Vulnerabilities exploitable today
379,124in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,721
New KEV · 24H0
Exploit Today ≥ 701,654
Distribution · last window
- Critical2,385
- High8,590
- Medium7,035
- Low793
Filters
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-26336—34.6%
——10——CVE-2026-48512—34.6%
——10——CVE-2026-55661—34.6%
——10Tina is a headless content management system. In versions prior to @tinacms/mdx 2.1.7 and tinacms 3.9.3, rich-text parsing and the default link/image renderers did not sanitize the url field on Slate link/image nodes. Content containing javascript: or data:text/html URLs — including case-variant, whitespace-padded, and control-character-obfuscated forms — is rendered into href/src and executes when the content is viewed. Any actor able to author rich-text content (for example a lower-privileged editor, or imported/external content) can achieve stored XSS against editors and site viewers. This issue is fixed in versions @tinacms/mdx 2.1.7 and tinacms 3.9.3.79dCVE-2024-54039—34.6%
——10——CVE-2023-1602—34.6%
——10——CVE-2026-831049.1 CRI34.5%
——10Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Forms Services, C/S, Charmode). Supported versions that are affected are 12.2.1.19.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Forms. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Forms accessible data as well as unauthorized access to critical data or complete access to all Oracle Forms accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).6hCVE-2024-1533—34.5%
——10——CVE-2010-4668—34.5%
——10——CVE-2025-7054—34.5%
——10——CVE-2023-5352—34.5%
——10——CVE-2026-28456—34.5%
——10——CVE-2026-624149.1 CRI34.5%
——10Joomla Extension - joomlack.fr - Improper access control in Page Builder CK < 3.6.2 - The Joomla extension Page Builder CK does not properly apply access control to frontend page list views.62dCVE-2025-9847—34.5%
——10——CVE-2025-60199—34.5%
——10——CVE-2023-36509—34.5%
——10——CVE-2025-0332—34.5%
——10——CVE-2018-1957—34.5%
——10——CVE-2026-323055.3 MED34.5%
——10Traefik is an HTTP reverse proxy and load balancer. Versions 2.11.40 and below, 3.0.0-beta1 through 3.6.11, and 3.7.0-ea.1 are vulnerable to mTLS bypass through the TLS SNI pre-sniffing logic related to fragmented ClientHello packets. When a TLS ClientHello is fragmented across multiple records, Traefik's SNI extraction may fail with an EOF and return an empty SNI. The TCP router then falls back to the default TLS configuration, which does not require client certificates by default. This allows an attacker to bypass route-level mTLS enforcement and access services that should require mutual TLS authentication. This issue is patched in versions 2.11.41, 3.6.11 and 3.7.0-ea.2.71dCVE-2026-46949—34.5%
——10——CVE-2025-64287—34.5%
——10——CVE-2025-55619—34.5%
——10——CVE-2024-11282—34.5%
——10——CVE-2024-0698—34.5%
——10——CVE-2022-29439—34.5%
——10——CVE-2024-10397—34.5%
——10——CVE-2026-117258.8 HIG34.5%
——10IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to an integer overflow in MQINQ request processing.1dCVE-2025-2877—34.5%
——10——CVE-2025-59268—34.5%
——10——CVE-2025-31550—34.5%
——10——CVE-2026-150899.1 CRI34.5%
——10Vulnerability in Drupal Commerce guest registration. This issue affects Commerce guest registration versions: *.*.29dCVE-2025-64373—34.5%
——10——CVE-2026-31225—34.5%
——10——CVE-2025-0353—34.5%
——10——CVE-2025-6326—34.5%
——10——CVE-2026-581559.3 CRI34.5%
——10Apache Traffic Server truncates over-long header names, allowing header aliasing, request smuggling, and policy bypass.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.
Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.51dCVE-2025-64377—34.5%
——10——CVE-2026-62143—34.5%
——10A Server-Side Request Forgery (SSRF) protection bypass existed in the html_to_markdown expansion module of misp-modules.
The module attempts to prevent requests to loopback, private, link-local, and other restricted IP address ranges. However, IP addresses were compared against the blocked ranges without first normalising IPv4-mapped IPv6 addresses.
An authenticated attacker able to invoke the module could supply an IPv4-mapped IPv6 address, such as:
http://[::ffff:127.0.0.1]/
http://[::ffff:169.254.169.254]/
Alternatively, the attacker could use a hostname that resolves to an IPv4-mapped IPv6 address. These addresses were treated as IPv6 addresses and therefore did not match the corresponding blocked IPv4 ranges.
Successful exploitation could cause the misp-modules server to connect to services available through its loopback interface, internal network, or link-local network. This could expose internal web services, administrative interfaces, or cloud instance metadata, with retrieved content potentially returned to the attacker as converted Markdown.
The vulnerability has been addressed by normalising IPv4-mapped IPv6 addresses to their underlying IPv4 representation before applying the blocked-range checks. URLs without a valid hostname are now also rejected.71dCVE-2026-739169.1 CRI34.5%
——10Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions that are affected are 3.0.0-3.2.17. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Helidon accessible data as well as unauthorized access to critical data or complete access to all Helidon accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).27dCVE-2023-26107—34.5%
——10——CVE-2019-14563—34.5%
——10——