Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 4 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,167All CVEsplus 19,120 rejected
- 475Last 24 hours2,785 in the last 7 days
- 16,854Last 30 days1,538 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 1 | 2 | 4 | 0 | 0 | 7 | 23 |
| 2025 | 0 | 3 | 4 | 0 | 0 | 7 | 16 |
| 2024 | 0 | 2 | 0 | 1 | 0 | 3 | 9 |
| 2023 | 1 | 0 | 5 | 0 | 0 | 6 | 6 |
| Title | ||
|---|---|---|
| CVE-2026-109197 | WP Directory Kit <= 1.6.0 - Unauthenticated SQL Injection via 'idfield' Parameterwpdirectorykit · WP Directory Kit | High7.5 |
| CVE-2026-96653 | WP Directory Kit <= 1.5.9 - Authenticated (Subscriber+) SQL Injection via 'display_name' Profile Field (Second-Order)wpdirectorykit · WP Directory Kit | Medium6.5 |
| CVE-2026-16596 | WP Directory Kit <= 1.5.4 - Authenticated (Custom+) SQL Injection via 'data_fields_list' Parameterwpdirectorykit · WP Directory Kit | Medium6.5 |
| CVE-2026-16588 | WP Directory Kit <= 1.5.4 - Authenticated (Custom+) SQL Injection via 'order_by' Parameterwpdirectorykit · WP Directory Kit | Medium6.5 |
| CVE-2026-28001 | WordPress WP Directory Kit plugin <= 1.5.4 - SQL Injection vulnerabilityWPDirectoryKit · WP Directory Kit | Critical9.3 |
| CVE-2026-27538 | WordPress WP Directory Kit plugin <= 1.5.4 - SQL Injection vulnerabilityWPDirectoryKit · WP Directory Kit | High7.5 |
| CVE-2025-13920 | WP Directory Kit <= 1.4.9 - Unauthenticated Email Exposure via wdk_public_actionwpdirectorykit · WP Directory Kit | Medium5.3 |
| CVE-2025-14618 | Sweet Energy Efficiency <= 1.0.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Graph Deletionwpdirectorykit · Sweet Energy Efficiency | Medium4.3 |
| CVE-2025-13089 | WP Directory Kit <= 1.4.7 - Unauthenticated SQL Injectionwpdirectorykit · WP Directory Kit | High7.5 |
| CVE-2025-13090 | WP Directory Kit <= 1.4.6 - Authenticated (Admin+) SQL Injectionwpdirectorykit · WP Directory Kit | Medium4.9 |
| CVE-2025-13525 | WP Directory Kit <= 1.4.5 - Reflected Cross-Site Scripting via 'order_by' Parameterwpdirectorykit · WP Directory Kit | Medium6.1 |
| CVE-2025-13138 | WP Directory Kit <= 1.4.3 - Unauthenticated SQL Injection via select_2_ajax() Functionwpdirectorykit · WP Directory Kit | High7.5 |
| CVE-2025-60120 | WordPress WP Directory Kit plugin <= 1.4.0 - Broken Access Control vulnerabilityWPDirectoryKit · WP Directory Kit | Medium5.3 |
| CVE-2025-58262 | WordPress Sweet Energy Efficiency plugin <= 1.0.8 - Cross Site Request Forgery (CSRF) vulnerabilityWPDirectoryKit · Sweet Energy Efficiency | High7.1 |
| CVE-2024-37253 | WordPress WPDirectoryKit plugin <= 1.3.6 - HTML Injection vulnerabilityWpDirectoryKit · WP Directory Kit | Low2.7 |
| CVE-2024-3217 | WP Directory Kit <= 1.3.0 - Authenticated (Subscriber+) SQL Injectionwpdirectorykit · WP Directory Kit | High8.8 |
| CVE-2024-29774 | WordPress WP Directory Kit plugin <= 1.2.9 - Reflected Cross Site Scripting (XSS) vulnerabilityWpDirectoryKit · WP Directory Kit | High7.1 |
| CVE-2023-2279 | WP Directory Kit <= 1.2.1 - Cross-Site Request Forgery to Plugin Settings Change/Delete, Demo Import, Directory Kit Modification/Deletion via admin_page_displaywpdirectorykit · WP Directory Kit | Medium5.4 |
| CVE-2023-2278 | WP Directory Kit <= 1.1.9 - Unauthenticated Local File Inclusion via wdk_public_actionwpdirectorykit · WP Directory Kit | Critical9.8 |
| CVE-2023-2277 | WP Directory Kit <= 1.1.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting via wdk_resultitemwpdirectorykit · WP Directory Kit | Medium6.1 |
| CVE-2023-2351 | WP Directory Kit <= 1.2.3 - Missing Authorization to Plugin Settings Change/Delete, Demo Import, Directory Kit Deletion via wdk_admin_actionwpdirectorykit · WP Directory Kit | Medium6.5 |
| CVE-2023-2280 | WP Directory Kit <= 1.2.2 - Missing Authorization to Plugin Installation, Settings Change/Delete, Demo Import, Directory Kit Deletion via wdk_public_actionwpdirectorykit · WP Directory Kit | Medium6.5 |
| CVE-2023-2835 | WP Directory Kit <= 1.2.3 - Reflected Cross-Site Scripting via 'search'wpdirectorykit · WP Directory Kit | Medium6.1 |