PULSE
LIVE21signals / 24h
ES
FEED
ransomnova reclama a Marpatech · Technologyransomnova reclama a Canal 9 Litoral · AR · Telecommunicationransomqilin reclama a Evergreen Title · US · Financial Servicesransomplay reclama a Tax MT · MT · Business Servicesransomplay reclama a Kreysler & Associates · US · Business Servicesransomnova reclama a La Financière d'Orion (finorion) · FR · Financial Servicesransomchaos reclama a argonautms.com · RU · Technologyransomdragonforce reclama a One Community FCU · US · Financial Servicesransomqilin reclama a RehaVital Gesundheitsservice GmbH · DE · Healthcareransomnova reclama a Tèrra Aventura · PT · Hospitality and Tourismransomnova reclama a Koperasi Karyawan PT Aplikanusa Lintasarta · ID · Telecommunicationransomakira reclama a Novasport s.r.o. · CZ · Consumer Servicesransomakira reclama a Finer & Finer · Consumer Servicesransommorpheus reclama a Kyowa Singapore Pte Ltd · SG · Business Servicesransomnova reclama a Marpatech · Technologyransomnova reclama a Canal 9 Litoral · AR · Telecommunicationransomqilin reclama a Evergreen Title · US · Financial Servicesransomplay reclama a Tax MT · MT · Business Servicesransomplay reclama a Kreysler & Associates · US · Business Servicesransomnova reclama a La Financière d'Orion (finorion) · FR · Financial Servicesransomchaos reclama a argonautms.com · RU · Technologyransomdragonforce reclama a One Community FCU · US · Financial Servicesransomqilin reclama a RehaVital Gesundheitsservice GmbH · DE · Healthcareransomnova reclama a Tèrra Aventura · PT · Hospitality and Tourismransomnova reclama a Koperasi Karyawan PT Aplikanusa Lintasarta · ID · Telecommunicationransomakira reclama a Novasport s.r.o. · CZ · Consumer Servicesransomakira reclama a Finer & Finer · Consumer Servicesransommorpheus reclama a Kyowa Singapore Pte Ltd · SG · Business Services
CVE Watch351,720 in full archive

Vulnerabilities exploitable today

8,242in current view

Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.

In KEV catalog1,651
New KEV · 24H0
Exploit Today ≥ 701,587

Distribution · last window

  • Critical
    1,750
  • High
    5,599
  • Medium
    4,484
  • Low
    405
Filters

Window

Severity

Flags

Vulnerabilities4,281–4,320 · 8,242
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-577927.5 HIG
39.4%
——12Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Dør dor allows PHP Local File Inclusion.This issue affects Dør: from n/a through <= 2.4.1.8dCVE-2026-577917.5 HIG
39.4%
——12Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Brook brook allows PHP Local File Inclusion.This issue affects Brook: from n/a through <= 2.9.0.8dCVE-2026-577907.5 HIG
39.4%
——12Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Billey billey allows PHP Local File Inclusion.This issue affects Billey: from n/a through <= 2.1.8.8dCVE-2026-577897.5 HIG
39.4%
——12Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in jwsthemes Aqua aqua allows PHP Local File Inclusion.This issue affects Aqua: from n/a through <= 5.1.2.8dCVE-2026-577887.5 HIG
39.4%
——12Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Edge-Themes Aalto aalto allows PHP Local File Inclusion.This issue affects Aalto: from n/a through <= 1.8.8dCVE-2026-577878.5 HIG
27.0%
——8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CreativeWS CWS SVGicons cws-svgicons allows Blind SQL Injection.This issue affects CWS SVGicons: from n/a through <= 1.5.5.8dCVE-2026-577868.8 HIG
6.0%
——2Cross-Site Request Forgery (CSRF) vulnerability in purethemes WorkScout-Core workscout-core allows Authentication Bypass.This issue affects WorkScout-Core: from n/a through <= 1.7.08.8dCVE-2026-577836.5 MED
12.3%
——4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in merkulove Speaker speaker allows Stored XSS.This issue affects Speaker: from n/a through <= 4.1.13.8dCVE-2026-577825.3 MED
20.6%
——6Missing Authorization vulnerability in PressTigers Universal Clocks universal-clocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Universal Clocks: from n/a through <= 1.2.0.8dCVE-2026-577815.3 MED
20.6%
——6Missing Authorization vulnerability in Sovlix MeetingHub meetinghub allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MeetingHub: from n/a through <= 1.25.10.8dCVE-2026-577806.5 MED
12.3%
——4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Plugin Envision Envision Page Builder envision-page-builder allows DOM-Based XSS.This issue affects Envision Page Builder: from n/a through <= 0.22.8dCVE-2026-577795.3 MED
20.6%
——6Missing Authorization vulnerability in themebeez Fascinate fascinate allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fascinate: from n/a through <= 1.1.5.8dCVE-2026-577785.3 MED
20.6%
——6Missing Authorization vulnerability in wpdevart Booking calendar, Appointment Booking System booking-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booking calendar, Appointment Booking System: from n/a through <= 3.2.36.8dCVE-2026-577765.3 MED
21.4%
——6Missing Authorization vulnerability in vowelweb VW Wedding vw-wedding allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VW Wedding: from n/a through <= 1.3.7.8dCVE-2026-577745.3 MED
21.4%
——6Missing Authorization vulnerability in vowelweb VW Food Corner vw-food-corner allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VW Food Corner: from n/a through <= 1.1.0.8dCVE-2026-577737.6 HIG
29.5%
——9Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Zorem Advanced Shipment Tracking for WooCommerce woo-advanced-shipment-tracking allows Blind SQL Injection.This issue affects Advanced Shipment Tracking for WooCommerce: from n/a through <= 4.0.8dCVE-2026-577728.5 HIG
16.7%
——5Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Inventory WP Inventory Manager wp-inventory-manager allows Blind SQL Injection.This issue affects WP Inventory Manager: from n/a through <= 2.4.0.8dCVE-2026-577718.5 HIG
16.7%
——5Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Milan Petrovic GD Rating System gd-rating-system allows Blind SQL Injection.This issue affects GD Rating System: from n/a through <= 3.7.8dCVE-2026-577709.8 CRI
23.5%
——7Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Photography grandphotography allows Object Injection.This issue affects Grand Photography: from n/a through <= 5.7.8.8dCVE-2026-577688.2 HIG
13.6%
——4Incorrect Privilege Assignment vulnerability in favethemes Houzez Login Register houzez-login-register allows Privilege Escalation.This issue affects Houzez Login Register: from n/a through <= 3.3.3.8dCVE-2026-577457.1 HIG
7.8%
——2Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in stmcan RT-Theme 18 | Extensions rt18-extensions allows Reflected XSS.This issue affects RT-Theme 18 | Extensions: from n/a through <= 2.5.8dCVE-2026-577449.8 CRI
23.5%
——7Deserialization of Untrusted Data vulnerability in stmcan RT-Theme 18 | Extensions rt18-extensions allows Object Injection.This issue affects RT-Theme 18 | Extensions: from n/a through <= 2.5.8dCVE-2026-577438.1 HIG
33.8%
——10Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in stmcan RT-Theme 18 | Extensions rt18-extensions allows PHP Local File Inclusion.This issue affects RT-Theme 18 | Extensions: from n/a through <= 2.5.8dCVE-2026-577417.1 HIG
7.8%
——2Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AcyMailing Newsletter Team AcyMailing SMTP Newsletter acymailing allows Stored XSS.This issue affects AcyMailing SMTP Newsletter: from n/a through <= 10.11.0.8dCVE-2026-577407.1 HIG
13.3%
——4Missing Authorization vulnerability in AcyMailing Newsletter Team AcyMailing SMTP Newsletter acymailing allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AcyMailing SMTP Newsletter: from n/a through <= 10.11.1.8dCVE-2026-577399.3 CRI
21.2%
——6Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AcyMailing Newsletter Team AcyMailing SMTP Newsletter acymailing allows Blind SQL Injection.This issue affects AcyMailing SMTP Newsletter: from n/a through <= 10.11.0.8dCVE-2026-577389.8 CRI
31.0%
——9Deserialization of Untrusted Data vulnerability in axiomthemes 777 triple-seven allows Object Injection.This issue affects 777: from n/a through <= 1.13.0.8dCVE-2026-577347.1 HIG
7.8%
——2Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tagDiv tagDiv Composer td-composer allows Reflected XSS.This issue affects tagDiv Composer: from n/a through <= 5.4.3.8dCVE-2026-577337.1 HIG
7.8%
——2Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tagDiv tagDiv Cloud Library td-cloud-library allows DOM-Based XSS.This issue affects tagDiv Cloud Library: from n/a through <= 3.9.4.8dCVE-2026-577327.1 HIG
7.8%
——2Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tagDiv tagDiv Opt-In Builder td-subscription allows DOM-Based XSS.This issue affects tagDiv Opt-In Builder: from n/a through <= 1.7.4.8dCVE-2026-577297.5 HIG
20.7%
——6Missing Authorization vulnerability in UX-themes Flatsome flatsome allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Flatsome: from n/a through <= 3.20.5.8dCVE-2026-577287.1 HIG
7.8%
——2Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in UX-themes Flatsome flatsome allows Reflected XSS.This issue affects Flatsome: from n/a through <= 3.20.5.8dCVE-2026-577277.5 HIG
20.7%
——6Missing Authorization vulnerability in Themeum Kirki kirki allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kirki: from n/a through <= 6.0.13.8dCVE-2026-577269.3 CRI
21.2%
——6Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum Kirki kirki allows Blind SQL Injection.This issue affects Kirki: from n/a through <= 6.0.12.8dCVE-2026-577257.1 HIG
7.8%
——2Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Kirki kirki allows Stored XSS.This issue affects Kirki: from n/a through <= 6.0.11.8dCVE-2026-577249.8 CRI
31.0%
——9Deserialization of Untrusted Data vulnerability in Themeum Kirki kirki allows Object Injection.This issue affects Kirki: from n/a through <= 6.0.12.8dCVE-2026-5771910.0 CRI
28.1%
——8Unrestricted Upload of File with Dangerous Type vulnerability in CodeRevolution Aimogen Pro aimogen-pro allows Using Malicious Files.This issue affects Aimogen Pro: from n/a through <= 2.8.3.8dCVE-2026-577187.1 HIG
7.8%
——2Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Reflected XSS.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through <= 2.0.12.8dCVE-2026-577157.1 HIG
7.8%
——2Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPManageNinja Fluent CRM fluent-crm allows Reflected XSS.This issue affects Fluent CRM: from n/a through <= 3.1.7.8dCVE-2026-577149.3 CRI
21.2%
——6Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LatePoint LatePoint latepoint allows Blind SQL Injection.This issue affects LatePoint: from n/a through <= 5.6.3.8d