Vulnerabilities exploitable today
404,880in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,760
New KEV · 24H0
Exploit Today ≥ 701,693
Distribution · last window
- Critical5,622
- High21,796
- Medium20,177
- Low2,113
Filters
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-103755——
——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.12dCVE-2025-34906——
——0Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.9dCVE-2026-16681——
——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.12dCVE-2016-8153——
——0Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none11dCVE-2026-26036——
——0Rejected reason: Not used11dCVE-2019-18774——
——0Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none11dCVE-2026-51229——
——0Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.90dCVE-2025-34907——
——0Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulnerability disclosure.9dCVE-2026-23690——
——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.13dCVE-2016-9527——
——0Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none11dCVE-2023-54369——
——0Rejected reason: This CVE ID has been rejected.79dCVE-2016-2757——
——0Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none11dCVE-2023-34428——
——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused62dCVE-2026-9052——
——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.13dCVE-2026-1169005.4 MED—
——0REDAXO before 5.21.4 contains a stored cross-site scripting vulnerability that allows content editors to inject HTML by storing unescaped values rendered by media, medialist, link and linklist widgets. Attackers can submit crafted REX_INPUT_MEDIA or REX_INPUT_LINK values that break out of the value attribute, executing script in administrators' backend sessions to hijack accounts.2dCVE-2026-1168996.5 MED—
——0REDAXO before 5.21.4 contains a broken access control vulnerability that allows authenticated editors to modify slices in unauthorized categories by pairing a permitted article with a foreign slice id. Attackers can abuse content/edit delete and edit functions or the content_slice_status and content_move_slice APIs to delete, toggle, move, or overwrite other editors' slices.2dCVE-2018-4658——
——0Rejected reason: This candidate is unused by its CNA.11dCVE-2024-56786——
——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.13dCVE-2017-4776——
——0Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017. Notes: none12dCVE-2025-62681——
——0Rejected reason: Not used11dCVE-2016-8185——
——0Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none11dCVE-2016-0045——
——0Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none11dCVE-2017-4420——
——0Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017. Notes: none11dCVE-2016-2751——
——0Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none11dCVE-2026-73188——
——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Duplicate to CVE-2026-13610.76dCVE-2016-7183——
——0Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none11dCVE-2026-57846——
——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.13dCVE-2025-12533——
——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.12dCVE-2026-57847——
——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.13dCVE-2016-1332——
——0Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none11dCVE-2026-1168875.4 MED—
——0Semantic MediaWiki from 3.0.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows users with page-edit rights to inject HTML through Keyword-typed property values rendered unescaped on Special:Browse. Attackers can annotate a Keyword property with an event-handler payload that executes JavaScript in viewers' sessions, including administrators, to read tokens and perform actions.2dCVE-2026-1168865.4 MED—
——0Semantic MediaWiki from 2.5.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows users with page-edit rights to inject scripts via External identifier property values. Attackers can annotate markup payloads that ExternalIdentifierValue renders unescaped on Special:Browse, executing JavaScript in viewers' sessions, including administrators.2dCVE-2020-11385——
——0Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none11dCVE-2026-1168824.8 MED—
——0Semantic MediaWiki from 4.2.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows authenticated profile or schema editors to inject HTML through FacetedSearch exploration-link labels. Attackers can store markup in the label, which ExploreListBuilder::buildHTML() passes unescaped to Html::rawElement(), altering the Special:FacetedSearch page and potentially running scripts in viewers' browsers.2dCVE-2026-1168816.1 MED—
——0Semantic MediaWiki from 3.0.0 before 7.3.1 contains a cross-site scripting vulnerability that allows attackers to inject markup by storing malicious semantic property values rendered unescaped in autocomplete suggestions. When another user opens the property-value autocomplete with an empty query, jquery.autocomplete.js concatenates the raw PValueLookup API value into HTML via container.html(), altering the dropdown and potentially executing script.2dCVE-2026-27321——
——0Rejected reason: Not used11dCVE-2026-1168846.1 MED—
——0SemanticMediaWiki from 5.0.0 before 7.3.1 contains a stored cross-site scripting vulnerability in ext.smw.tooltip.tippy.js that renders data-* attributes via innerHTML with allowHTML enabled. Editors can plant a .smw-highlighter span with a malicious data-content, data-title, data-top, data-bottom, or data-theme attribute to execute JavaScript when viewers, including administrators, hover it.13hCVE-2017-4744——
——0Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017. Notes: none11dCVE-2023-3483——
——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.11dCVE-2026-1168807.1 HIG—
——0Semantic MediaWiki from 3.0.0 before 7.3.1 contains a cross-site request forgery vulnerability in Special:SMWAdmin because it overwrites the wpEditToken with a freshly generated valid token. Attackers can lure an authenticated smw-admin user to a malicious page that triggers schema setup, entity-disposal, or job actions, causing semantic data loss and resource exhaustion.2d