a system message when blocking a temporary account that's related to other temporary accountsWikimedia Foundation · CheckUser | None0.0 |
| CVE-2026-58035 | Stored XSS through a system message in the codex version of Special:BlockWikimedia Foundation · MediaWiki | None0.0 |
| CVE-2026-5266 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Echo. This vulnerability is associated with program files…Wikimedia Foundation · Echo | Low2.3 |
| CVE-2026-34095 | action=raw with Special:Mypage subpage title responds with "Content-Type: text/html" on ctype=text/javascript requestWikimedia Foundation · MediaWiki | None0.0 |
| CVE-2026-34094 | Customized help link for page protection indicator is relative to subpage name, because the link target is missing the "/wiki/" prefixWikimedia Foundation · MediaWiki | Low2.0 |
| CVE-2026-34093 | Special:UserRights allows viewing user rights from private wikiWikimedia Foundation · MediaWiki | Low1.1 |
| CVE-2026-34092 | Block UI elements in 'tools'-sidebar shows presence of an autoblocked IPWikimedia Foundation · MediaWiki | Low2.1 |
| CVE-2026-34091 | User localization leaked by AbuseFilter + EventStreamWikimedia Foundation · MediaWiki | Medium5.5 |
| CVE-2026-34090 | Suggested investigations: Handle suppressed usernamesWikimedia Foundation · CheckUser | Medium4.8 |
| CVE-2026-34089 | Memory leak in Scribunto causes runJobs.php to run out of memoryWikimedia Foundation · Scribunto | Low2.3 |
| CVE-2026-34088 | RecentChanges entries expose suppressed content via generated log page htmlWikimedia Foundation · MediaWiki | Low1.3 |
| CVE-2026-34087 | Users API leaks whether privileged users have their user groups disabled for lack of 2FAWikimedia Foundation · OATHAuth | Medium5.1 |
| CVE-2026-34086 | AbuseFilter misuses ::userCanBitfield, exposing access-controlled informationWikimedia Foundation · AbuseFilter | Low2.1 |
| CVE-2026-39837 | Stored XSS through the dynamic table format in CargoWikimedia Foundation · Mediawiki - Cargo Extension | Medium6.3 |
| CVE-2026-39841 | Stored XSS through list fields on Cargo's page values and Special:CargoTablesWikimedia Foundation · Mediawiki - Cargo Extension | Medium6.3 |
| CVE-2026-39840 | CSS injection in multiple Cargo display formatsWikimedia Foundation · Mediawiki - Cargo Extension | Medium5.1 |
| CVE-2026-39839 | Stored XSS through URLs in Cargo's map formatWikimedia Foundation · Mediawiki - Cargo Extension | Medium6.3 |
| CVE-2026-39838 | ProofreadPage improperly sanitizes multiline styles using Sanitizer::checkCSSWikimedia Foundation · MediaWiki - ProofreadPage Extension | Medium6.9 |