Vulnerabilities exploitable today
378,377in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,717
New KEV · 24H0
Exploit Today ≥ 701,649
Distribution · last window
- Critical2,326
- High8,522
- Medium6,833
- Low770
Filters
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2024-51805—32.9%
——10——CVE-2024-51795—32.9%
——10——CVE-2026-183669.8 CRI32.9%
——10The Events Manager WordPress plugin before 7.4.1 does not properly scope its capability mapping, discarding the access control decisions WordPress already made for unrelated privileged actions, which allows unauthenticated users to change the password of, escalate to Administrator, or delete any account whose user ID happens to match the ID of one of the Events Manager WordPress plugin before 7.4.1's own posts.27dCVE-2018-9334—32.9%
——10——CVE-2024-1157—32.9%
——10——CVE-2024-50514—32.9%
——10——CVE-2026-34245.3 MED32.9%
——10The The kk Star Ratings – Rate Post & Collect User Feedbacks plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.4.10.3. This is due to the software allowing users to execute an action that does not properly validate the 'payload' value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.27dCVE-2024-51847—32.9%
——10——CVE-2024-54318—32.9%
——10——CVE-2024-32062—32.9%
——10——CVE-2010-3079—32.9%
——10——CVE-2026-42378—32.9%
——10——CVE-2024-50839—32.9%
——10——CVE-2025-59098—32.9%
——10——CVE-2025-9686—32.9%
——10——CVE-2026-51302—32.9%
——10Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.53dCVE-2009-1990—32.9%
——10——CVE-2024-41252—32.9%
——10——CVE-2024-51821—32.9%
——10——CVE-2024-24256—32.9%
——10——CVE-2024-51839—32.9%
——10——CVE-2026-142517.7 HIG32.9%
——10A flaw was found in the OpenShift GitOps operator. The ClusterRole reconciler does not validate resource ownership when reconciling ClusterRole objects. A namespace-scoped Argo CD instance can trigger deletion of a ClusterRole owned by a cluster-scoped Argo CD instance by crafting a name collision, resulting in a denial of service.68dCVE-2024-10580—32.9%
——10——CVE-2016-20080—32.9%
——10——CVE-2024-39097—32.9%
——10——CVE-2017-3301—32.9%
——10——CVE-2017-7066—32.9%
——10——CVE-2026-95177.3 HIG32.9%
——10A vulnerability was determined in hemant6488 CodeIgniter-StudentManagementSystem. The affected element is an unknown function of the file /index.php/students/addStudentView of the component Student Management Handler. Executing a manipulation can lead to improper access controls. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.61dCVE-2024-51819—32.9%
——10——CVE-2020-14707—32.9%
——10——CVE-2015-4231—32.9%
——10——CVE-2026-483715.4 MED32.9%
——10Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.26dCVE-2024-51854—32.9%
——10——CVE-2023-47755—32.9%
——10——CVE-2024-51829—32.9%
——10——CVE-2024-51842—32.9%
——10——CVE-2024-51844—32.9%
——10——CVE-2024-51836—32.9%
——10——CVE-2024-51850—32.9%
——10——CVE-2026-106788.1 HIG32.9%
——10The MCTP-over-I2C+GPIO target binding in Zephyr (subsys/pmci/mctp/mctp_i2c_gpio_target.c) processes pseudo-register writes from an I2C bus master byte-by-byte in mctp_i2c_gpio_target_write_received() without validating the order or the receive buffer. In the affected versions the MCTP_I2C_GPIO_RX_MSG_ADDR (data) handler dereferences and writes through b->rx_pkt without checking that the receive buffer was allocated: a controller that selects the data register and writes a byte without first sending the length register (which is what allocates the buffer) causes a write of an attacker-chosen byte through a NULL/unallocated mctp_pktbuf pointer (i.e. into a small attacker-advanceable offset above address 0), producing memory corruption or a hard fault.
The same handler also performs a write-then-check bounds test, allowing a one-byte heap overflow at data[255] when more than 255 data bytes are sent.
Because the I2C target callback is invoked with raw bytes supplied by whatever device is the bus master and the binding performs no authentication, a malicious or malfunctioning controller on the bus can trigger these without any prior protocol state, leading to memory corruption and/or denial of service on the target device.
The vulnerable code was introduced when the I2C+GPIO target binding was added and shipped in Zephyr v4.3.0 and v4.4.0. The fix defers allocation to the first data byte with a NULL check, treats a missing length as a zero-sized packet rejected by libmctp, and moves the bounds check before the store.54d