Vulnerabilities exploitable today
374,209in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,710
New KEV · 24H0
Exploit Today ≥ 701,645
Distribution · last window
- Critical2,226
- High7,950
- Medium6,437
- Low714
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-52716—27.2%
——8——CVE-2019-20606—27.2%
——8——CVE-2024-8260—27.2%
——8——CVE-2025-1293—27.2%
——8——CVE-2024-39728—27.2%
——8——CVE-2026-46389—27.2%
——8——CVE-2025-60045—27.2%
——8——CVE-2025-64209—27.2%
——8——CVE-2024-49513—27.2%
——8——CVE-2026-57236—27.2%
——8——CVE-2006-5328—27.2%
——8——CVE-2023-46175—27.2%
——8——CVE-2012-5483—27.2%
——8——CVE-2025-27732—27.2%
——8——CVE-2026-22745—27.2%
——8——CVE-2025-8105—27.2%
——8——CVE-2026-136008.1 HIG27.2%
——8The AutoNetTV Relay WordPress plugin before 3.0.14 does not perform any capability or authentication check before setting a WordPress administrator authentication cookie during its scheduled content-synchronization task. On server configurations where the scheduled task executes before the HTTP response is committed, an unauthenticated attacker who triggers the due task can receive the administrator's session cookie and gain administrator access without credentials.21dCVE-2025-20129—27.2%
——8——CVE-2025-5387—27.2%
——8——CVE-2015-7502—27.2%
——8——CVE-2026-72996.3 MED27.2%
——8Appsmith’s SQL query editor’s autocomplete functionality fails to sanitize database object names before rendering them in innerHTML, allowing an authenticated Developer to inject persistent XSS by a malicious table or column names triggering arbitrary code execution in the sessions of other workspace members when they interact with the same datasource.56dCVE-2025-60077—27.2%
——8——CVE-2024-8759—27.2%
——8——CVE-2025-23082—27.2%
——8——CVE-2024-4232—27.2%
——8——CVE-2025-5389—27.2%
——8——CVE-2025-49925—27.2%
——8——CVE-2024-47059—27.2%
——8——CVE-2022-26363—27.2%
——8——CVE-2025-1904—27.2%
——8——CVE-2024-2643—27.2%
——8——CVE-2002-0355—27.2%
——8——CVE-2026-6823—27.2%
——8——CVE-2001-0078—27.2%
——8——CVE-2020-10762—27.2%
——8——CVE-2026-30805—27.2%
——8——CVE-2023-26332—27.2%
——8——CVE-2026-65985—27.2%
——8FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. In 1.3.2 and earlier, the device-webapi-request Socket.IO handler in server/runtime/index.js permits an authenticated non-admin runtime user to control property.address, causing the FUXA server to issue an outbound HTTP or HTTPS request and return the response body to the requesting socket. The attacker can use the server as a read SSRF oracle against reachable internal services or cloud metadata endpoints, with impact depending on the FUXA host's deployment network. This issue is fixed in version 1.3.3.7dCVE-2026-64941—27.2%
——8URL Redirection to Untrusted Site ('Open Redirect') vulnerability in phoenixframework phoenix_live_view allows an attacker to send a victim's browser to an origin of the attacker's choosing via a :to value containing ASCII tab, LF or CR.
redirect/2 validates :to through the private validate_local_url!/2 in lib/phoenix_live_view.ex, which is intended to guarantee the target is a path within the application. It rejects a leading // and any backslash, but not ASCII tab, LF or CR. Browsers strip those three characters before parsing a URL, so a value such as /<TAB>/example.com passes validation as a path and is then resolved as the scheme-relative URL //example.com. The live navigation functions share the guard but are not affected, because the client expands their target against the current origin. push_patch/2 is also affected before 0.7.0, which is when that expansion was added.
This issue affects phoenix_live_view: from 0.5.0 before 1.0.19, from 1.1.0-rc.0 before 1.1.33, and from 1.2.0-rc.0 before 1.2.9.35dCVE-2007-1051—27.2%
——8——