Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 6 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,234All CVEsplus 19,120 rejected
- 500Last 24 hours2,798 in the last 7 days
- 16,901Last 30 days1,543 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 2 | 11 | 13 | 0 | 0 | 26 | 59 |
| 2025 | 1 | 4 | 13 | 0 | 0 | 18 | 33 |
| 2024 | 0 | 3 | 6 | 1 | 0 | 10 | 15 |
| 2023 | 0 | 0 | 2 | 0 | 0 | 2 | 5 |
| 2022 | 0 | 0 | 0 | 0 | 0 | 0 | 3 |
| 2021 | 0 | 0 | 3 | 0 | 0 | 3 | 3 |
| Title | ||
|---|---|---|
| CVE-2026-120019 | W3 Total Cache <= 2.10.7 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Predictable Minify Placeholderboldgrid · W3 Total Cache | Medium5.4 |
| CVE-2026-111254 | W3 Total Cache <= 2.10.7 - Unauthenticated Stored Cross-Site Scripting via Comment Content Cached as HTML after License Expiryboldgrid · W3 Total Cache | High7.2 |
| CVE-2026-110253 | weForms <= 1.6.28 - Unauthenticated Limited Media File Deletion via 'wpuf_files' Parameterboldgrid · weForms – Easy Drag & Drop Contact Form Builder For WordPress | Medium5.4 |
| CVE-2026-78001 | Post and Page Builder by BoldGrid <= 1.27.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-label' Attributeboldgrid · Post and Page Builder by BoldGrid – Visual Drag and Drop Editor | Medium6.4 |
| CVE-2026-87920 | W3 Total Cache <= 2.10.6 - Unauthenticated Stored Cross-Site Scripting via Comment Contentboldgrid · W3 Total Cache | High7.2 |
| CVE-2026-100510 | WordPress Post and Page Builder by BoldGrid plugin <= 1.27.14 - Cross Site Scripting (XSS) vulnerabilityBoldGrid · Post and Page Builder by BoldGrid | High7.1 |
| CVE-2026-97078 | WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.17 - Insecure Direct Object References (IDOR) vulnerabilityBoldGrid · Client Invoicing by Sprout Invoices | Medium5.3 |
| CVE-2026-78438 | W3 Total Cache <= 2.10.5 - Unauthenticated Stored Cross-Site Scripting via LazyLoad Background Mutatorboldgrid · W3 Total Cache | High7.2 |
| CVE-2026-18109 | W3 Total Cache <= 2.10.3 - Unauthenticated Stored Cross-Site Scripting via Comment Author Nameboldgrid · W3 Total Cache | High7.2 |
| CVE-2026-66708 | WordPress Total Upkeep plugin <= 1.17.2 - Broken Access Control vulnerabilityBoldGrid · Total Upkeep | High8.2 |
| CVE-2026-66695 | WordPress W3 Total Cache plugin <= 2.10.2 - Path Traversal vulnerabilityBoldGrid · W3 Total Cache | Medium6.5 |
| CVE-2026-57428 | WordPress Sprout Clients plugin <= 3.2.3 - Cross Site Scripting (XSS) vulnerabilityBoldGrid · Sprout Clients | High7.1 |
| CVE-2026-57418 | WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.13 - Broken Access Control vulnerabilityBoldGrid · Client Invoicing by Sprout Invoices | Medium6.5 |
| CVE-2026-9282 | W3 Total Cache <= 2.9.4 - Unauthenticated Arbitrary File Read via 'f_array[]' Parameterboldgrid · W3 Total Cache | High7.5 |
| CVE-2026-57623 | WordPress W3 Total Cache plugin <= 2.9.4 - Arbitrary Code Execution vulnerabilityBoldGrid · W3 Total Cache | Critical9.0 |
| CVE-2026-39595 | WordPress W3 Total Cache plugin <= 2.9.1 - Broken Access Control vulnerabilityBoldGrid · W3 Total Cache | Medium4.7 |
| CVE-2026-3143 | Total Upkeep <= 1.17.1 - Missing Authorization to Unauthenticated Rollback Cancellationboldgrid · Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid | Medium5.3 |
| CVE-2026-39562 | WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.10 - Broken Access Control vulnerabilityBoldGrid · Client Invoicing by Sprout Invoices | Medium5.3 |
| CVE-2026-5032 | W3 Total Cache <= 2.9.3 - Unauthenticated Security Token Exposure via User-Agent Headerboldgrid · W3 Total Cache | High7.5 |
| CVE-2026-32484 | WordPress weForms plugin <= 1.6.26 - PHP Object Injection vulnerabilityBoldGrid · weForms | High8.8 |
| CVE-2026-32424 | WordPress Sprout Clients plugin <= 3.2.2 - Cross Site Scripting (XSS) vulnerabilityBoldGrid · Sprout Clients | Medium6.5 |
| CVE-2026-32401 | WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.9 - Local File Inclusion vulnerabilityBoldGrid · Client Invoicing by Sprout Invoices | High7.2 |
| CVE-2026-2707 | weForms <= 1.6.27 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Hidden Field Value via REST APIboldgrid · weForms – Easy Drag & Drop Contact Form Builder For WordPress | Medium6.4 |
| CVE-2026-27384 | WordPress W3 Total Cache plugin <= 2.9.1 - Arbitrary Code Execution vulnerabilityBoldGrid · W3 Total Cache | Critical9.0 |
| CVE-2026-25364 | WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.8 - Broken Access Control vulnerabilityBoldGrid · Client Invoicing by Sprout Invoices | Medium5.3 |
| CVE-2025-69345 | WordPress Post and Page Builder by BoldGrid plugin <= 1.27.9 - Broken Access Control vulnerabilityBoldGrid · Post and Page Builder by BoldGrid | Medium4.3 |
| CVE-2025-69028 | WordPress weForms plugin <= 1.6.25 - Broken Access Control vulnerabilityBoldGrid · weForms | Medium5.3 |
| CVE-2025-66118 | WordPress Sprout Clients plugin <= 3.2.1 - Cross Site Scripting (XSS) vulnerabilityBoldGrid · Sprout Clients | High7.1 |
| CVE-2025-64227 | WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.7 - PHP Object Injection vulnerabilityBoldGrid · Client Invoicing by Sprout Invoices | Critical9.8 |
| CVE-2025-64229 | WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.7 - Broken Access Control vulnerabilityBoldGrid · Client Invoicing by Sprout Invoices | Medium4.3 |
| CVE-2025-52712 | WordPress Post and Page Builder by BoldGrid – Visual Drag and Drop Editor <= 1.27.8 - Path Traversal VulnerabilityBoldGrid · Post and Page Builder by BoldGrid | Medium4.2 |
| CVE-2020-36848 | Total Upkeep by BoldGrid <= 1.14.9 - Unauthenticated Backup Downloadboldgrid · Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid | High7.5 |
| CVE-2025-52713 | WordPress Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plugin <= 1.27.8 - Server Side Request Forgery (SSRF) VulnerabilityBoldGrid · Post and Page Builder by BoldGrid | Medium6.4 |
| CVE-2025-52711 | WordPress Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plugin <= 1.27.8 - Cross Site Request Forgery (CSRF) VulnerabilityBoldGrid · Post and Page Builder by BoldGrid | Medium4.3 |
| CVE-2025-31797 | WordPress Sprout Clients plugin <= 3.2 - Cross Site Scripting (XSS) vulnerabilityBoldGrid · Sprout Clients | Medium6.5 |
| CVE-2025-2257 | Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid <= 1.16.10 - Authenticated (Admin+) Command Injectionboldgrid · Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid | High7.2 |
| CVE-2024-13907 | Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid <= 1.16.8 - Authenticated (Administrator+) Server-Side Request Forgeryboldgrid · Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid | Medium4.9 |
| CVE-2025-0859 | Post and Page Builder by BoldGrid <= 1.27.6 - Path Traversal to Authenticated (Contributor+) Arbitrary File Read via template_via_url Functionboldgrid · Post and Page Builder by BoldGrid – Visual Drag and Drop Editor | Medium6.5 |
| CVE-2025-24606 | WordPress Client Invoicing by Sprout Invoices – Easy Estimates and Invoices for WordPress plugin <=20.8.1 - Broken Access Control vulnerabilityBoldGrid · Client Invoicing by Sprout Invoices | Medium6.4 |
| CVE-2025-22759 | WordPress Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plugin <= 1.27.5 - Cross Site Scripting (XSS) vulnerabilityBoldGrid · Post and Page Builder by BoldGrid | Medium6.5 |
| CVE-2024-12008 | W3 Total Cache <= 2.8.1 Information Exposure via Log Filesboldgrid · W3 Total Cache | Medium5.3 |
| CVE-2024-12006 | W3 Total Cache <= 2.8.1 Missing Authorization to Unauthenticated Plugin Deactivation and Extensions Activation/Deactivationboldgrid · W3 Total Cache | Medium5.3 |
| CVE-2024-12365 | W3 Total Cache <= 2.8.1 - Authenticated (Subscriber+) Missing Authorization to Server-Side Request Forgeryboldgrid · W3 Total Cache | High8.5 |
| CVE-2025-22512 | WordPress Help Scout Plugin <= 6.5.6 - Broken Access Control vulnerabilityBoldGrid · Help Scout | Medium4.3 |
| CVE-2024-53819 | WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.0 - Insecure Direct Object References (IDOR) vulnerabilityBoldGrid · Client Invoicing by Sprout Invoices | Medium5.3 |
| CVE-2024-9461 | Total Upkeep <= 1.16.6 - Authenticated (Administrator+) Remote Code Execution via Backup Settingsboldgrid · Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid | High7.2 |
| CVE-2023-5359 | W3 Total Cache <= 2.7.5 - Sensitive Credentials Stored in Plaintextboldgrid · W3 Total Cache | Low3.7 |
| CVE-2024-6848 | Post and Page Builder by BoldGrid – Visual Drag and Drop Editor <= 1.26.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via File Uploadboldgrid · Post and Page Builder by BoldGrid – Visual Drag and Drop Editor | Medium6.4 |
| CVE-2024-24869 | WordPress Total Upkeep plugin <= 1.15.8 - Arbitrary File Download vulnerabilityBoldGrid · Total Upkeep | High7.5 |
| CVE-2024-4400 | Post and Page Builder by BoldGrid – Visual Drag and Drop Editor <= 1.26.4 - Authenticated (Contributer+) Stored Cross-Site Scriptingboldgrid · Post and Page Builder by BoldGrid – Visual Drag and Drop Editor | Medium6.4 |