Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 7 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,334All CVEsplus 19,141 rejected
- 443Last 24 hours2,721 in the last 7 days
- 16,923Last 30 days1,562 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 7 | 42 | 39 | 1 | 0 | 89 | 176 |
| 2025 | 0 | 3 | 2 | 0 | 0 | 5 | 87 |
| 2024 | 0 | 4 | 8 | 1 | 0 | 13 | 82 |
| 2023 | 4 | 31 | 27 | 0 | 0 | 62 | 69 |
| 2022 | 1 | 4 | 2 | 0 | 0 | 7 | 7 |
| Title | ||
|---|---|---|
| CVE-2026-116183 | phpMyFAQ before 4.1.10 Authorization Bypass via /api/faq/create openQuestionIDthorsten · phpMyFAQ | High8.7 |
| CVE-2026-116182 | phpMyFAQ before 4.1.10 SSRF via PDF Export Image Fetchingthorsten · phpMyFAQ | Medium5.3 |
| CVE-2026-111911 | phpMyFAQ 4.0.0 before 4.1.9 Authentication Bypass via WebAuthn Credential Injectionthorsten · phpMyFAQ | Critical9.3 |
| CVE-2026-111910 | phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Authorization Bypass via attachment.php Downloadsthorsten · phpMyFAQ | High7.1 |
| CVE-2026-111909 | phpMyFAQ before 4.1.9 Missing Authorization Allows Superadmin Deletion via deleteUser APIthorsten · phpMyFAQ | High7.2 |
| CVE-2026-111908 | phpMyFAQ 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta BOLA in FAQ Update via REST APIthorsten · phpMyFAQ | High8.7 |
| CVE-2026-111907 | phpMyFAQ 4.0.0 before 4.1.9 CSRF via /admin/api/update-databasethorsten · phpMyFAQ | High7.1 |
| CVE-2026-111906 | phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta CSRF in Elasticsearch/OpenSearch Admin API Index Operationsthorsten · phpMyFAQ | High7.1 |
| CVE-2026-111905 | phpMyFAQ 3.2.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta IDOR Leaks TOTP Secret via /admin/api/user/datathorsten · phpMyFAQ | High7.0 |
| CVE-2026-111904 | phpMyFAQ 4.2.0-alpha before 4.2.0-beta Information Disclosure via open-questions APIthorsten · phpMyFAQ | Medium6.9 |
| CVE-2026-111903 | phpMyFAQ 4.2.0-alpha before 4.2.0-beta Stored XSS via SVG DTD Entity Bypassthorsten · phpMyFAQ | Medium5.1 |
| CVE-2026-111902 | phpMyFAQ 4.2.0-alpha before 4.2.0-beta Authorization Bypass via Comments and Attachments APIthorsten · phpMyFAQ | Medium6.9 |
| CVE-2026-111901 | phpMyFAQ 4.2.0-alpha before 4.2.0-beta Unauthenticated DoS via API Paginationthorsten · phpMyFAQ | High8.7 |
| CVE-2026-111900 | phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Draft FAQ Attachment Disclosure via attachment.phpthorsten · phpMyFAQ | Medium5.3 |
| CVE-2026-111898 | phpMyFAQ 4.2.0-alpha before 4.2.0-beta Account Takeover via Keycloak Implicit Account Linkingthorsten · phpMyFAQ | High7.7 |
| CVE-2026-111897 | phpMyFAQ 4.2.0-alpha before 4.2.0-beta Authorization Bypass in Attachment Administration Endpointsthorsten · phpMyFAQ | High7.1 |
| CVE-2026-111896 | phpMyFAQ 4.2.0-alpha before 4.2.0-beta Stored XSS via SVG Upload Sanitizer Bypassthorsten · phpMyFAQ | Medium5.1 |
| CVE-2026-111895 | phpMyFAQ 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta Account Takeover via Entra ID preferred_usernamethorsten · phpMyFAQ | High7.6 |
| CVE-2026-111894 | phpMyFAQ 3.2.1 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Stored XSS via iframe data: URIthorsten · phpMyFAQ | Medium5.1 |
| CVE-2026-111893 | phpMyFAQ 4.2.0-alpha before 4.2.0-beta Privilege Escalation via Group Category Restrictions APIthorsten · phpMyFAQ | High8.5 |
| CVE-2026-111892 | phpMyFAQ 4.2.0-alpha before 4.2.0-beta Missing Rate Limiting on Password-Reset Endpointsthorsten · phpMyFAQ | Medium6.9 |
| CVE-2026-111891 | phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta Privilege Escalation via Group Permissions APIthorsten · phpMyFAQ | High7.0 |
| CVE-2026-111890 | phpMyFAQ 4.2.0-alpha.2 before 4.2.0-beta Privilege Escalation via updateUserRightsthorsten · phpMyFAQ | High7.0 |
| CVE-2026-111889 | phpMyFAQ 4.1.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Missing Authorization via Admin Dashboardthorsten · phpMyFAQ | Medium5.3 |
| CVE-2026-111888 | phpMyFAQ 4.0.0 before 4.1.9 Incorrect Authorization via news update APIthorsten · phpMyFAQ | Medium5.1 |
| CVE-2026-111887 | phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Account Enumeration via Guest Comment Endpointthorsten · phpMyFAQ | Medium6.9 |
| CVE-2026-111886 | phpMyFAQ 4.2.0-alpha.2 before 4.2.0-beta 2FA Brute-Force via remove-twofactor Endpointthorsten · phpMyFAQ | High7.1 |
| CVE-2026-111885 | phpMyFAQ 4.2.0-alpha before 4.2.0-beta Missing Authorization via deleteGroup APIthorsten · phpMyFAQ | High7.0 |
| CVE-2026-111884 | phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Missing Current-Password Step-Up on E-mail Change Enables Account Takeoverthorsten · phpMyFAQ | High8.7 |
| CVE-2026-111882 | phpMyFAQ 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta TOTP 2FA Bypass via SSO Callbacksthorsten · phpMyFAQ | High8.6 |
| CVE-2026-109573 | phpMyFAQ before 4.1.9 SQL Injection via api/autocomplete Search Endpointthorsten · phpMyFAQ | Critical9.2 |
| CVE-2026-108851 | phpMyFAQ through 4.1.10 Missing Authorization via MCP Server faq_search Toolthorsten · phpMyFAQ | Medium4.8 |
| CVE-2026-47132 | phpMyFAQ: SQL LIKE Wildcard Injection in Chat User Search Allows Authenticated User Enumerationthorsten · phpMyFAQ | Medium5.4 |
| CVE-2026-56738 | phpMyFAQ has SQL Injection in `StopWords::add()` — Unescaped Stop Word Insertionthorsten · phpMyFAQ | High8.5 |
| CVE-2026-56737 | phpMyFAQ's two-factor authentication login bypasses the password factorthorsten · phpMyFAQ | High8.1 |
| CVE-2026-56736 | phpMyFAQ has Stored XSS in Admin FAQ Editor via HTML Entity Bypass in Frontend FAQ Submissionthorsten · phpMyFAQ | High8.2 |
| CVE-2026-85593 | phpMyFAQ before 4.1.8 Stored XSS via html_entity_decodethorsten · phpMyFAQ | Medium5.1 |
| CVE-2026-85592 | phpMyFAQ before 4.1.8 Authorization Bypass via question/createthorsten · phpMyFAQ | Medium6.3 |
| CVE-2026-85591 | phpMyFAQ before 4.1.8 Authentication Bypass via Unverified Password Changethorsten · phpMyFAQ | High7.1 |
| CVE-2026-85590 | phpMyFAQ before 4.1.8 Authentication Bypass via Two-Factor Disablethorsten · phpMyFAQ | High7.1 |
| CVE-2026-85589 | phpMyFAQ before 4.2.0-alpha.2 Missing Authorization via Dashboard APIthorsten · phpMyFAQ | Medium5.3 |
| CVE-2026-85588 | phpMyFAQ before 4.1.8 TOTP Secret Exposure via Data Exportthorsten · phpMyFAQ | Medium5.3 |
| CVE-2026-85587 | phpMyFAQ before 4.1.8 Incorrect Authorization via Admin Pagesthorsten · phpMyFAQ | Medium5.3 |
| CVE-2026-85586 | phpMyFAQ before 4.1.8 CAPTCHA Bypass via store parameterthorsten · phpMyFAQ | Medium6.9 |
| CVE-2026-76215 | phpMyFAQ before 4.1.7 Missing Authorization via child resourcesthorsten · phpMyFAQ | Medium6.9 |
| CVE-2026-76214 | phpMyFAQ before 4.1.7 WebAuthn Replay Attack via Challengethorsten · phpMyFAQ | Critical9.1 |
| CVE-2026-76213 | phpMyFAQ before 4.1.7 2FA Brute-Force via Session-Scoped Throttlethorsten · phpMyFAQ | Critical9.1 |
| CVE-2026-76212 | phpMyFAQ before 4.1.7 LIKE Wildcard Injection via PostgreSQLthorsten · phpMyFAQ | Medium6.9 |
| CVE-2026-76211 | phpMyFAQ before 4.1.7 Information Disclosure via Admin APIthorsten · phpMyFAQ | Medium5.3 |
| CVE-2026-76210 | phpMyFAQ before v4.1.6 Local File Disclosure via PDF Exportthorsten · phpMyFAQ | High7.1 |