Vulnerabilities exploitable today
376,337in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,713
New KEV · 24H0
Exploit Today ≥ 701,646
Distribution · last window
- Critical2,382
- High8,758
- Medium6,800
- Low731
Filters
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2019-1815—29.5%
——9——CVE-2026-203599.9 CRI29.5%
——9As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Crosswork engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities.
The vulnerabilities trackled by CVE-2026-20359 are related to insufficiently protected credentials issues that are grouped under the Common Weakness Enumeration (CWE) CWE-522.29dCVE-2014-8181—29.5%
——9——CVE-2023-47073—29.5%
——9——CVE-2023-388997.8 HIG29.5%
——9SQL injection vulnerability in berkaygediz O_Blog v.1.0 allows a local attacker to escalate privileges via the secure_file_priv component.71dCVE-2019-18256—29.5%
——9——CVE-2024-10980—29.5%
——9——CVE-2024-12622—29.5%
——9——CVE-2023-37538—29.5%
——9——CVE-2023-41949—29.5%
——9——CVE-2024-41809—29.5%
——9——CVE-2024-28805—29.5%
——9——CVE-2023-41306—29.5%
——9——CVE-2026-0591—29.5%
——9——CVE-2022-34311—29.5%
——9——CVE-2026-42757—29.5%
——9——CVE-2020-3974—29.5%
——9——CVE-2023-51731—29.5%
——9——CVE-2025-67953—29.5%
——9——CVE-2026-86856.5 MED29.5%
——9The Infility Global plugin for WordPress is vulnerable to SQL Injection via the 'orderby' and 'order' parameters in all versions up to, and including, 2.15.16. This is due to insufficient escaping on user supplied parameters and lack of sufficient preparation on the existing SQL query within the show_control_data::post_list() function, which is registered as an admin menu page with only the 'read' capability. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.56dCVE-2026-0584—29.5%
——9——CVE-2025-67738—29.5%
——9——CVE-2026-87792—29.5%
——9——CVE-2012-6539—29.5%
——9——CVE-2026-747507.5 HIG29.5%
——9In the Linux kernel, the following vulnerability has been resolved:
ovpn: defer key slot crypto freeing to workqueue
Key slots are released through a kref and the existing release path
frees the AEAD transforms from an RCU callback. That is not safe for all
crypto implementations: crypto_free_aead can sleep, for example when an
async or hardware implementation has teardown work to complete.
Use queue_rcu_work for key-slot release. This keeps the RCU grace period
needed by lockless key-slot readers, but runs the actual crypto teardown
from workqueue context where sleeping is allowed. Once the rcu_work
callback runs, pre-existing RCU readers are gone, and the final kref put
already proves that no transform user remains, so the worker can release
the AEAD transforms and free the slot directly.
The previous patch drains ovpn_wq during module exit, so queued key-slot
teardown work cannot outlive module text.22dCVE-2012-6540—29.5%
——9——CVE-2026-704896.5 MED29.5%
——9Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.0, automation recurrence parsing in backend/open_webui/utils/automations.py anchored minutely and hourly rules at a fixed date of 2000-01-01 and then walked forward one interval at a time to find the next run. A single FREQ=MINUTELY rule enumerates roughly a quarter-century of occurrences synchronously on the event loop that also serves scheduler, HTTP, and WebSocket traffic, and the scheduler recomputes the next run for every claimed row on each poll. This causes availability impact for every other user of the instance. This issue is fixed in 0.11.0.9dCVE-2025-57939—29.5%
——9——CVE-2025-15212—29.5%
——9——CVE-2026-150413.7 LOW29.5%
——9A flaw was found in 389 Directory Server. The PBKDF2-SHA256 password verification function uses standard memcmp() for comparing password hashes instead of a constant-time comparison function. A remote attacker could potentially use timing measurements of LDAP bind attempts to infer partial hash information, though practical exploitation is extremely difficult due to PBKDF2 computational overhead.70dCVE-2025-15387—29.5%
——9——CVE-2023-51719—29.5%
——9——CVE-2023-51721—29.5%
——9——CVE-2023-22938—29.5%
——9——CVE-2026-4803—29.5%
——9——CVE-2024-9205—29.5%
——9——CVE-2023-41855—29.5%
——9——CVE-2025-49348—29.5%
——9——CVE-2024-3137—29.5%
——9——CVE-2018-25104—29.5%
——9——