Vulnerabilities exploitable today
376,337in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,713
New KEV · 24H0
Exploit Today ≥ 701,646
Distribution · last window
- Critical2,382
- High8,758
- Medium6,800
- Low733
Filters
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-87618.8 HIG29.4%
——9The Dokan plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 5.0.1. This is due to a missing authorization check in the `CustomersController` REST controller (`includes/REST/CustomersController.php`), which re-registers WooCommerce's customer CRUD routes under the `/dokan/v1/customers/` namespace and replaces WooCommerce's native `manage_woocommerce` capability check with a vendor-only check that inspects the **requesting** user's role and never validates the **target** user. This makes it possible for authenticated attackers with Vendor/Seller-level access and above to read, modify, or delete any WordPress user — including administrators — via `GET`/`PUT`/`DELETE` requests against `/wp-json/dokan/v1/customers/{id}`. Setting the `password` parameter on an administrator's record yields a full site takeover.36dCVE-2026-68015.3 MED29.4%
——9The Context Blog theme for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.3.5 via the context_blog_modal_popup. This makes it possible for unauthenticated attackers to extract the content of password-protected posts.67dCVE-2025-49675—29.4%
——9——CVE-2022-26358—29.4%
——9——CVE-2026-198757.5 HIG29.4%
——9IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote attacker to overwrite administrator email information and abuse the server as an outbound relay due to missing authentication for the registration endpoint.22dCVE-2025-8676—29.4%
——9——CVE-2025-65092—29.4%
——9——CVE-2025-52544—29.4%
——9——CVE-2019-0086—29.4%
——9——CVE-2024-33465—29.4%
——9——CVE-2026-562845.3 MED29.4%
——9Capgo (Cap-go/capgo) before 12.128.2 contains an information disclosure vulnerability in the Supabase PostgREST RPC function public.get_total_metrics(org_id), which is callable by the anon role using only the public sb_publishable_* key. An unauthenticated attacker can probe organization existence and leak sensitive usage metrics including MAU, bandwidth, and install counts by sending POST requests to /rest/v1/rpc/get_total_metrics with valid organization UUIDs.71dCVE-2026-6907—29.4%
——9——CVE-2025-11024—29.4%
——9——CVE-2025-58087—29.4%
——9——CVE-2025-46248—29.4%
——9——CVE-2026-64648.1 HIG29.4%
——9Untrusted data inclusion in PostgreSQL psql COPY may allow a server administrator to elicit execution of data lines as psql commands, via error injection. If the "COPY FROM STDIN" or "\copy FROM STDIN" command fails before the server indicates that it awaits input rows, psql processes the in-line data rows as psql commands. "COPY FROM" with a filename is unaffected. The server administrator has no inherent control over the data rows, so a complete attack requires the attacker to separately acquire control of both the server and the data rows. Alternatively, an attacker controlling data rows alone might complete an attack through a coincidental error that they don't control. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.19dCVE-2025-26604—29.4%
——9——CVE-2025-59348—29.4%
——9——CVE-2019-3887—29.4%
——9——CVE-2026-27043—29.4%
——9——CVE-2009-2952—29.4%
——9——CVE-2026-8754—29.4%
——9——CVE-2005-4345—29.4%
——9——CVE-2012-10022—29.4%
——9——CVE-2026-346919.3 CRI29.4%
——9Adobe Experience Manager Forms JEE versions LTS SP1, 6.5.24.0 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.21dCVE-2009-2488—29.4%
——9——CVE-2020-6206—29.4%
——9——CVE-2020-23376—29.4%
——9——CVE-2023-43345—29.4%
——9——CVE-2026-263378.2 HIG29.4%
——9Hyland Alfresco Transformation Service allows unauthenticated attackers to achieve both arbitrary file read and server-side request forgery through the absolute path traversal.66dCVE-2017-11653—29.4%
——9——CVE-2026-563275.3 MED29.4%
——9Capgo before 12.128.2 contains an information disclosure vulnerability in the public.invite_user_to_org RPC function that allows unauthenticated attackers to enumerate organization existence by observing distinct error responses. Attackers can call the SECURITY DEFINER function with a publishable API key to determine if an organization ID exists based on NO_ORG versus NO_RIGHTS responses, enabling tenant enumeration attacks.79dCVE-2023-46736—29.4%
——9——CVE-2020-37200—29.4%
——9——CVE-2024-3053—29.4%
——9——CVE-2025-58095—29.4%
——9——CVE-2024-2788—29.4%
——9——CVE-2025-47996—29.4%
——9——CVE-2026-790208.1 HIG29.4%
——9Out of bounds read in Skia in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially read memory inside the sandbox via a crafted media file. (Chromium security severity: Medium)18dCVE-2024-49655—29.4%
——9——