CVE Watch401,106 in full archive

Vulnerabilities exploitable today

16,675in current view

Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.

In KEV catalog1,754

New KEV · 24H0

Exploit Today ≥ 701,665

Distribution · last window

Critical
3,504
High
15,968
Medium
14,895
Low
1,474

Filters

Window

Severity

Flags

Vulnerabilities12,601–12,640 · 16,675

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-1002538.8 HIG

37.3%

——11In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 sandbox escape leading to code execution was possible via the versioned settings Kotlin DSL15d CVE-2026-765709.1 CRI

37.9%

——11Joomla Extension - joomcode.com - Unauthenticated SQL injection in read and write queries in JCTables 1.21.1 - The front-end CRUD API controller performs no Joomla token validation and no authentication check on any task. Table names, column names, and values are taken directly from request parameters and concatenated into SQL queries, allowing SQLi for reading and writing queries.15d CVE-2026-1033975.6 MED

11.6%

——3OpenSave before 2.4.0-beta.1 fails to validate sender identity in WAN relay requests, allowing unpaired room members to impersonate paired devices by spoofing the RelayMessage From field. Attackers who know the room code can join, read paired peer identifiers from announcements, and send forged requests to access protected sync routes including save data, snapshots, and file operations.19d CVE-2026-1032435.8 MED

14.1%

——4LightLLM through 1.2.0 fails to validate image_url and audio_url parameters in multimodal endpoints, allowing unauthenticated attackers to perform server-side request forgery. Attackers can supply arbitrary URLs to fetch internal resources, with vision model processing disclosing content or error responses revealing internal network topology.19d CVE-2026-1032276.3 MED

43.1%

——13A weakness has been identified in GPAC up to 26.07.0. Affected by this issue is the function gf_dash_resolve_url of the file src/media_tools/dash_client.c of the component DASH Client. This manipulation causes buffer overflow. The attack is possible to be carried out remotely. Upgrading to version abi-16.26 can resolve this issue. Patch name: 4c8e26f278ff63eec57968f7bc696f604bb0cffd. It is recommended to upgrade the affected component.19d CVE-2026-1032266.3 MED

43.1%

——13A vulnerability was identified in Artifex Ghostscript up to 10.07.0. Affected is the function type1_callsubr of the file devices/vector/gdevpsfx.c of the component Pdfwrite. The manipulation leads to stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. Upgrading to version 10.08.0 is able to address this issue. It is suggested to upgrade the affected component. A solution was implemented: "I've chosen to fix this slightly differently by using the defined macro in the font parsing loop rather than in the callsubr function, because this better matches the pattern of 'normal' usage."6d CVE-2026-1031184.3 MED

20.6%

——6A vulnerability was detected in GraphicsMagick up to 1.3.47. Affected by this vulnerability is the function ExtractPostscript of the file coders/wpg.c of the component WPG File Handler. Performing a manipulation results in uncontrolled recursion. The attack may be initiated remotely. The patch is named 627b5b1b2fc2. It is suggested to install a patch to address this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.19d CVE-2026-973025.3 MED

8.9%

——3Unauthenticated Sensitive Data Exposure in MPG <= 4.2.3 versions.21d CVE-2026-973016.5 MED

6.2%

——2Contributor Cross Site Scripting (XSS) in Cool Formkit Lite <= 2.7.8 versions.9d CVE-2026-972995.4 MED

0.6%

——0Unauthenticated Cross Site Request Forgery (CSRF) in Razorpay Payment Links for WooCommerce <= 2.1.5 versions.21d CVE-2026-972986.5 MED

2.4%

——1Contributor Cross Site Scripting (XSS) in King Addons for Elementor <= 51.1.86 versions.21d CVE-2026-972938.5 HIG

15.2%

——5Contributor SQL Injection in Media LIbrary Assistant <= 3.41 versions.21d CVE-2026-972926.5 MED

2.4%

——1Author Cross Site Scripting (XSS) in YITH WooCommerce Tab Manager <= 2.15.0 versions.21d CVE-2026-972897.1 HIG

3.5%

——1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows DOM-Based XSS.This issue affects Quiz And Survey Master: from n/a through 11.2.6.12d CVE-2026-972886.5 MED

2.4%

——1Contributor Cross Site Scripting (XSS) in OAuth Server <= 4.5.1 versions.21d CVE-2026-972878.5 HIG

16.5%

——5Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Blind SQL Injection. This issue affects Event Tickets: from n/a through 5.29.5.6d CVE-2026-972866.5 MED

4.1%

——1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Strong Testimonials strong-testimonials allows Stored XSS.This issue affects Strong Testimonials: from n/a through 3.3.11.19d CVE-2026-972855.4 MED

9.3%

——3Contributor Broken Access Control in The Events Calendar <= 6.17.5 versions.21d CVE-2026-972825.3 MED

6.7%

——2Unauthenticated Insecure Direct Object References (IDOR) in Review Schema <= 3.1.0 versions.21d CVE-2026-972796.5 MED

4.1%

——1Contributor Cross Site Scripting (XSS) in Polylang <= 3.8.9 versions.21d CVE-2026-972749.8 CRI

21.5%

——6Unauthenticated Bypass Vulnerability in OAuth Single Sign On – SSO (OAuth Client) <= 7.1.2 versions.21d CVE-2026-972727.1 HIG

3.5%

——1Unauthenticated Cross Site Scripting (XSS) in Premmerce Permalink Manager for WooCommerce <= 2.3.13 versions.21d CVE-2026-972717.1 HIG

3.5%

——1Unauthenticated Cross Site Scripting (XSS) in WPFunnels <= 3.13.1 versions.21d CVE-2026-972706.5 MED

6.2%

——2Subscriber Cross Site Scripting (XSS) in CMB2 <= 2.13.0 versions.21d CVE-2026-972674.3 MED

10.9%

——3Subscriber Broken Access Control in Prevent files / folders access <= 2.6.7 versions.21d CVE-2026-972666.5 MED

2.4%

——1Contributor Cross Site Scripting (XSS) in Virtue/Ascend/Pinnacle Toolkit <= 4.9.12.1 versions.21d CVE-2026-972626.5 MED

2.4%

——1Contributor Cross Site Scripting (XSS) in Visual Composer Website Builder <= 45.16.2 versions.21d CVE-2026-972615.3 MED

8.9%

——3Unauthenticated Sensitive Data Exposure in Notivo <= 1.4.2 versions.21d CVE-2026-972537.1 HIG

3.5%

——1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kreatura LayerSlider allows Reflected XSS. This issue affects LayerSlider: from n/a through 8.4.0.21d CVE-2026-972507.1 HIG

3.5%

——1Unauthenticated Cross Site Scripting (XSS) in Geo Mashup <= 1.13.21 versions.21d CVE-2026-972495.3 MED

8.8%

——3Unauthenticated Bypass Vulnerability in Paid Member Subscriptions <= 3.0.9 versions.21d CVE-2026-972489.8 CRI

31.3%

——9Unauthenticated PHP Object Injection in Booking Activities <= 1.18.7.1 versions.21d CVE-2026-972476.5 MED

10.5%

——3Unauthenticated Broken Access Control in Blocksy Companion <= 2.1.55 versions.21d CVE-2026-972464.9 MED

11.1%

——3Deserialization of Untrusted Data vulnerability in ShortPixel ShortPixel Image Optimizer shortpixel-image-optimiser allows Object Injection.This issue affects ShortPixel Image Optimizer: from n/a through 6.5.5.21h CVE-2026-972457.2 HIG

26.3%

——8Shop Worker Privilege Escalation in SureCart <= 4.7.2 versions.21d CVE-2026-972447.5 HIG

21.1%

——6Contributor Path Traversal in Creator LMS <= 1.2.19 versions.21d CVE-2026-972435.4 MED

11.8%

——4Subscriber Broken Access Control in AllAble Connector <= 0.13.4 versions.21d CVE-2026-972426.8 MED

28.4%

——9Author Arbitrary File Deletion in WEBO MCP <= 3.0.18 versions.21d CVE-2026-972417.5 HIG

21.6%

——6Unauthenticated Sensitive Data Exposure in BackupEase <= 2.2.2 versions.21d CVE-2026-972407.5 HIG

21.6%

——6Unauthenticated Sensitive Data Exposure in StifLi Backup Tools <= 2.2.7 versions.21d