Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 6 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,764All CVEsplus 19,141 rejected
- 677Last 24 hours3,064 in the last 7 days
- 17,177Last 30 days1,610 of them critical
- 1,769Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 0 | 5 | 5 | 1 | 0 | 11 | 28 |
| 2025 | 0 | 13 | 1 | 0 | 0 | 14 | 17 |
| 2024 | 1 | 0 | 1 | 0 | 0 | 2 | 3 |
| 2023 | 0 | 1 | 0 | 0 | 0 | 1 | 1 |
| Title | ||
|---|---|---|
| CVE-2026-109977 | YaySMTP <= 2.7.8 - Authenticated (Administrator+) SQL Injection via 'params[searchKey]' Parameteryaycommerce · YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports | Medium4.9 |
| CVE-2026-42701 | WordPress YayMail plugin <= 4.4.6 - PHP Object Injection vulnerabilityYayCommerce · YayMail | High7.2 |
| CVE-2026-92553 | YaySMTP <= 2.7.7 - Authenticated (Subscriber+) Arbitrary File Upload via Attachment Filename Extensionyaycommerce · YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports | High8.8 |
| CVE-2026-66442 | WordPress YayPricing plugin <= 3.5.6 - Broken Access Control vulnerabilityYayCommerce · YayPricing | Medium5.4 |
| CVE-2026-39496 | WordPress YayMail plugin <= 4.3.3 - SQL Injection vulnerabilityYayCommerce · YayMail | High7.6 |
| CVE-2025-67994 | WordPress YayCurrency plugin <= 3.3 - Arbitrary Content Deletion vulnerabilityYayCommerce · YayCurrency | High7.5 |
| CVE-2026-27327 | WordPress YayMail – WooCommerce Email Customizer plugin <= 4.3.2 - Broken Access Control vulnerabilityYayCommerce · YayMail | Medium4.3 |
| CVE-2026-1831 | YayMail <= 4.3.2 - Missing Authorization to Authenticated (Shop Manager+) Plugin Installation and Activationyaycommerce · YayMail – WooCommerce Email Customizer | Low2.7 |
| CVE-2026-1943 | YayMail <= 4.3.2 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via Template Elementsyaycommerce · YayMail – WooCommerce Email Customizer | Medium4.4 |
| CVE-2026-1938 | YayMail <= 4.3.2 - Missing Authorization to Authenticated (Shop Manager+) License Key Deletion via '/yaymail-license/v1/license/delete' Endpointyaycommerce · YayMail – WooCommerce Email Customizer | Medium5.3 |
| CVE-2026-1937 | YayMail <= 4.3.2 - Missing Authorization to Authenticated (Shop Manager+) Arbitrary Options Update via 'yaymail_import_state' AJAX Actionyaycommerce · YayMail – WooCommerce Email Customizer | High7.2 |
| CVE-2025-60077 | WordPress YayPricing plugin <= 3.5.3 - Broken Access Control vulnerabilityYayCommerce · YayPricing | High7.5 |
| CVE-2025-60114 | WordPress YayCurrency plugin <= 3.3.1 - Remote Code Execution (RCE) vulnerabilityYayCommerce · YayCurrency | Medium6.6 |
| CVE-2025-48161 | WordPress YaySMTP plugin <= 1.3 - SQL Injection VulnerabilityYayCommerce · YaySMTP | High7.6 |
| CVE-2025-48299 | WordPress YayExtra plugin <= 1.5.5 - SQL Injection VulnerabilityYayCommerce · YayExtra | High7.6 |
| CVE-2025-48301 | WordPress SMTP for SendGrid – YaySMTP plugin <= 1.5 - SQL Injection VulnerabilityYayCommerce · SMTP for SendGrid – YaySMTP | High7.6 |
| CVE-2025-54043 | WordPress SMTP for Amazon SES plugin <= 1.9 - SQL Injection VulnerabilityYayCommerce · SMTP for Amazon SES | High7.6 |
| CVE-2025-53256 | WordPress YaySMTP plugin <= 2.6.6 - SQL Injection VulnerabilityYayCommerce · YaySMTP | High7.6 |
| CVE-2025-47587 | WordPress YaySMTP plugin <= 2.6.4 - SQL Injection VulnerabilityYayCommerce · YaySMTP | High7.6 |
| CVE-2025-3434 | SMTP for Amazon SES – YaySMTP <= 1.8 - Unauthenticated Stored Cross-Site Scripting via Email Logsyaycommerce · SMTP for Amazon SES – YaySMTP | High7.2 |
| CVE-2025-31415 | WordPress YayExtra <= 1.5.2 - Broken Access Control VulnerabilityYayCommerce · YayExtra | High7.6 |
| CVE-2025-0957 | Vulnerability: SMTP for Amazon SES <= 1.8 - Unauthenticated Stored Cross-Site Scripting via Email Logsyaycommerce · SMTP for Amazon SES – YaySMTP | High7.2 |
| CVE-2025-0953 | SMTP for Sendinblue – YaySMTP <= 1.2 - Unauthenticated Stored Cross-Site Scripting via Email Logsyaycommerce · SMTP for Sendinblue – YaySMTP | High7.2 |
| CVE-2025-0918 | SMTP for SendGrid – YaySMTP <= 1.4 - Unauthenticated Stored Cross-Site Scripting via Email Logsyaycommerce · SMTP for SendGrid – YaySMTP | High7.2 |
| CVE-2025-0916 | YaySMTP 2.4.9 - 2.6.2 - Unauthenticated Stored Cross-Site Scriptingyaycommerce · YaySMTP and Email Logs: Amazon SES, SendGrid, Outlook, Mailgun, Brevo, Google and Any SMTP Service | High7.2 |
| CVE-2024-54348 | WordPress Brandy theme <= 1.1.6 - Cross Site Scripting (XSS) vulnerabilityyaycommerce · Brand | Medium6.5 |
| CVE-2024-7257 | YayExtra – WooCommerce Extra Product Options <= 1.3.7 - Unauthenticated Arbitrary File Upload via handle_upload_file Functionyaycommerce · YayExtra – WooCommerce Extra Product Options | Critical9.8 |
| CVE-2023-3093 | YaySMTP <= 2.4.5 - Unauthenticated Stored Cross-Site Scripting via Emailyaycommerce · YaySMTP and Email Logs: Amazon SES, SendGrid, Outlook, Mailgun, Brevo, Google and Any SMTP Service | High7.2 |