Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 3 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,702All CVEsplus 19,141 rejected
- 647Last 24 hours3,003 in the last 7 days
- 17,172Last 30 days1,609 of them critical
- 1,769Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 0 | 6 | 6 | 0 | 0 | 12 | 23 |
| 2025 | 0 | 1 | 4 | 0 | 0 | 5 | 11 |
| 2024 | 0 | 1 | 5 | 0 | 0 | 6 | 6 |
| Title | ||
|---|---|---|
| CVE-2026-100151 | Ninja Forms <= 3.15.5 - Reflected DOM-Based Cross-Site Scripting via 'querystring:<key>' URL Parameterkstover · Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder | Medium6.1 |
| CVE-2026-100155 | Ninja Forms <= 3.15.5 - Unauthenticated Arbitrary Shortcode Execution via 'formData' Field Value via Success Message Merge Tagkstover · Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder | Medium6.5 |
| CVE-2026-109997 | Ninja Forms <= 3.15.5 - Unauthenticated Stored Cross-Site Scripting via 'extra' Parameter via Metadata Key Normalizationkstover · Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder | High7.2 |
| CVE-2026-101326 | Ninja Forms <= 3.15.5 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via '{wp:user_display_name}' Merge Tag via display_namekstover · Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder | Medium5.4 |
| CVE-2026-90438 | Ninja Forms <= 3.15.4 - Unauthenticated Stored Cross-Site Scripting via Paragraph Text (RTE) Field Submissionkstover · Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder | High7.2 |
| CVE-2026-94504 | Ninja Forms – The Contact Form Builder That Grows With You <= 3.15.3 - Stored Cross-Site Scriptingkstover · Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder | High7.2 |
| CVE-2026-11363 | Ninja Forms <= 3.14.6 - Authenticated (Administrator+) PHP Object Injection via Form Importkstover · Ninja Forms – The Contact Form Builder That Grows With You | Medium6.6 |
| CVE-2026-19769 | Ninja Forms <= 3.15.1 - Unauthenticated Stored Cross-Site Scripting via Repeater Child 'type' Confusion via Unmatched Array Keykstover · Ninja Forms – The Contact Form Builder That Grows With You | High7.2 |
| CVE-2026-15663 | Ninja Forms <= 3.14.9 - Authenticated (Administrator+) SQL Injection via Import File 'settings' Keykstover · Ninja Forms – The Contact Form Builder That Grows With You | Medium4.9 |
| CVE-2026-1239 | Ninja Forms <= 3.14.1 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via token/refresh REST Endpointkstover · Ninja Forms – The Contact Form Builder That Grows With You | High7.5 |
| CVE-2026-1307 | Ninja Forms <= 3.14.1 - Authenticated (Contributor+) Sensitive Information Disclosure via Block Editor Tokenkstover · Ninja Forms – The Contact Form Builder That Grows With You | Medium6.5 |
| CVE-2026-2268 | Ninja Forms <= 3.14.0 - Unauthenticated Information Disclosure in nf_ajax_submit AJAX Actionkstover · Ninja Forms – The Contact Form Builder That Grows With You | High7.5 |
| CVE-2025-11924 | Ninja Forms – The Contact Form Builder That Grows With You <= 3.13.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via Unscoped Bearer Tokenkstover · Ninja Forms – The Contact Form Builder That Grows With You | High7.5 |
| CVE-2025-10498 | Ninja Forms – The Contact Form Builder That Grows With You <= 3.12.0 - Cross-Site Request Forgery to Limited File Deletionkstover · Ninja Forms – The Contact Form Builder That Grows With You | Medium4.3 |
| CVE-2025-10499 | Ninja Forms – The Contact Form Builder That Grows With You <= 3.12.0 - Cross-Site Request Forgery to Plugin Settings Updatekstover · Ninja Forms – The Contact Form Builder That Grows With You | Medium4.3 |
| CVE-2025-5398 | Ninja Forms <= 3.10.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via CSTIkstover · Ninja Forms – The Contact Form Builder That Grows With You | Medium6.4 |
| CVE-2024-13470 | Ninja Forms – The Contact Form Builder That Grows With You <= 3.8.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodekstover · Ninja Forms – The Contact Form Builder That Grows With You | Medium6.4 |
| CVE-2024-12238 | Ninja Forms – The Contact Form Builder That Grows With You <= 3.8.22 - Authenticated (Subscriber+) Arbitrary Shortcode Executionkstover · Ninja Forms – The Contact Form Builder That Grows With You | Medium6.3 |
| CVE-2024-11052 | Ninja Forms – The Contact Form Builder That Grows With You <= 3.8.19 - Unauthenticated Stored Cross-Site Scripting via Form Calculationskstover · Ninja Forms – The Contact Form Builder That Grows With You | High7.2 |
| CVE-2024-3866 | Ninja Forms Contact Form <= 3.8.15 - Reflected Self-Based Cross-Site Scripting via Refererkstover · Ninja Forms – The Contact Form Builder That Grows With You | Medium4.7 |
| CVE-2024-2108 | Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.8.0 - Authenticated (Author+) Stored Cross-Site Scriptingkstover · Ninja Forms – The Contact Form Builder That Grows With You | Medium4.6 |
| CVE-2024-2113 | Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.8.0 - Cross-Site Request Forgery to Publicly Accessible Form Submission Exportkstover · Ninja Forms – The Contact Form Builder That Grows With You | Medium4.3 |
| CVE-2024-0685 | Ninja Forms Contact Form <= 3.7.1 - Unauthenticated Second Order SQL Injectionkstover · Ninja Forms – The Contact Form Builder That Grows With You | Medium5.9 |