Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 7 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,094All CVEsplus 19,119 rejected
- 497Last 24 hours2,828 in the last 7 days
- 16,877Last 30 days1,551 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 0 | 3 | 9 | 1 | 0 | 13 | 30 |
| 2025 | 0 | 1 | 8 | 0 | 0 | 9 | 17 |
| 2024 | 1 | 0 | 4 | 0 | 0 | 5 | 8 |
| 2023 | 0 | 0 | 0 | 0 | 0 | 0 | 3 |
| 2022 | 0 | 1 | 0 | 0 | 0 | 1 | 3 |
| 2021 | 0 | 0 | 0 | 0 | 0 | 0 | 2 |
| 2020 | 0 | 0 | 0 | 0 | 0 | 0 | 2 |
| 2019 | 0 | 0 | 0 | 0 | 0 | 0 | 2 |
| 2018 | 0 | 0 | 0 | 0 | 0 | 0 | 2 |
| 2017 | 0 | 0 | 2 | 0 | 0 | 2 | 2 |
| Title | ||
|---|---|---|
| CVE-2026-18496 | Booking Calendar <= 11.4.3 - Unauthenticated Sensitive Information Exposure in 'WPBC_FLEXTIMELINE_NAV' AJAX Actionwpdevelop · Booking Calendar | Medium5.3 |
| CVE-2026-39601 | WordPress Booking Calendar plugin <= 11.8.4 - Race Condition vulnerabilityWPdevelop · Booking Calendar | Low3.7 |
| CVE-2026-93655 | Booking Calendar <= 11.8.3 - Reflected Cross-Site Scripting via 'wpbc_auto_fill' Parameterwpdevelop · Booking Calendar | Medium6.1 |
| CVE-2026-92561 | Booking Calendar <= 11.8.2 - Reflected Cross-Site Scripting via 'options' Parameterwpdevelop · Booking Calendar | Medium6.1 |
| CVE-2026-92619 | Booking Calendar <= 11.8.2 - Authenticated (Editor+) Privilege Escalation to 'data_name' Parameterwpdevelop · Booking Calendar | High7.2 |
| CVE-2026-74002 | WordPress Booking Calendar plugin <= 11.7 - Broken Access Control vulnerabilitywpdevelop · Booking Calendar | Medium5.3 |
| CVE-2026-59558 | WordPress Booking Calendar plugin <= 11.4.2 - Cross Site Scripting (XSS) vulnerabilitywpdevelop · Booking Calendar | High7.1 |
| CVE-2026-42751 | WordPress Booking Manager plugin <= 2.1.18 - Cross Site Scripting (XSS) vulnerabilitywpdevelop · Booking Manager | Medium6.5 |
| CVE-2026-32358 | WordPress Booking Calendar plugin <= 10.14.15 - SQL Injection vulnerabilitywpdevelop · Booking Calendar | High7.6 |
| CVE-2026-2230 | Booking Calendar <= 10.14.14 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Settings Modificationwpdevelop · Booking Calendar | Medium4.3 |
| CVE-2026-1431 | Booking Calendar <= 10.14.13 - Missing Authorization to Unauthenticated Booking Details Exposurewpdevelop · Booking Calendar | Medium5.3 |
| CVE-2025-14982 | Booking Calendar <= 10.14.11 - Missing Authorization to Sensitive Information Exposurewpdevelop · Booking Calendar | Medium4.3 |
| CVE-2025-14146 | Booking Calendar <= 10.14.10 - Unauthenticated Sensitive Information Exposurewpdevelop · Booking Calendar | Medium5.3 |
| CVE-2025-14383 | Booking Calendar <= 10.14.8 - Unauthenticated SQL Injection via dates_to_checkwpdevelop · Booking Calendar | High7.5 |
| CVE-2025-12804 | Booking Calendar <= 10.14.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via bookingcalendar Shortcodewpdevelop · Booking Calendar | Medium6.4 |
| CVE-2025-64381 | WordPress Booking Calendar plugin <= 10.14.7 - Cross Site Scripting (XSS) vulnerabilitywpdevelop · Booking Calendar | Medium6.5 |
| CVE-2025-64275 | WordPress Booking Manager plugin <= 2.1.17 - Cross Site Scripting (XSS) vulnerabilitywpdevelop · Booking Manager | Medium6.5 |
| CVE-2025-9346 | Booking Calendar <= 10.14.1 - Authenticated (Contributor+) Stored Cross-Site Scriptingwpdevelop · Booking Calendar | Medium6.4 |
| CVE-2025-4669 | Booking Calendar <= 10.11.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpbc Shortcodewpdevelop · Booking Calendar | Medium6.4 |
| CVE-2024-13821 | WP Booking Calendar <= 10.10 - Unauthenticated Post-Confirmation Booking Manipulationwpdevelop · Booking Calendar | Medium5.3 |
| CVE-2024-13323 | Booking Calendar <= 10.9.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via 'booking' Shortcodewpdevelop · Booking Calendar | Medium6.4 |
| CVE-2024-56292 | WordPress Email Reminders Plugin <= 2.0.5 - Cross Site Scripting (XSS) vulnerabilitywpdevelop · Email Reminders | Medium5.9 |
| CVE-2024-11945 | Email Reminders <= 2.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameterwpdevelop · Email Reminders | Medium6.4 |
| CVE-2024-9306 | WP Booking Calendar <= 10.6 - Authenticated (Admin+) Stored Cross-Site Scriptingwpdevelop · Booking Calendar | Medium4.4 |
| CVE-2024-8274 | WP Booking Calendar <= 10.5 - Reflected Cross-Site Scriptingwpdevelop · Booking Calendar | Medium6.1 |
| CVE-2024-6930 | WP Booking Calendar <= 10.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via bookingform Shortcodewpdevelop · Booking Calendar | Medium6.4 |
| CVE-2024-1207 | Booking Calendar <= 9.9 - Unauthenticated SQL Injectionwpdevelop · Booking Calendar | Critical9.8 |
| CVE-2022-1463 | Booking Calendar <= 9.1 - PHP Object Injection via Shortcodewpdevelop · Booking Calendar | High8.8 |
| CVE-2017-2151 | Cross-site scripting vulnerability in Booking Calendar version 7.1 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified…wpdevelop · Booking Calendar | Medium6.1 |
| CVE-2017-2150 | Directory traversal vulnerability in Booking Calendar version 7.0 and earlier allows remote attackers to read arbitrary files via specially crafted…wpdevelop · Booking Calendar | Medium5.3 |