Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 7 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,234All CVEsplus 19,120 rejected
- 500Last 24 hours2,797 in the last 7 days
- 16,901Last 30 days1,543 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 1 | 20 | 97 | 20 | 1 | 139 | 323 |
| 2025 | 1 | 7 | 14 | 6 | 0 | 28 | 184 |
| 2024 | 1 | 6 | 27 | 4 | 0 | 38 | 156 |
| 2023 | 0 | 9 | 43 | 12 | 0 | 64 | 118 |
| 2022 | 2 | 5 | 27 | 3 | 0 | 37 | 54 |
| 2021 | 1 | 4 | 12 | 0 | 0 | 17 | 17 |
| Title | ||
|---|---|---|
| CVE-2017-20290 | Discourse < 1.9.0.beta13 Reflected XSS via /email/unsubscribedDiscourse · Discourse | Medium5.1 |
| CVE-2026-57447 | Discourse Doc Categories: Doc category index refresh leaks private topic titlesdiscourse · discourse-doc-categories | Medium4.3 |
| CVE-2026-55103 | Discourse ActivityPub: Fix inbound actor validation and apply outbound request SSRF hardeningdiscourse · discourse-activity-pub | High8.6 |
| CVE-2026-91157 | Discourse: Media uploads remain publicly accessible after category permissions are restricteddiscourse · discourse | High7.5 |
| CVE-2026-91156 | Discourse: Chat MessageBus delivers read-restricted messages to unauthorized usersdiscourse · discourse | High7.5 |
| CVE-2026-91159 | Discourse: Stored oEmbed HTML injection via allowed iframediscourse · discourse | High7.7 |
| CVE-2026-91119 | Discourse: Encode action_code_who in mention URLsdiscourse · discourse | Medium6.4 |
| CVE-2026-91121 | Discourse: Chat upload filenames rendered as raw HTML in excerptsdiscourse · discourse | Medium5.0 |
| CVE-2026-91120 | Discourse: Stored HTML injection in video notification emailsdiscourse · discourse | Medium5.4 |
| CVE-2026-91132 | Discourse: Wildcard iframe origin allowlist bypass via authority separatorsdiscourse · discourse | Medium4.3 |
| CVE-2026-91122 | Discourse: Chat MessageBus delivers read-restricted messages to unauthorized usersdiscourse · discourse | High8.7 |
| CVE-2026-91123 | Discourse: Reject literal backslash path separators in iframe src traversal guarddiscourse · discourse | High7.2 |
| CVE-2026-91133 | Discourse: Escape LIKE metacharacters in upload paths to prevent disclosurediscourse · discourse | Medium6.5 |
| CVE-2026-91134 | Discourse: Block post iframes whose encoded userinfo bypasses the allowed_iframes allowlistdiscourse · discourse | Medium5.4 |
| CVE-2026-84302 | Discourse: Non-participant moderators can read, edit, and delete PM content through Discourse AI reviewablesdiscourse · discourse | Medium4.2 |
| CVE-2026-59830 | Discourse: Stored XSS via unescaped actor name in post actionsdiscourse · discourse | Medium5.4 |
| CVE-2026-53960 | Discourse: Hidden first-post excerpt is emitted in Q&A schema JSON-LDdiscourse · discourse | Medium5.3 |
| CVE-2026-55704 | Discourse: Shared-draft titles and excerpts leak through group post serializationdiscourse · discourse | Medium4.3 |
| CVE-2026-55674 | Discourse: Cache poisoning/XSS via color scheme cookiesdiscourse · discourse | Critical9.3 |
| CVE-2026-59829 | Discourse: Review queue exposes flag-related private message excerpts to category group moderatorsdiscourse · discourse | Medium4.3 |
| CVE-2026-72732 | Discourse: Templates endpoint exposes hidden tag namesdiscourse · discourse | Medium4.3 |
| CVE-2026-72731 | Discourse: Strip SQL comments and use non-recursive parameter interpolation in Data Explorerdiscourse · discourse | High7.1 |
| CVE-2026-72730 | Discourse: Stored XSS chat-transcript username unescaped in Rich Text Editordiscourse · discourse | High8.7 |
| CVE-2026-72729 | Discourse: Stored XSS in discourse-local-dates plugindiscourse · discourse | Low2.0 |
| CVE-2026-72728 | Discourse: Onebox iframe origin allowlist enforces URL authority boundarydiscourse · discourse | Medium6.3 |
| CVE-2026-72727 | Discourse: Stored XSS in the moderation review queuediscourse · discourse | Medium4.8 |
| CVE-2026-72726 | Discourse: Unauthorized eavesdropping on private AI bot conversations.discourse · discourse | Medium6.5 |
| CVE-2026-72725 | Discourse: Stored XSS in staff action logs injects staff UIdiscourse · discourse | Medium5.4 |
| CVE-2026-72724 | Discourse: Private Chat Threat Message Disclosure via Chat Onebox Channel/Threat ID Mismatchdiscourse · discourse | Medium4.3 |
| CVE-2026-72723 | Discourse: Anonymous sidebar serialization exposes descriptions of category-restricted tagsdiscourse · discourse | Medium5.3 |
| CVE-2026-72722 | Discourse: Duplicate lookup reveals restricted topic titles through canonicalized URLsdiscourse · discourse | Medium4.3 |
| CVE-2026-72721 | Discourse: Onebox Domain Blocklist Bypass via Case-Sensitive Comparisondiscourse · discourse | Medium5.3 |
| CVE-2026-72720 | Discourse: HTML injection in PrettyText.format_for_email from cooked-attribute reparsingdiscourse · discourse | Medium6.4 |
| CVE-2026-45780 | Discourse: Private event sample invitees are serialized to non-invited event viewersdiscourse · discourse | Medium5.3 |
| CVE-2026-53963 | Discourse: Stored-XSS in 2FA delete confirmation modaldiscourse · discourse | High7.3 |
| CVE-2026-59828 | Discourse: Hidden post revisions leak through adjacent visible diffsdiscourse · discourse | Medium5.3 |
| CVE-2026-44787 | Discourse: Signup-time primary_group_id assignment grants whisperer accessdiscourse · discourse | High8.2 |
| CVE-2026-53962 | Discourse: Insufficient SVG sanitization logicdiscourse · discourse | Medium5.4 |
| CVE-2026-55424 | Discourse: Topic featured link susceptible to stored XSSdiscourse · discourse | High7.4 |
| CVE-2026-45788 | Discourse: Secure uploads exposed by hotlinked image copyingdiscourse · discourse | Medium6.3 |
| CVE-2026-49256 | Discourse: Hidden tag names leaked via category serializersdiscourse · discourse | Medium6.3 |
| CVE-2026-46413 | Discourse: Regular users can route multipart uploads into the admin backup storediscourse · discourse | Medium6.5 |
| CVE-2026-53961 | Discourse: Forged AWS SNS bounce notifications can disable a targeted user's email (missing TopicArn binding)discourse · discourse | Medium6.5 |
| CVE-2026-55420 | Discourse: Remote code execution via pdf uploadsdiscourse · discourse | High7.5 |
| CVE-2026-47264 | Discourse: Don't leak restricted tag group names via tag infodiscourse · discourse | Medium5.3 |
| CVE-2026-47263 | Discourse: Prevent webhook payload disclosure on event redeliverydiscourse · discourse | Medium4.3 |
| CVE-2026-45775 | Discourse: Cross-site backup access via path traversal in multisite local backupsdiscourse · discourse | Medium6.8 |
| CVE-2026-45085 | Discourse: Chat misauthorization and information disclosurediscourse · discourse | Medium5.3 |
| CVE-2026-44785 | Discourse: Hidden reply-to post raw can be disclosed through AI explain promptsdiscourse · discourse | Medium4.3 |
| CVE-2026-44784 | Discourse: Non-staff group owners can see email password in plaintext through group historydiscourse · discourse | Medium6.5 |