Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 9 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,802All CVEsplus 19,141 rejected
- 548Last 24 hours3,083 in the last 7 days
- 17,068Last 30 days1,603 of them critical
- 1,769Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 0 | 0 | 9 | 4 | 0 | 13 | 41 |
| 2025 | 0 | 0 | 0 | 1 | 0 | 1 | 28 |
| 2024 | 0 | 0 | 0 | 2 | 0 | 2 | 27 |
| 2023 | 1 | 0 | 2 | 0 | 0 | 3 | 25 |
| 2022 | 0 | 4 | 2 | 0 | 0 | 6 | 22 |
| 2021 | 0 | 3 | 2 | 0 | 0 | 5 | 16 |
| 2020 | 0 | 1 | 8 | 2 | 0 | 11 | 11 |
| Title | ||
|---|---|---|
| CVE-2026-49400 | October CMS: PHP Object Injection via Backend Widget Session Storageoctobercms · october | Low3.3 |
| CVE-2026-46696 | October CMS: Safe Mode Sandbox Bypass via Session Store and Forwarded Builder Callsoctobercms · system | Low3.3 |
| CVE-2026-29179 | October: Editor Sub-Permission Bypass for Asset and Blueprint File Operationsoctobercms · october | Low3.3 |
| CVE-2026-27937 | October: Reflected XSS via DataTable Form Widgetoctobercms · october | Low3.1 |
| CVE-2026-26274 | October: Safe Mode Bypass via Twig Database Write Operationsoctobercms · october | Medium6.6 |
| CVE-2026-26067 | October: Safe Mode Bypass via CSS Preprocessor Compilersoctobercms · october | Medium4.9 |
| CVE-2026-25133 | October CMS has Stored XSS via SVG Filter Bypassoctobercms · october | Medium4.8 |
| CVE-2026-25125 | October CMS: Environment Variable Exfiltration via INI Parser Interpolationoctobercms · october | Medium4.9 |
| CVE-2026-24907 | October CMS has Stored XSS via Event Log Mail Previewoctobercms · october | Medium5.1 |
| CVE-2026-24906 | October CMS has Stored XSS in its Backend Editor Markup Classesoctobercms · october | Medium5.1 |
| CVE-2026-22692 | October CMS: Twig Sandbox Bypass via Collection Methodsoctobercms · october | Medium4.9 |
| CVE-2025-61674 | October CMS Vulnerable to Stored XSS via Editor and Branding Stylesoctobercms · october | Medium6.1 |
| CVE-2025-61676 | October CMS Vulnerable to Stored XSS via Branding Stylesoctobercms · october | Medium6.1 |
| CVE-2024-51991 | October CMS Allows Unprotected SVG Rename in Media Manageroctobercms · october | Low1.1 |
| CVE-2024-25637 | Reflected XSS via X-October-Request-Handler Headeroctobercms · october | Low3.1 |
| CVE-2024-24764 | October Open Redirect for Administrator Accountsoctobercms · october | Low3.5 |
| CVE-2023-44381 | October CMS safe mode bypass using Page template injectionoctobercms · october | Medium4.9 |
| CVE-2023-44382 | October CMS safe mode bypass using Twig sandbox escapeoctobercms · october | Critical9.1 |
| CVE-2023-44383 | October CMS stored XSS by authenticated backend user with improper configurationoctobercms · october | Medium5.4 |
| CVE-2022-35944 | October CMS Safe Mode bypass leads to authenticated RCE (Remote Code Execution)octobercms · october | Medium6.2 |
| CVE-2022-24800 | Race Condition in October CMS upload processoctobercms · october | High8.1 |
| CVE-2022-23655 | Missing server signature validation in OctoberCMSoctobercms · october | Medium4.8 |
| CVE-2022-21705 | Authenticated remote code execution in octobercmsoctobercms · october | High7.2 |
| CVE-2021-32649 | Authenticated file write leads to remote code execution in october/systemoctobercms · october | High8.8 |
| CVE-2021-32650 | Arbitrary code execution in october/systemPublic exploitoctobercms · october | High8.8 |
| CVE-2021-41126 | Deleted Admin Can Sign In to Admin Interfaceoctobercms · october | High7.2 |
| CVE-2021-29487 | Authentication bypass in Octobercmsoctobercms · october | High7.4 |
| CVE-2021-32648 | Account Takeover in OctobercmsExploitedPublic exploitoctobercms · october | High8.2 |
| CVE-2021-21264 | Bypass of fix for CVE-2020-26231, Twig sandbox escapeoctobercms · october | Medium5.2 |
| CVE-2021-21265 | October CMS vulnerable to Potential Host Header Poisoning on misconfigured serversoctobercms · october | Medium6.8 |
| CVE-2020-26231 | Bypass of fix for CVE-2020-15247, Twig sandbox escapeoctobercms · october | Medium5.2 |
| CVE-2020-15249 | Stored XSS by authenticated backend user with access to upload filesoctobercms · october | Low2.8 |
| CVE-2020-15248 | Privilege escalation by backend users assigned to the default "Publisher" system roleoctobercms · october | Medium4.0 |
| CVE-2020-15247 | Twig Sandbox Escape by authenticated users with access to editing CMS templates when safemode is enabled.octobercms · october | Medium5.2 |
| CVE-2020-15246 | Local File Inclusion by unauthenticated usersoctobercms · october | High7.5 |
| CVE-2020-15128 | Reliance on Cookies without validation in OctoberCMSoctobercms · october | Medium6.1 |
| CVE-2020-5299 | Potential CSV Injection vector in OctoberCMSoctobercms · october | Medium4.0 |
| CVE-2020-5296 | Arbitrary File Deletion vulnerability in OctoberCMSoctobercms · october | Medium6.2 |
| CVE-2020-5297 | Upload whitelisted files to any directory in OctoberCMSoctobercms · october | Low3.4 |
| CVE-2020-5298 | Reflected XSS when importing CSV in OctoberCMSoctobercms · october | Medium4.0 |
| CVE-2020-5295 | Local File read vulnerability in OctoberCMSoctobercms · october | Medium4.8 |