PULSE
ES
FEED
ransomsilentransomgroup reclama a M... C... · Not Foundransomqilin reclama a United Restaurant Supply · US · Hospitalityransombravox reclama a AMSAM · FR · Not Foundransombravox reclama a Barrow & Grimm · US · Not Foundransomsilentransomgroup reclama a M...r · Not Foundransomsilentransomgroup reclama a Kirkland & Ellis LLP · US · Professional Servicesransomakira reclama a Bethany Press International · Retail & E-Commerceransomakira reclama a Medienwerkstatt · DE · Educationransomakira reclama a Annapath · Not Foundransomrhysida reclama a DR.SCHNELL GmbH & Co. KGaA · DE · Manufacturingransomqilin reclama a Airtificial · Technologyransomqilin reclama a Bathurst RSL · AU · Hospitalityransomqilin reclama a Creative Universe · AU · Otherransomeverest reclama a PWC · GB · Professional Servicesransomsilentransomgroup reclama a M... C... · Not Foundransomqilin reclama a United Restaurant Supply · US · Hospitalityransombravox reclama a AMSAM · FR · Not Foundransombravox reclama a Barrow & Grimm · US · Not Foundransomsilentransomgroup reclama a M...r · Not Foundransomsilentransomgroup reclama a Kirkland & Ellis LLP · US · Professional Servicesransomakira reclama a Bethany Press International · Retail & E-Commerceransomakira reclama a Medienwerkstatt · DE · Educationransomakira reclama a Annapath · Not Foundransomrhysida reclama a DR.SCHNELL GmbH & Co. KGaA · DE · Manufacturingransomqilin reclama a Airtificial · Technologyransomqilin reclama a Bathurst RSL · AU · Hospitalityransomqilin reclama a Creative Universe · AU · Otherransomeverest reclama a PWC · GB · Professional Services
CVE Watch401,677 in full archive

Vulnerabilities exploitable today

16,537in current view

Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.

In KEV catalog1,754
New KEV · 24H0
Exploit Today ≥ 701,666

Distribution · last window

  • Critical
    3,401
  • High
    15,534
  • Medium
    14,799
  • Low
    1,422
Filters
Filters

Window

Severity

Flags

Vulnerabilities11,641–11,680 · 16,537
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-973037.6 HIG
15.0%
——5Missing Authorization vulnerability in Apps Mav Scratch & Win – Giveaways and Contests scratch-win-giveaways-for-website-facebook allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Scratch & Win – Giveaways and Contests: from n/a through 3.0.2.16dCVE-2026-972839.8 CRI
28.0%
——8Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP Advanced Post Manager advanced-post-manager allows Object Injection.This issue affects Advanced Post Manager: from n/a through 4.5.5.16dCVE-2026-972755.3 MED
8.6%
——3Improper Validation of Specified Quantity in Input vulnerability in VillaTheme BuildKit – Product Builder for WooCommerce – Custom PC Builder woo-product-builder allows Input Data Manipulation.This issue affects BuildKit – Product Builder for WooCommerce – Custom PC Builder: from n/a through 1.0.28.16dCVE-2026-97070—
17.4%
——5Authorization Bypass Through User-Controlled Key vulnerability in CozyThemes Cozy Blocks cozy-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cozy Blocks: from n/a through 2.2.23.16dCVE-2026-951665.4 MED
2.9%
——1In Bacularis v1.0.0 - 6.5.1 when adding a new pool, the LabelFormat field allows for a Cross Site Scripting (XSS) payload.16dCVE-2026-951656.1 MED
4.2%
——1Bacularis 5.4.0 - 6.5.1 is vulnerable to Cross Site Scripting (XSS) in the Organization name field.16dCVE-2026-884249.8 CRI
19.3%
——6FineAdmin v1.0 was discovered to contain a SQL injection vulnerability via the field/order parameter at ButtonService.GetListByFilter(). This vulnerability allows attackers to access sensitive database information via crafted SQL statements.16dCVE-2026-588807.0 HIG
0.0%
——0In handle_app_val_response of btif_rc.cc, there is a possible way to achieve code execution due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.15dCVE-2026-588657.5 HIG
12.2%
——4In multiple functions of PduParser.java, there is a possible persistent denial of service due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.15dCVE-2026-588597.8 HIG
0.0%
——0In multiple places, there is a possible denial of service due to an uncaught exception. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.15dCVE-2026-588563.3 LOW
0.0%
——0In returnOutputBufferLocked of DeprecatedCamera3StreamSplitter.cpp, there is a possible out-of-bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.15dCVE-2026-588547.8 HIG
0.0%
——0In multiple locations, there is a possible memory corruption due to type confusion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.15dCVE-2026-588417.8 HIG
0.0%
——0In multiple functions of VirtualAudioControllerTest.java, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.15dCVE-2026-588358.8 HIG
14.0%
——4In cfg2prop of btif_storage.cc, there is a possible out-of-bounds write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.15dCVE-2026-588345.5 MED
0.0%
——0In setPermissionGrantState of DevicePolicyManagerService.java, there is a possible persistent denial of service due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.15dCVE-2026-588157.8 HIG
0.1%
——0In multiple locations, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.15dCVE-2026-552867.8 HIG
0.1%
——0In stpropnci_process of stpropnci.cc, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.15dCVE-2026-552808.8 HIG
13.1%
——4In multiple locations, there is a possible out-of-bounds write due to uninitialized data. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.15dCVE-2026-552707.8 HIG
0.0%
——0In dialInternal in multiple locations, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.15dCVE-2026-552697.8 HIG
0.1%
——0In FilterCapturedPacket of snoop_logger.cc, there is a possible memory safety issue due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.15dCVE-2026-552667.8 HIG
0.1%
——0In qsort of libufdt_sysdeps_vendor.c, there is a possible out-of-bounds write due to resource exhaustion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.15dCVE-2026-552656.5 MED
15.9%
——5In multiple functions of PduParser.java, there is a possible out of bounds read due to a missing bounds check. This could lead to a remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.15dCVE-2026-499377.8 HIG
0.1%
——0In multiple functions of MessageQueueBase.h, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.15dCVE-2026-499337.8 HIG
0.1%
——0In handle_le_monitor_device_event of msft.cc, there is a possible control-flow hijack in the privileged bluetooth process due to an uninitialized pointer dereference. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.16dCVE-2026-498857.8 HIG
0.1%
——0In rw_t4t_update_file of rw_t4t.cc, there is a possible out-of-bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.16dCVE-2026-498807.8 HIG
0.1%
——0In multiple functions of nfa_nfcee_act.cc, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.16dCVE-2026-498787.2 HIG
20.2%
——6In wpas_handle_robust_av_scs_recv_action of robust_av.c, there is a possible out-of-bounds write due to a logic error in the code. This could lead to remote code execution with System execution privileges needed. User interaction is not needed for exploitation.16dCVE-2026-455248.8 HIG
0.1%
——0In isSystem of WifiPermissionsUtil.java, there is a possible sandbox escape due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.16dCVE-2026-286675.5 MED
0.0%
——0In multiple functions of rw_t5t.cc, there is a possible out-of-bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.16dCVE-2026-286487.8 HIG
0.0%
——0In Settings, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.16dCVE-2026-286477.8 HIG
0.0%
——0In updateState of DeviceAdminAppsPreferenceController.java, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.16dCVE-2026-286417.8 HIG
0.0%
——0In shouldDisableUninstallButton of ApplicationActionButtonsPreferenceController.java, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.16dCVE-2026-286407.8 HIG
0.1%
——0In checkCallerIsCertInstallerOrSelfInProfile of CredentialStorageActivity.java, there is a possible permission bypass due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.16dCVE-2026-286257.8 HIG
0.0%
——0In multiple locations, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.16dCVE-2026-1057123.6 LOW
1.9%
——1gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive. When extracting an untrusted archive with --directory (aka -C) into an existing directory containing a pre-existing symlink, gpgtar can follow that symlink and create or overwrite a file outside the selected extraction directory. The write is limited by the extraction user's filesystem permissions. An archive extracted into a fresh empty directory does not have this risk.16dCVE-2026-1056464.9 MED
24.4%
——7Ghost is a Node.js content management system. From 4.0.0 until 6.67.0, a crafted content import file could cause excessive CPU usage, making the Ghost server unresponsive. Exploiting this requires Administrator access. This issue is fixed in version 6.67.0.15dCVE-2026-1056454.9 MED
24.4%
——7Ghost is a Node.js content management system. From 5.37.0 until 6.67.0, a crafted request to the external media inliner could cause excessive CPU usage, making the Ghost server unresponsive. Exploiting this requires Administrator access. This issue is fixed in version 6.67.0.16dCVE-2026-1056446.8 MED
23.7%
——7Ghost is a Node.js content management system. From 4.0.0 until 6.67.0, SVG images included in content imports were stored without sanitization. An attacker who convinced an Administrator to import a crafted file could host scripts on the site's domain, possibly resulting in compromise of staff users' admin sessions. This issue is fixed in version 6.67.0.16dCVE-2026-1056437.3 HIG
18.3%
——5Ghost is a Node.js content management system. From version 6.34.0 until 6.67.0, embed cards in the Ghost editor could bypass protections against stored cross-site scripting. Any staff user, including Contributors, could store scripts in post content that ran when another staff user opened the post in the editor, potentially compromising that user’s admin session. Self-hosted sites should leave the new  security.embedPreviewUrl  configuration option at its default value. This issue is fixed in version 6.67.0.16dCVE-2026-1056428.8 HIG
15.6%
——5Ghost is a Node.js content management system. From 6.56.0 until 6.67.0, an image processing library bundled with Ghost contained a vulnerability in its SVG handling. Any staff user, including Contributors, could create a bookmark card for an attacker-controlled website, resulting in arbitrary commands being run on the Ghost server. This issue is fixed in version 6.67.0.16d