PULSEUnderground Intel

LIVE21signals / 24h

FEED

ransomscarlettgroup reclama a nbcuniversal.com · US · Technologyransomn0n reclama a Xylanpicks · US · Not Foundransombravox reclama a GSE-M Technology Sdn. Bhd. · MY · Technologyransomemperador reclama a Bruin Group LLC · US · Otherransomsilentransomgroup reclama a M... M... · Not Foundransomsilentransomgroup reclama a P... H... · Not Foundransomglobal secret group reclama a Graves Fireplaces, Inc. · US · Manufacturingransomincransom reclama a centralrogers.com · US · Otherransomdark project reclama a Asensus Surgical · US · Healthcareransomdark project reclama a The Excalibur Group · US · Not Foundransomsilentransomgroup reclama a P...S...R... · Not Foundransomaurora reclama a Duarte Nursery, Inc. · US · Agriculture and Food Productionransomn0n reclama a 51Ridge (Newark NJ hosting/IT) · US · Technologyransombooba project reclama a Research Foundation of The City University of New York · US · Educationransomscarlettgroup reclama a nbcuniversal.com · US · Technologyransomn0n reclama a Xylanpicks · US · Not Foundransombravox reclama a GSE-M Technology Sdn. Bhd. · MY · Technologyransomemperador reclama a Bruin Group LLC · US · Otherransomsilentransomgroup reclama a M... M... · Not Foundransomsilentransomgroup reclama a P... H... · Not Foundransomglobal secret group reclama a Graves Fireplaces, Inc. · US · Manufacturingransomincransom reclama a centralrogers.com · US · Otherransomdark project reclama a Asensus Surgical · US · Healthcareransomdark project reclama a The Excalibur Group · US · Not Foundransomsilentransomgroup reclama a P...S...R... · Not Foundransomaurora reclama a Duarte Nursery, Inc. · US · Agriculture and Food Productionransomn0n reclama a 51Ridge (Newark NJ hosting/IT) · US · Technologyransombooba project reclama a Research Foundation of The City University of New York · US · Education

CVE Watch401,106 in full archive

Vulnerabilities exploitable today

16,677in current view

Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.

In KEV catalog1,754

New KEV · 24H0

Exploit Today ≥ 701,665

Distribution · last window

Critical
3,504
High
15,974
Medium
14,897
Low
1,475

Filters

Filters

Window

Severity

Flags

Vulnerabilities12,681–12,720 · 16,677

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-963509.8 CRI

——11Subscriber Privilege Escalation in Estatik <= 4.3.5 versions.21d CVE-2026-9634910.0 CRI

——14Unauthenticated Remote Code Execution (RCE) in SiteSkite <= 2.1.8 versions.21d CVE-2026-963487.5 HIG

——5Unauthenticated Broken Access Control in Bookly <= 28.2 versions.21d CVE-2026-963476.5 MED

——6Subscriber Insecure Direct Object References (IDOR) in Bookly <= 28.2 versions.21d CVE-2026-963467.6 HIG

——6Author SQL Injection in WP ERP <= 1.17.9 versions.21d CVE-2026-963457.6 HIG

——6Administrator SQL Injection in Estatik <= 4.3.5 versions.21d CVE-2026-963447.2 HIG

——9Custom role PHP Object Injection in eCommerce Product Catalog <= 3.6.0 versions.21d CVE-2026-963437.2 HIG

——9Custom role PHP Object Injection in WP ERP <= 1.17.9 versions.21d CVE-2026-963386.5 MED

——3Subscriber Cross Site Scripting (XSS) in Profile Builder <= 4.0.2 versions.21d CVE-2026-956167.5 HIG

——10An integer overflow in WSS4J's DER bounds check lets an oversized allocation pass validation. An unauthenticated attacker can send a SOAP message carrying an X.509 certificate whose SubjectKeyIdentifier extension declares a length of 0x7FFFFFFF; WSS4J decodes this while resolving the signature's key reference, before the message is authenticated, so an eleven-byte extension triggers a 2 GB allocation. Repeated requests exhaust server memory. Users are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4, which fix this issue.15d CVE-2026-955877.5 HIG

——6Unauthenticated Broken Access Control in Hostinger Migrator <= 1.0 versions.21d CVE-2026-955318.8 HIG

——12Subscriber PHP Object Injection in Conversational Forms for ChatBot <= 1.5.0 versions.21d CVE-2026-946838.8 HIG

——8Contributor PHP Object Injection in DesignSetGo <= 2.8.0 versions.21d CVE-2026-946815.9 MED

——6Unauthenticated Denial of Service Attack in WP Store Locator < 3.0.0 versions.21d CVE-2026-946788.8 HIG

——9Contributor PHP Object Injection in Go Live Update Urls <= 7.0.8 versions.21d CVE-2026-946777.2 HIG

——10Shop manager PHP Object Injection in Kadence WooCommerce Email Designer <= 1.5.19.1 versions.21d CVE-2026-946746.5 MED

——1Contributor Cross Site Scripting (XSS) in Pixel Manager for WooCommerce <= 1.69.0 versions.21d CVE-2026-946735.3 MED

——4Unauthenticated Insecure Direct Object References (IDOR) in Simply Schedule Appointments <= 1.6.12.31 versions.21d CVE-2026-946724.3 MED

——3Contributor Insecure Direct Object References (IDOR) in Safe SVG <= 2.5.0 versions.21d CVE-2026-944997.1 HIG

——6Subscriber Broken Access Control in FormGent <= 1.12.2 versions.21d CVE-2026-943899.0 CRI

——12Unauthenticated Remote Code Execution (RCE) in AcyMailing SMTP Newsletter <= 11.0.5 versions.21d CVE-2026-941787.5 HIG

——7Subscriber Privilege Escalation in Import and export users and customers <= 2.5.2 versions.21d CVE-2026-941778.5 HIG

——5Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ruben Garcia GamiPress gamipress allows Blind SQL Injection.This issue affects GamiPress: from n/a through 8.0.2.4d CVE-2026-941735.4 MED

——3Contributor Insecure Direct Object References (IDOR) in Business Directory <= 6.4.27 versions.21d CVE-2026-941237.5 HIG

——10Unauthenticated Arbitrary File Download in NextGEN Gallery <= 4.5.0 versions.21d CVE-2026-941227.2 HIG

——9Editor PHP Object Injection in Responsive Slider Gallery <= 1.5.5 versions.21d CVE-2026-941218.8 HIG

——9Contributor PHP Object Injection in 10Web Booster – Website speed optimization, Cache & Page Speed optimizer <= 2.33.6 versions.21d CVE-2026-941207.5 HIG

——6Unauthenticated Broken Access Control in GravityExport Lite for Gravity Forms <= 2.7.2 versions.21d CVE-2026-941158.5 HIG

——5Contributor SQL Injection in Easy Pricing Tables <= 4.1.2 versions.21d CVE-2026-940827.6 HIG

——6Author SQL Injection in Quiz Cat <= 3.1.1 versions.21d CVE-2026-940817.1 HIG

——2Unauthenticated Cross Site Scripting (XSS) in WordPress Persistent Login <= 3.1.3 versions.21d CVE-2026-940787.1 HIG

——3Unauthenticated Cross Site Scripting (XSS) in Site Reviews <= 8.3.1 versions.21d CVE-2026-940776.5 MED

——2Contributor Cross Site Scripting (XSS) in Safe SVG <= 2.5.0 versions.21d CVE-2026-940768.8 HIG

——8Contributor PHP Object Injection in SEO Plugin by Squirrly SEO <= 14.2.5 versions.21d CVE-2026-940746.5 MED

——3Unauthenticated Broken Access Control in Simply Schedule Appointments <= 1.6.12.29 versions.21d CVE-2026-937717.2 HIG

——9Shop manager PHP Object Injection in Cost of Goods for WooCommerce <= 3.5.2 versions.21d CVE-2026-937707.1 HIG

——3Unauthenticated Cross Site Scripting (XSS) in WP Statistics <= 14.16.13 versions.21d CVE-2026-936517.2 HIG

——9Author PHP Object Injection in Minimum and Maximum Quantity for WooCommerce <= 2.1.2 versions.21d CVE-2026-936247.2 HIG

——9Shop manager PHP Object Injection in Music Player for WooCommerce <= 1.9.1 versions.21d CVE-2026-936218.2 HIG

——5Unauthenticated SQL Injection in WP Data Access <= 5.5.84 versions.21d