Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 9 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 400,898All CVEsplus 19,118 rejected
- 417Last 24 hours2,904 in the last 7 days
- 16,792Last 30 days1,550 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 1 | 9 | 23 | 1 | 0 | 34 | 43 |
| 2025 | 0 | 1 | 0 | 0 | 0 | 1 | 9 |
| 2024 | 0 | 1 | 1 | 1 | 0 | 3 | 8 |
| 2023 | 0 | 3 | 1 | 0 | 0 | 4 | 5 |
| 2022 | 0 | 0 | 0 | 1 | 0 | 1 | 1 |
| Title | ||
|---|---|---|
| CVE-2026-71435 | Statamic: Stored Cross-Site Scripting in Automagic Form Notification Email Templatestatamic · cms | Medium6.1 |
| CVE-2026-71434 | Statamic: Missing file upload validation on frontend forms allows uploading disallowed file typesstatamic · cms | Medium5.3 |
| CVE-2026-64662 | Statamic: Missing authorization on navigation endpoint allows disclosure of restricted entriesstatamic · cms | Medium6.5 |
| CVE-2026-64663 | Statamic: Unsafe method invocation via Antlers template resolution allows data destructionstatamic · cms | Medium6.5 |
| CVE-2026-64665 | Statamic: Account takeover via OAuth email matching without email-verification checkstatamic · cms | High8.1 |
| CVE-2026-64664 | Statamic: Missing authorization on Control Panel endpoint allows disclosure of user existencestatamic · cms | Medium4.3 |
| CVE-2026-71293 | Statamic CMS Unguarded Exposure of 2FA Recovery Codes via Antlers current_user Variablestatamic · cms | Medium6.2 |
| CVE-2026-54243 | Statamic: CSV formula injection in form submission exportsstatamic · cms | Medium6.1 |
| CVE-2026-54242 | Statamic: Server-Side Request Forgery via Glide (DNS rebinding)statamic · cms | Medium4.9 |
| CVE-2026-54244 | Statamic: Incorrect authorization lets view-only users submit Live Preview content reserved for editorsstatamic · cms | Low3.5 |
| CVE-2026-49288 | Statamic CMS missing authorization on Control Panel fieldtype endpoints allows disclosure of restricted resourcesstatamic · cms | Medium4.3 |
| CVE-2026-49287 | Statamic CMS vulnerable to unsafe method invocation via collection sorting allows data destructionstatamic · cms | High7.4 |
| CVE-2026-45660 | Statamic: Server-Side Request Forgery via Glidestatamic · cms | Medium5.4 |
| CVE-2026-44306 | Statamic: Email enumeration via forgot password endpointstatamic · cms | Medium5.3 |
| CVE-2026-41175 | Statamic: Unsafe method invocation via query value resolution allows data destructionstatamic · cms | High8.1 |
| CVE-2026-33887 | Statamic allows unauthorized content access through missing authorization in its revision controllersstatamic · cms | Medium5.4 |
| CVE-2026-33886 | Statamic's sensitive configuration values are exposed to content editors via Antlers-enabled fieldsstatamic · cms | Medium6.5 |
| CVE-2026-33885 | Statamic has an Open Redirect on unauthenticated endpoints via URL parsing differentialstatamic · cms | Medium6.1 |
| CVE-2026-33884 | Statamic's live preview token bypasses content protection for unrelated entriesstatamic · cms | Medium4.3 |
| CVE-2026-33883 | Statamic has Reflected XSS via unescaped redirect parameter in its password reset form tagstatamic · cms | Medium6.1 |
| CVE-2026-33882 | Statamic's Markdown preview endpoint exposes sensitive user datastatamic · cms | Medium6.5 |
| CVE-2026-33177 | Statamic is missing authorization check on taxonomy term creation via fieldtypestatamic · cms | Medium4.3 |
| CVE-2026-33172 | Statamic has Stored XSS via SVG Sanitization Bypassstatamic · cms | High8.7 |
| CVE-2026-33171 | Statamic has a path traversal in file dictionary fieldtypestatamic · cms | Medium4.3 |
| CVE-2026-32612 | Statamic: privilege escalation via stored cross-site scriptingstatamic · cms | Medium5.4 |
| CVE-2026-28426 | Statamic vulnerable to privilege escalation via stored cross-site scriptingstatamic · cms | High8.7 |
| CVE-2026-28425 | Statamic vulnerable to remote code execution via Antlers-enabled control panel inputsstatamic · cms | High8.0 |
| CVE-2026-28424 | Statamic's missing authorization allows access to email addressesstatamic · cms | Medium6.5 |
| CVE-2026-28423 | Statamic Vulnerable to Server-Side Request Forgery via Glidestatamic · cms | Medium6.8 |
| CVE-2026-27939 | Statamic allows Authenticated Control Panel users to escalate privileges via elevated session bypassstatamic · cms | High8.8 |
| CVE-2026-27593 | Statamic is vulnerable to account takeover via password reset link injectionstatamic · cms | Critical9.3 |
| CVE-2026-27196 | Statamic affected by privilege escalation via stored Cross-site Scriptingstatamic · cms | High8.1 |
| CVE-2026-25759 | Statmatic affected by privilege escalation via stored cross-site scriptingstatamic · cms | High8.7 |
| CVE-2026-25633 | Statamic's missing authorization allows access to assetsstatamic · cms | Medium4.3 |
| CVE-2025-64112 | Statmatic vulnerable to Stored Cross-Site Scriptingstatamic · cms | High8.0 |
| CVE-2024-52600 | Statamic CMS has Path Traversal in Asset Uploadstatamic · cms | Medium5.3 |
| CVE-2024-36119 | Password confirmation stored in plain text via registration form in statamic/cmsstatamic · cms | Low1.8 |
| CVE-2024-24570 | Statamic account takeover via XSS and password reset linkstatamic · cms | High8.2 |
| CVE-2023-48701 | Statamic CMS vulnerable to Cross-site Scripting via uploaded assetsstatamic · cms | High7.5 |
| CVE-2023-48217 | Remote code execution via form uploads in statamic/cmsstatamic · cms | High8.8 |
| CVE-2023-47129 | Statamic CMS remote code execution via front-end form uploadsstatamic · cms | High8.4 |
| CVE-2023-36828 | Statamic's Antlers sanitizer cannot effectively sanitize malicious SVGstatamic · cms | Medium5.5 |
| CVE-2022-24784 | Discoverability of user password hash in Statamic CMSstatamic · cms | Low3.7 |