Vulnerabilities exploitable today
16,637in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,754
New KEV · 24H0
Exploit Today ≥ 701,665
Distribution · last window
- Critical3,493
- High15,884
- Medium14,818
- Low1,466
Filters
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-965417.5 HIG55.7%
——17A denial-of-service flaw was found in gnome-remote-desktop. An unauthenticated remote attacker can open RDP connections without completing the handshake and retain the connection-throttling slots indefinitely because no pre-authentication handshake deadline is enforced. By exhausting the global connection limit, an attacker can prevent new RDP clients from connecting until a holding socket is closed.7dCVE-2026-956047.5 HIG25.0%
——8Unauthenticated Broken Access Control in Loops & Logic <= 4.2.4 versions.28dCVE-2026-956037.2 HIG32.4%
——10Shop manager PHP Object Injection in Reycob Product Import Export <= 2.3.0 versions.28dCVE-2026-956026.5 MED18.9%
——6Authorization Bypass Through User-Controlled Key vulnerability in YITH YITH WooCommerce Request A Quote allows Exploiting Incorrectly Configured Access Control Security Levels.
This issue affects YITH WooCommerce Request A Quote: from n/a before 4.46.1.28dCVE-2026-956019.3 CRI15.0%
——5Unauthenticated SQL Injection in Product Filter by WBW <= 3.1.7 versions.28dCVE-2026-956005.3 MED15.4%
——5Unauthenticated Sensitive Data Exposure in TrustedLogin Connector <= 2.0.3 versions.28dCVE-2026-955937.6 HIG20.4%
——6Editor SQL Injection in Ultimeter <= 3.0.8 versions.28dCVE-2026-955925.3 MED13.9%
——4Unauthenticated Insecure Direct Object References (IDOR) in Team <= 6.0.0 versions.28dCVE-2026-955907.1 HIG19.8%
——6Subscriber SQL Injection in Tainacan <= 1.2.0 versions.28dCVE-2026-955866.5 MED4.9%
——1Contributor Cross Site Scripting (XSS) in Ultimate Addons for Contact Form 7 <= 3.5.50 versions.28dCVE-2026-955306.5 MED10.8%
——3Subscriber Cross Site Scripting (XSS) in PixelYourSite – Your smart PIXEL (TAG) Manager <= 11.4.1 versions.28dCVE-2026-955297.1 HIG7.1%
——2Unauthenticated Cross Site Scripting (XSS) in Calculated Fields Form <= 5.5.1.1 versions.28dCVE-2026-955287.1 HIG7.1%
——2Unauthenticated Cross Site Scripting (XSS) in Core Web Vitals & PageSpeed Booster <= 1.0.31 versions.28dCVE-2026-955276.5 MED15.8%
——5Unauthenticated Broken Access Control in Conekta Payment Gateway <= 6.2.4 versions.28dCVE-2026-955256.5 MED39.3%
——12Subscriber Arbitrary File Deletion in WP User Frontend <= 4.3.11 versions.28dCVE-2026-955245.3 MED15.3%
——5Unauthenticated Bypass Vulnerability in WP User Frontend <= 4.3.11 versions.28dCVE-2026-955236.5 MED25.4%
——8Subscriber Bypass Vulnerability in WP User Frontend <= 4.3.11 versions.28dCVE-2026-955227.6 HIG20.4%
——6Shop manager SQL Injection in Easy Digital Downloads <= 3.7.0 versions.28dCVE-2026-955157.1 HIG7.1%
——2Unauthenticated Cross Site Scripting (XSS) in Ninja Forms <= 3.15.3 versions.28dCVE-2026-955145.3 MED15.3%
——5Unauthenticated Bypass Vulnerability in Netgsm <= 2.10.0 versions.28dCVE-2026-955137.5 HIG17.1%
——5Unauthenticated Broken Access Control in Online Booking & Scheduling Calendar for WordPress by vcita <= 4.6.0 versions.28dCVE-2026-94684—5.8%
——2Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. False positive detection.20dCVE-2026-946826.5 MED6.1%
——2Contributor Cross Site Scripting (XSS) in Podcast Importer SecondLine <= 1.5.6 versions.28dCVE-2026-946806.5 MED6.1%
——2Contributor Cross Site Scripting (XSS) in The Post Grid <= 7.9.5 versions.28dCVE-2026-946795.4 MED13.0%
——4Subscriber Broken Access Control in Fluent Support <= 2.3.2 versions.28dCVE-2026-946716.5 MED6.1%
——2Contributor Cross Site Scripting (XSS) in The Post Grid <= 7.9.5 versions.28dCVE-2026-945006.5 MED6.1%
——2Contributor Cross Site Scripting (XSS) in ElementsKit Elementor addons Lite <= 4.0.5 versions.28dCVE-2026-944986.5 MED14.4%
——4Unauthenticated Broken Access Control in AppMySite <= 3.15.4 versions.28dCVE-2026-944878.1 HIG2.4%
——1Unauthenticated Cross Site Request Forgery (CSRF) in PublishPress Capabilities <= 2.50.1 versions.28dCVE-2026-944616.5 MED6.1%
——2Contributor Cross Site Scripting (XSS) in Ditty <= 3.1.69 versions.28dCVE-2026-944574.8 MED8.4%
——3Unauthenticated Bypass Vulnerability in Captcha Code <= 3.32 versions.28dCVE-2026-943916.5 MED6.1%
——2Contributor Cross Site Scripting (XSS) in Ultimate FAQ <= 2.4.14 versions.28dCVE-2026-941817.4 HIG16.7%
——5An address bar spoofing issue in affected versions of Arc could allow an attacker to spoof the browser address bar via a <select> element that triggers requestFullscreen without displaying the fullscreen notification.27dCVE-2026-941797.1 HIG8.3%
——2Unauthenticated Cross Site Scripting (XSS) in Razorpay Payment Button <= 2.4.9 versions.28dCVE-2026-941767.1 HIG8.3%
——2Unauthenticated Cross Site Scripting (XSS) in Mang Board WP <= 2.4.1 versions.28dCVE-2026-941747.6 HIG20.4%
——6Administrator SQL Injection in Email Log <= 2.63 versions.28dCVE-2026-941686.5 MED6.1%
——2Contributor Cross Site Scripting (XSS) in Premium Addons for Elementor <= 4.11.105 versions.28dCVE-2026-941248.5 HIG11.8%
——4Contributor SQL Injection in WP EasyCart <= 5.9.4 versions.28dCVE-2026-941186.5 MED6.1%
——2Contributor Cross Site Scripting (XSS) in Premium Blocks – Gutenberg Blocks for WordPress <= 2.3.17 versions.28dCVE-2026-940805.3 MED12.2%
——4Unauthenticated Broken Access Control in MarketKing <= 2.1.70 versions.28d