Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 8 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,234All CVEsplus 19,120 rejected
- 499Last 24 hours2,796 in the last 7 days
- 16,901Last 30 days1,543 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 2 | 14 | 7 | 0 | 0 | 23 | 150 |
| 2025 | 0 | 0 | 3 | 1 | 0 | 4 | 127 |
| 2024 | 0 | 5 | 7 | 0 | 0 | 12 | 123 |
| 2023 | 0 | 13 | 56 | 0 | 0 | 69 | 111 |
| 2022 | 1 | 8 | 22 | 0 | 0 | 31 | 42 |
| 2021 | 0 | 4 | 6 | 0 | 0 | 10 | 11 |
| 2020 | 0 | 1 | 0 | 0 | 0 | 1 | 1 |
| Title | ||
|---|---|---|
| CVE-2026-109392 | Pimcore through 2026.3.1 Stored XSS via ExternalImage Field Version PreviewPimcore · Pimcore | Medium5.1 |
| CVE-2026-55416 | Pimcore: SQL Injection in Mautic Custom Reports Bundle Due to Direct Concatenation of User-Controlled Configuration Fields Without Parameterizationpimcore · pimcore | High8.8 |
| CVE-2026-55072 | Pimcore: ClassDefinition UID regex missing end anchor allows SQL injection via Block.php unquoted table namepimcore · pimcore | High8.5 |
| CVE-2026-55634 | Pimcore: Remote Code Execution via DataObject Class-Definition Field Namepimcore · pimcore | Critical9.9 |
| CVE-2026-55220 | Pimcore Hotspotimage getDataFromResource() unrestricted Serialize::unserialize over object-store columnpimcore · pimcore | Critical9.3 |
| CVE-2026-44741 | Pimcore Admin Classic Bundle Vulnerable to SQL Injection in Translation Grid Date Filter via Unsanitized Property Parameterpimcore · pimcore | High8.8 |
| CVE-2026-72562 | Pimcore pimcore admin-ui-classic-bundle - SQL InjectionPimcore · pimcore admin-ui-classic-bundle | High8.8 |
| CVE-2026-45704 | Pimcore: CustomReports Share Bypasspimcore · pimcore | High7.1 |
| CVE-2026-44739 | Pimcore: SQL Injection in Custom Reports Column Configurationpimcore · pimcore | High8.7 |
| CVE-2026-45260 | Pimcore: Missing Authorization in WebDAV MOVE via unchecked asset move handlingpimcore · pimcore | High8.1 |
| CVE-2026-45703 | Pimcore: WordExport Authorization Bypass for Unauthorized Document Exportpimcore · pimcore | Medium6.4 |
| CVE-2026-45162 | Pimcore: Unsafe PHP Deserialization in Multiple Locations Without allowed_classes Restrictionpimcore · pimcore | High8.0 |
| CVE-2026-55207 | Pimcore: Account Takeover via Password Reset URL Injection allows unauthenticated attacker to hijack any admin account with 2FA bypasspimcore · pimcore | High8.8 |
| CVE-2026-55208 | Pimcore: SQL Injection via Column Name in DateFilter allows authenticated user to extract arbitrary database data including admin password hashespimcore · pimcore | High7.7 |
| CVE-2026-55212 | Pimcore: Insufficient Permission Check on Class Definition Creation Endpoint Allows Privilege Escalationpimcore · pimcore | High7.1 |
| CVE-2026-5362 | Pimcore Platform v12.3.3 - Stored XSS in Document Editable Embed renderingpimcore · pimcore | Medium4.8 |
| CVE-2026-5394 | Pimcore Platform v12.3.3 - SQL Injection in DataObject composite index handlingpimcore · pimcore | High7.0 |
| CVE-2026-27461 | Pimcore vulnerable to SQL injection via unsanitized filter value in Dependency Dao RLIKE clausepimcore · pimcore | Medium6.9 |
| CVE-2026-23496 | Pimcore Web2Print Tools Bundle "Favourite Output Channel Configuration" Missing Function Level Authorizationpimcore · pimcore | Medium5.4 |
| CVE-2026-23494 | Pimcore is Missing Function Level Authorization on "Static Routes" Listingpimcore · pimcore | Medium4.3 |
| CVE-2026-23495 | Pimcore's Admin Classic Bundle is Missing Function Level Authorization on "Predefined Properties" Listingpimcore · pimcore | Medium4.3 |
| CVE-2026-23493 | Pimcore ENV Variables and Cookie Informations are exposed in http_error_logpimcore · pimcore | High8.6 |
| CVE-2026-23492 | Pimcore has a Blind SQL Injection in Admin Search Find API due to an incomplete fix for CVE-2023-30848pimcore · pimcore | High8.8 |
| CVE-2025-30166 | Pimcore's Admin Classic Bundle allows HTML Injectionpimcore · admin-ui-classic-bundle | Low1.8 |
| CVE-2025-27617 | Pimcore Vulnerable to SQL Injection in getRelationFilterConditionpimcore · pimcore | Medium6.3 |
| CVE-2025-24980 | Pimcore Admin Classic Bundle allows user enumerationpimcore · admin-ui-classic-bundle | Medium6.9 |
| CVE-2024-11956 | Pimcore customer-data-framework list sql injectionPimcore · customer-data-framework | Medium5.1 |
| CVE-2023-2332 | Stored Cross-site Scripting (XSS) in pimcore/pimcorepimcore · pimcore/pimcore | Medium4.0 |
| CVE-2024-49370 | Change-Password via Portal-Profile sets PimcoreBackendUser password without hashingpimcore · pimcore | High8.7 |
| CVE-2024-41109 | Pimcore vulnerable to disclosure of system and database information behind /admin firewallpimcore · admin-ui-classic-bundle | Medium6.3 |
| CVE-2024-32871 | Pimcore Vulnerable to Flooding Server with Thumbnail filespimcore · pimcore | High7.5 |
| CVE-2024-29197 | Pimcore Preview Documents are not restricted to logged in users anymorepimcore · pimcore | Medium6.5 |
| CVE-2024-25625 | Pimcore Host Header Injection in user invitation linkpimcore · admin-ui-classic-bundle | High8.1 |
| CVE-2024-24822 | Pimcore Admin Classic Bundle permissions are not getting checked when working with tagspimcore · admin-ui-classic-bundle | Medium6.5 |
| CVE-2024-23646 | Pimcore Admin Classic Bundle SQL Injection in Admin download files as zippimcore · admin-ui-classic-bundle | High8.8 |
| CVE-2024-23648 | Pimcore Admin Classic Bundle host header injection in the password resetpimcore · admin-ui-classic-bundle | High8.8 |
| CVE-2024-21667 | Pimcore Customer Data Framework Improper Access Control allows unprivileged user to access GDPR extractspimcore · customer-data-framework | Medium6.5 |
| CVE-2024-21666 | Pimcore Customer Data Framework Improper Access Control allows unprivileged user to access customers duplicates listpimcore · customer-data-framework | Medium6.5 |
| CVE-2024-21665 | Pimcore Ecommerce Framework Bundle Improper Access Control allows unprivileged user to access back-office orders listpimcore · ecommerce-framework-bundle | Medium4.3 |
| CVE-2023-49076 | Pimcore missing token/header to prevent CSRFpimcore · customer-data-framework | Medium4.3 |
| CVE-2023-49075 | Pimcore Admin UI has Two Factor Authentication disabled for non admin security firewallspimcore · admin-ui-classic-bundle | High8.5 |
| CVE-2023-47636 | Full Path Disclosure via re-export document in pimcore/admin-ui-classic-bundlepimcore · admin-ui-classic-bundle | Medium5.3 |
| CVE-2023-47637 | SQL Injection in Admin Grid Filter API in Pimcorepimcore · pimcore | High8.8 |
| CVE-2023-46722 | Pimcore Admin Classic Bundle Cross-site Scripting (XSS) in PDF previewspimcore · admin-ui-classic-bundle | Medium6.1 |
| CVE-2023-5873 | Cross-site Scripting (XSS) - Stored in pimcore/pimcorepimcore · pimcore/pimcore | Medium4.0 |
| CVE-2023-5844 | Unverified Password Change in pimcore/admin-ui-classic-bundlepimcore · pimcore/admin-ui-classic-bundle | Medium4.3 |
| CVE-2023-5192 | Excessive Data Query Operations in a Large Data Table in pimcore/demopimcore · pimcore/demo | Medium6.1 |
| CVE-2023-42817 | Cross-site Scripting (XSS) in pimcore admin-ui-classic-bundle translationspimcore · admin-ui-classic-bundle | Medium5.4 |
| CVE-2023-4453 | Cross-site Scripting (XSS) - Reflected in pimcore/pimcorepimcore · pimcore/pimcore | Medium6.4 |
| CVE-2023-38708 | Pimcore Path Traversal Vulnerability in AssetController:importServerFilesActionpimcore · pimcore | Medium6.3 |