Vulnerabilities exploitable today
374,209in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,710
New KEV · 24H0
Exploit Today ≥ 701,645
Distribution · last window
- Critical2,224
- High7,940
- Medium6,436
- Low714
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2019-0116—27.5%
——8——CVE-2009-1214—27.5%
——8——CVE-2026-151627.5 HIG27.5%
——8The Object Sync for Salesforce plugin is vulnerable to unauthenticated SQL Injection via the wordpress_object_type parameter of its /wp-json/object-sync-for-salesforce/push/ REST route. The route's permission callback (can_process()) checks only the HTTP method for the push class — no capability or nonce — so it is reachable by unauthenticated users. The wordpress_object_type value is concatenated directly into a SQL query (post_type = "$object_type", class-object-sync-sf-wordpress.php:328) and executed via $wpdb->get_results() with no $wpdb->prepare() (:578). Because REST body parameters are not magic-quoted, an attacker can break out of the quoted string and inject arbitrary SQL. This makes it possible for unauthenticated attackers to append additional SQL queries (time-based blind), enabling extraction of sensitive information such as password hashes from the database. Only a valid wordpress_id (e.g. 1) is required — no authentication or Salesforce connection.27dCVE-2026-347886.5 MED27.5%
——8Emlog is an open source website building system. In versions 2.6.2 and prior, a SQL injection vulnerability exists in include/model/tag_model.php at line 168. The updateTagName() function directly interpolates user input into the SQL query string without using parameterized queries or proper escaping ($this->db->escape_string()), making it vulnerable to SQL injection attacks. At time of publication, there are no publicly available patches.54dCVE-2024-28569—27.5%
——8——CVE-2026-8915—27.5%
——8——CVE-2024-3170—27.5%
——8——CVE-2020-15064—27.5%
——8——CVE-2025-1259—27.5%
——8——CVE-2018-20917—27.5%
——8——CVE-2006-3159—27.5%
——8——CVE-2017-0688—27.5%
——8——CVE-2026-7466—27.5%
——8——CVE-2006-1588—27.5%
——8——CVE-2023-25954—27.5%
——8——CVE-2026-732396.5 MED27.5%
——8Insecure Direct Object Reference (IDOR) due to missing permission checks for multiple Artifact types in Apache Allura.
This issue affects Apache Allura: before 1.19.1.
Users are recommended to upgrade to version 1.19.1, which fixes the issue.30dCVE-2023-28642—27.5%
——8——CVE-2025-5153—27.5%
——8——CVE-2004-1089—27.5%
——8——CVE-2025-26780—27.5%
——8——CVE-2024-11696—27.5%
——8——CVE-2026-41408—27.5%
——8——CVE-2021-28835—27.5%
——8——CVE-2026-164827.5 HIG27.5%
——8The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'compare' parameter in all versions up to, and including, 4.7.11 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is exploitable on any public page containing an rtMedia shortcode (e.g., [rtmedia_gallery]) when the rtmedia_shortcode GET parameter is set, because RTMediaQuery::query() merges $_REQUEST into the internal query while only validating top-level array keys, allowing the nested 'compare' subvalue to reach the vulnerable sink without authentication.21hCVE-2026-455545.3 MED27.5%
——8NiceGUI is a Python-based UI framework. Prior to version 3.12.0, two FastAPI routes that serve per-component static assets in NiceGUI accept a sub-path parameter that may resolve to a directory rather than a file. Requests that resolve to a directory raise an unhandled RuntimeError inside Starlette's FileResponse, which Uvicorn writes to the server log as a full traceback. Because the routes are reachable without authentication, a remote attacker can amplify log volume and consume disk and log-pipeline capacity on any publicly reachable NiceGUI server. This issue has been patched in version 3.12.0.56dCVE-2010-20045—27.5%
——8——CVE-2021-1128—27.5%
——8——CVE-2023-52168—27.5%
——8——CVE-2026-563315.3 MED27.5%
——8Capgo before 12.128.2 contains improper error handling in the /private/accept_invitation endpoint that returns HTTP 500 instead of safe 4xx errors when magic_invite_string is invalid. Attackers can trigger this vulnerability using only the public key by submitting malformed magic_invite_string values to cause server errors and leak internal processing details.77dCVE-2026-726707.7 HIG27.5%
——8A lower privileged user who holds only the privilege to read agent policies can read the entire configuration of a configured Fleet proxy. This would normally require the Fleet privilege to read settings.The proxy configuration possibly contains proxy authentication credentials and private key material that they should not be authorized to view.12dCVE-2026-758288.7 HIG27.5%
——8Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the detectXss() function where unpaired quotes in unquoted attribute values bypass event-handler detection. Authenticated editors can inject event handlers like onerror= that pass validation and execute in visitor browsers when page content is rendered.8dCVE-2013-0296—27.5%
——8——CVE-2005-4783—27.5%
——8——CVE-2025-2031—27.5%
——8——CVE-2017-0692—27.5%
——8——CVE-2026-3317—27.5%
——8——CVE-2024-28831—27.5%
——8——CVE-2026-177916.5 MED27.5%
——8Insufficient validation of untrusted input in Payments in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)43dCVE-2024-3176—27.5%
——8——CVE-2011-10025—27.5%
——8——