CVE Watch402,410 in full archive

Vulnerabilities exploitable today

16,726in current view

Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.

In KEV catalog1,754

New KEV · 24H0

Exploit Today ≥ 701,668

Distribution · last window

Critical
3,545
High
15,903
Medium
14,814
Low
1,453

Filters

Window

Severity

Flags

Vulnerabilities9,761–9,800 · 16,726

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-427128.5 HIG

26.5%

——8Subscriber SQL Injection in Qode Tours <= 3.1.3.2 versions.10d CVE-2026-427117.1 HIG

7.2%

——2Unauthenticated Cross Site Scripting (XSS) in Slider by 10Web <= 1.2.63 versions.10d CVE-2026-427097.1 HIG

7.2%

——2Unauthenticated Cross Site Scripting (XSS) in Food Menu – Restaurant Menu & Online Ordering for WooCommerce <= 6.0.5 versions.10d CVE-2026-427067.5 HIG

14.9%

——4Unauthenticated Broken Access Control in DK <= 3.2.1 versions.10d CVE-2026-427057.5 HIG

14.9%

——4Unauthenticated Broken Access Control in Grand News <= 3.4 versions.10d CVE-2026-427048.1 HIG

27.2%

——8Unauthenticated Local File Inclusion in Kids Care <= 3.2.4 versions.10d CVE-2026-427027.1 HIG

7.2%

——2Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Tutor LMS tutor allows Reflected XSS.This issue affects Tutor LMS: from n/a through 4.1.0.10d CVE-2026-426997.1 HIG

7.2%

——2Unauthenticated Cross Site Scripting (XSS) in FV Player 8 <= 8.1.8 versions.10d CVE-2026-426977.1 HIG

7.2%

——2Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Inisev Social Share Icons & Social Share Buttons ultimate-social-media-plus allows Reflected XSS.This issue affects Social Share Icons & Social Share Buttons: from n/a through 3.7.5.10d CVE-2026-4269610.0 CRI

31.6%

——9Improper Control of Generation of Code ('Code Injection') vulnerability in Royal Plugins SiteVault – Backup, Restore, Migration & Cloning sitevault-backup-restore-migration allows Remote Code Inclusion.This issue affects SiteVault – Backup, Restore, Migration & Cloning: from n/a through 1.5.19.10d CVE-2026-426937.1 HIG

7.2%

——2Unauthenticated Cross Site Scripting (XSS) in Jannah <= 7.6.5 versions.10d CVE-2026-426338.5 HIG

26.5%

——8Subscriber SQL Injection in Events Manager <= 7.4.6 versions.10d CVE-2026-426327.1 HIG

7.2%

——2Unauthenticated Cross Site Scripting (XSS) in Qode Real Estate <= 1.1.7.3 versions.10d CVE-2026-426317.1 HIG

7.2%

——2Unauthenticated Cross Site Scripting (XSS) in Qode Music <= 2.1.8.2 versions.10d CVE-2026-426307.5 HIG

21.8%

——7Unauthenticated Sensitive Data Exposure in Web Plura Backup & Restore Manager <= 0.2.25 versions.10d CVE-2026-424195.9 MED

16.4%

——5Unauthenticated Sensitive Data Exposure in Swish Migrate and Backup <= 1.4.0 versions.10d CVE-2026-408086.5 MED

19.3%

——6Subscriber Broken Access Control in Jetpack VideoPress <= 3.6 versions.10d CVE-2026-408057.7 HIG

38.1%

——11Subscriber Arbitrary File Deletion in PeepSo <= 9.0.5.4 versions.10d CVE-2026-408037.1 HIG

7.2%

——2Unauthenticated Cross Site Scripting (XSS) in Jotform – AI Chatbot <= 3.8.2 versions.10d CVE-2026-408027.6 HIG

20.7%

——6Subscriber Settings Change in Pubjet | پاب‌جت <= 5.4.8 versions.10d CVE-2026-408018.1 HIG

24.5%

——7Subscriber Broken Access Control in Wordable <= 8.2.10 versions.10d CVE-2026-408009.3 CRI

31.2%

——9Subscriber SQL Injection in ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes <= 1.5.3 versions.10d CVE-2026-407778.1 HIG

27.7%

——8Subscriber Broken Access Control in WPSection <= 1.5.1 versions.10d CVE-2026-398028.1 HIG

39.0%

——12Unauthenticated Remote Code Execution (RCE) in Everest Backup <= 2.3.13 versions.10d CVE-2026-398019.8 CRI

38.1%

——11Subscriber Privilege Escalation in AIWU <= 1.5.9 versions.10d CVE-2026-398007.1 HIG

7.2%

——2Unauthenticated Cross Site Scripting (XSS) in Additional Order Filters for WooCommerce <= 1.24 versions.10d CVE-2026-397997.1 HIG

7.2%

——2Unauthenticated Cross Site Scripting (XSS) in WP File Download <= 6.3.6 versions.10d CVE-2026-273507.2 HIG

4.7%

——1Server-Side Request Forgery (SSRF) vulnerability in Builderius.io Builderius allows Server Side Request Forgery. This issue affects Builderius: from 1.4 through 1.4-beta.10d CVE-2026-1086046.3 MED

2.5%

——1Tabularis through 0.27.0 contains an incorrect authorization vulnerability in the MCP run_query safety gate that allows prompt-injected agents or untrusted MCP clients to bypass read-only mode by submitting side-effecting SELECT statements. Attackers can run statements like SELECT setval, nextval, or PostgreSQL query_to_xml with embedded DELETE to modify data without approval prompts.7d CVE-2026-1086033.3 LOW

3.2%

——1slide-maker through 5.8.0 contains a path traversal vulnerability in generate_images_openai.py that allows attackers to write image files outside the output directory via manifest-supplied filenames. Attackers can influence deck source material so the image prompt manifest contains ../ or symlinked filenames, creating directories and overwriting existing files at arbitrary paths.7d CVE-2026-1086024.3 MED

11.0%

——3Helicone through v2025.08.21-1 contains a server-side request forgery vulnerability in the Jawn webhook sender that allows authenticated organization users to reach internal services by using hostnames resolving to private addresses. Attackers can create webhooks with public hostnames that resolve or DNS-rebind to loopback or internal addresses, causing blind POST requests to internal HTTPS services.5d CVE-2026-1074345.4 MED

17.5%

——5Subscriber Bypass Vulnerability in MicroPayments <= 3.2.9 versions.10d CVE-2026-1074205.3 MED

1.9%

——1Unauthenticated Bypass Vulnerability in Pay With MetaMask For WooCommerce – Cryptocurrency Payment Gateway <= 1.7.2 versions.10d CVE-2026-1036854.3 MED

7.7%

——2Missing Authorization vulnerability in VillaTheme ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce woo-alidropship allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce: from n/a through 2.2.4.10d CVE-2026-963418.2 HIG

19.2%

——6Incorrect Privilege Assignment vulnerability in WPMU DEV Forminator forminator allows Privilege Escalation.This issue affects Forminator: from n/a through 1.57.3.10d CVE-2026-945906.5 MED

8.6%

——3Improper Verification of Source of a Communication Channel vulnerability in CodePeople2 Sell Downloads sell-downloads allows Exploitation of Trusted Credentials.This issue affects Sell Downloads: from n/a through 1.2.3.10d CVE-2026-578067.1 HIG

7.2%

——2Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in drfuri Martfury - WooCommerce Marketplace WordPress Theme martfury allows Reflected XSS.This issue affects Martfury - WooCommerce Marketplace WordPress Theme: from n/a through 3.3.9.10d CVE-2026-1086004.7 MED

3.7%

——1open-multi-agent (@open-multi-agent/core) 1.5.0 through 1.21.2 contains a link following vulnerability in the file_write tool sandbox that allows attackers to create files outside the workspace root by using dangling symlinks. Attackers can plant a dangling symlink in the workspace and steer the agent via prompt injection to write attacker-influenced content anywhere the agent process can write.7d CVE-2026-1085994.7 MED

6.3%

——2phi 0.1.1 through 0.28.4 contains an improper link resolution vulnerability that allows malicious repositories to bypass workspace_only_writes by exploiting lexical-only path checks in the permission gate. Attackers can commit symlinks pointing outside the workspace and use prompt injection to make the write tool write attacker-influenced content to external files without approval.7d CVE-2026-1085989.8 CRI

53.8%

——16Floci 1.1.0 before 2.2.0 contains a code injection vulnerability in VtlTemplateEngine that allows unauthenticated attackers to execute commands via unrestricted Velocity mapping templates. Attackers can create a REST API with a MOCK integration whose template uses $util reflection to reach Runtime or ProcessBuilder, executing OS commands in the Floci JVM.7d