Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 6 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,089All CVEsplus 19,119 rejected
- 501Last 24 hours2,843 in the last 7 days
- 16,877Last 30 days1,552 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 3 | 12 | 20 | 1 | 0 | 36 | 47 |
| 2025 | 0 | 2 | 4 | 0 | 0 | 6 | 11 |
| 2024 | 3 | 0 | 2 | 0 | 0 | 5 | 5 |
| Title | ||
|---|---|---|
| CVE-2026-111602 | Appointment Booking Plugin <= 5.7.4 - Unauthenticated Sensitive Information Disclosure via ORM Operator Injection in 'customer[uuid]' Parameterlatepoint · Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress | Low3.7 |
| CVE-2026-110653 | Appointment Booking Plugin <= 5.7.4 - Unauthenticated Authentication Bypass via Race Condition on OTP Attempts Counterlatepoint · Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress | Critical9.1 |
| CVE-2026-103380 | Appointment Booking Plugin <= 5.7.3 - Authenticated (Subscriber+) Sensitive Information Exposure in 'first_name' Parameter Template Re-expansionlatepoint · Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress | Medium4.3 |
| CVE-2026-103366 | Appointment Booking Plugin <= 5.7.3 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'booking[id]' and 'cart[id]' Parameterslatepoint · Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress | High7.5 |
| CVE-2026-100163 | Appointment Booking Plugin <= 5.7.2 - Unauthenticated Authentication Bypass to Customer Account Takeover via Insufficient Verification in create_wp_user_for_customer() username_exists Fallbacklatepoint · Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress | High7.4 |
| CVE-2026-96662 | Appointment Booking Plugin <= 5.7.2 - Unauthenticated SQL Injection via 'booking[service_id]' Parameterlatepoint · Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress | High7.5 |
| CVE-2026-104766 | Appointment Booking Plugin <= 5.7.3 - Authenticated (Custom+) Privilege Escalation to 'settings[default_wp_role_for_customer]' Parameterlatepoint · Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress | High8.8 |
| CVE-2026-91050 | Appointment Booking Plugin <= 5.7.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Unauthorized Booking Creation and Sensitive Information Disclosure via 'params[presets][order_item_id]' Parameterlatepoint · Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress | Medium4.3 |
| CVE-2026-17538 | Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress <= 5.6.9 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Customer PII Modificationlatepoint · Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress | Medium5.4 |
| CVE-2026-94432 | Appointment Booking Plugin <= 5.7.1 - Insecure Direct Object Reference to Unauthenticated Unauthorized Transaction Intent Creation/Modification and Invoice Enumeration via 'invoice_id' Parameterlatepoint · Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress | Medium5.3 |
| CVE-2026-92966 | Appointment Booking Plugin <= 5.7.0 - Unauthenticated Arbitrary Shortcode Execution via First/Last Name Fieldlatepoint · Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress | Critical9.1 |
| CVE-2026-13471 | LatePoint <= 5.6.3 - Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Booking Deletion and Customer/Booking Data Disclosure via Abilities REST API (list-bookings, list-customers, delete-booking)latepoint · Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress | Medium4.3 |
| CVE-2026-18441 | LatePoint - Appointment Booking & Scheduling <= 5.6.9 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Disclosure via 'customer[id]' Parameterlatepoint · Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress | Medium4.3 |
| CVE-2026-5391 | LatePoint <= 5.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributeslatepoint · Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress | Medium6.4 |
| CVE-2026-57714 | WordPress LatePoint plugin <= 5.6.3 - SQL Injection vulnerabilityLatePoint · LatePoint | Critical9.3 |
| CVE-2026-5356 | LatePoint - Calendar Booking Plugin for Appointments and Events <= 5.4.0 - Unauthenticated Stripe PaymentIntent Amount-Binding Bypasslatepoint · LatePoint – Calendar Booking Plugin for Appointments and Events | High7.5 |
| CVE-2026-11398 | LatePoint <= 5.6.1 - Missing Authorization to Unauthenticated Arbitrary Customer Data Modification via process_step_customer() Booking Form Customer Steplatepoint · LatePoint – Calendar Booking Plugin for Appointments and Events | Medium5.3 |
| CVE-2026-12657 | LatePoint <= 5.6.2 - Unauthenticated Insecure Direct Object Reference to Arbitrary Creation via 'service_id' Parameterlatepoint · LatePoint – Calendar Booking Plugin for Appointments and Events | Medium5.3 |
| CVE-2026-13228 | LatePoint <= 5.6.3 - Authenticated (Custom+) Privilege Escalation to Administrator via 'order[customer_id]' Parameterlatepoint · LatePoint – Calendar Booking Plugin for Appointments and Events | High8.8 |
| CVE-2026-8176 | LatePoint <= 5.5.1 - Authenticated (Agent+) Privilege Escalation to Administrator via IDOR in OsOrdersController::create_or_update + Unauthenticated Customer-Cabinet Password Resetlatepoint · LatePoint – Calendar Booking Plugin for Appointments and Events | High7.5 |
| CVE-2026-49083 | WordPress LatePoint plugin <= 5.5.1 - Privilege Escalation vulnerabilityLatePoint · LatePoint | High7.5 |
| CVE-2026-9719 | LatePoint <= 5.6.0 - Cross-Site Request Forgery via invoices__change_status Actionlatepoint · LatePoint – Calendar Booking Plugin for Appointments and Events | Medium4.3 |
| CVE-2026-5365 | LatePoint <= 5.3.2 - Cross-Site Request Forgery via 'customer_cabinet__request_cancellation' AJAX Routelatepoint · LatePoint – Calendar Booking Plugin for Appointments and Events | Medium4.3 |
| CVE-2026-7652 | LatePoint <= 5.5.0 - Unauthenticated Account Takeover via Weak Password Recovery Mechanismlatepoint · LatePoint – Calendar Booking Plugin for Appointments and Events | Medium5.3 |
| CVE-2026-7332 | LatePoint <= 5.5.0 - Unauthenticated Stored Cross-Site Scripting via 'booking_form_page_url' Parameterlatepoint · LatePoint – Calendar Booking Plugin for Appointments and Events | High7.2 |
| CVE-2026-7457 | LatePoint <= 5.5.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Customer Cabinet Profile Updatelatepoint · LatePoint – Calendar Booking Plugin for Appointments and Events | Medium6.4 |
| CVE-2026-6741 | LatePoint <= 5.4.1 - Authenticated (Agent+) Privilege Escalation to Administrator via 'connect-customer-to-wp-user' Abilitylatepoint · LatePoint – Calendar Booking Plugin for Appointments and Events | High8.8 |
| CVE-2026-5234 | LatePoint <= 5.3.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Financial Data Exposure via Sequential Invoice IDlatepoint · LatePoint – Calendar Booking Plugin for Appointments and Events | Medium5.3 |
| CVE-2026-4785 | LatePoint <= 5.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodelatepoint · LatePoint – Calendar Booking Plugin for Appointments and Events | Medium6.4 |
| CVE-2026-32533 | WordPress LatePoint plugin <= 5.2.6 - Insecure Direct Object References (IDOR) vulnerabilityLatePoint · LatePoint | Medium6.5 |
| CVE-2026-2324 | LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.7 - Cross-Site Request Forgery in Booking Form Settings Update to Stored Cross-Site Scriptinglatepoint · LatePoint – Calendar Booking Plugin for Appointments and Events | Medium6.1 |
| CVE-2026-1487 | LatePoint <= 5.2.7 - Authenticated (Administrator+) SQL Injection via JSON Importlatepoint · LatePoint – Calendar Booking Plugin for Appointments and Events | Medium6.5 |
| CVE-2026-1566 | LatePoint <= 5.2.7 - Authenticated (Agent+) Privilege Escalationlatepoint · LatePoint – Calendar Booking Plugin for Appointments and Events | High8.8 |
| CVE-2025-14873 | LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.5 - Cross-Site Request Forgerylatepoint · LatePoint – Calendar Booking Plugin for Appointments and Events | Medium4.3 |
| CVE-2026-1537 | LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.6 - Missing Authorization to Booking Details Exposurelatepoint · LatePoint – Calendar Booking Plugin for Appointments and Events | Medium5.3 |
| CVE-2026-0617 | LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.5 - Unauthenticated Stored Cross-Site Scriptinglatepoint · LatePoint – Calendar Booking Plugin for Appointments and Events | High7.2 |
| CVE-2025-7052 | LatePoint <= 5.1.94 - Cross-Site Request Forgery to Account Takeover via change_password() Functionlatepoint · LatePoint – Calendar Booking Plugin for Appointments and Events | High8.8 |
| CVE-2025-7038 | LatePoint <= 5.1.94 - Unauthenticated Authentication Bypass via load_step Functionlatepoint · LatePoint – Calendar Booking Plugin for Appointments and Events | High8.2 |
| CVE-2025-6941 | LatePoint <= 5.1.94 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodelatepoint · LatePoint – Calendar Booking Plugin for Appointments and Events | Medium6.4 |
| CVE-2025-6815 | LatePoint <= 5.1.94 - Authenticated (Administrator+) Stored Cross-Site Scriptinglatepoint · LatePoint – Calendar Booking Plugin for Appointments and Events | Medium5.5 |
| CVE-2025-3769 | Latepoint <= 5.1.92 - Unauthenticated Insecure Direct Object Referencelatepoint · LatePoint – Calendar Booking Plugin for Appointments and Events | Medium5.3 |
| CVE-2025-30836 | WordPress LatePoint plugin <= 5.1.6 - Cross Site Scripting (XSS) vulnerabilityLatePoint · LatePoint | Medium6.5 |
| CVE-2024-43945 | WordPress LatePoint plugin <= 4.9.91 - Cross Site Request Forgery (CSRF) vulnerabilityLatepoint · LatePoint | Medium6.5 |
| CVE-2024-8943 | LatePoint <= 5.0.12 - Authentication Bypasslatepoint · LatePoint Plugin | Critical9.8 |
| CVE-2024-8911 | LatePoint <= 5.0.11 - Unauthenticated Arbitrary User Password Change via SQL Injectionlatepoint · LatePoint Plugin | Critical9.8 |
| CVE-2024-43992 | WordPress LatePoint plugin <= 4.9.91 - Cross Site Scripting (XSS) vulnerabilityLatepoint · LatePoint | Medium6.5 |
| CVE-2024-2472 | LatePoint Plugin <= 4.9.9 - Missing Authorization and Sensitive Information Exposure via IDORlatepoint · LatePoint Plugin | Critical9.1 |