Vulnerabilities exploitable today
374,209in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,710
New KEV · 24H0
Exploit Today ≥ 701,645
Distribution · last window
- Critical2,347
- High8,411
- Medium6,454
- Low715
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2023-36691—26.1%
——8——CVE-2026-23428—26.1%
——8——CVE-2026-48683—26.1%
——8——CVE-2021-20649—26.1%
——8——CVE-2026-16876—26.1%
——8An authentication bypass vulnerability exists in the WebGUI of Series UNIVERGE IX-R/IX-V. A user could bypass authentication and execute arbitrary CLI commands by tampering with WebGUI messages and sending them to the device via internet.6dCVE-2024-3630—26.1%
——8——CVE-2005-0387—26.1%
——8——CVE-2025-4994—26.1%
——8The SafeLine SL6 and SL6+ devices integrated into elevator emergency intercom systems are vulnerable to an authentication bypass. This vulnerability allows attackers to bypass authentication requirements and access the device's configuration service via the Bluetooth Low Energy (BLE) interface. Consequently, an attacker within wireless range can gain unauthorized administrative access to the device configuration.70dCVE-2009-0313—26.1%
——8——CVE-2026-1489—26.1%
——8——CVE-2021-47720—26.1%
——8——CVE-2023-4276—26.1%
——8——CVE-2017-1000485—26.1%
——8——CVE-2001-0589—26.1%
——8——CVE-2024-49505—26.1%
——8——CVE-2026-24960—26.1%
——8——CVE-2026-44431—26.1%
——8——CVE-2026-9270—26.1%
——8——CVE-2025-153817.1 HIG26.1%
——8In the latest version of mlflow/mlflow, when the `basic-auth` app is enabled, tracing and assessment endpoints are not protected by permission validators. This allows any authenticated user, including those with `NO_PERMISSIONS` on the experiment, to read trace information and create assessments for traces they should not have access to. This vulnerability impacts confidentiality by exposing trace metadata and integrity by allowing unauthorized creation of assessments. Deployments using `mlflow server --app-name=basic-auth` are affected.63dCVE-2026-409887.5 HIG26.1%
——8An application using spring-security-saml2-service-provider and the REDIRECT binding for SAML 2.0 Login or Logout may be vulnerable to a denial of service by way of an unbounded writer that inflates the compressed SAML payload into memory.
Affected versions:
Spring Security 5.7.0 through 5.7.23; 5.8.0 through 5.8.25; 6.3.0 through 6.3.16; 6.4.0 through 6.4.16; 6.5.0 through 6.5.10; 7.0.0 through 7.0.5.55dCVE-2017-15591—26.1%
——8——CVE-2026-722278.1 HIG26.1%
——8In the Linux kernel, the following vulnerability has been resolved:
batman-adv: mcast: avoid OOB read of num_dests header
Before the access to struct batadv_tvlv_mcast_tracker's num_dests, it is
attempted to check whether enough space is actually in the network header.
But instead of using offsetofend() to check for the whole size (2) which
must be accessible, offsetof() of is called. The latter is always returning
0. The comparison with the network header length will always return that
enough data is available - even when only 1 or 0 bytes are accessible.
Instead of using offsetofend(), use the more common check for the whole
header.30dCVE-2019-25512—26.1%
——8——CVE-2025-24149—26.1%
——8——CVE-2026-29771—26.1%
——8——CVE-2025-4515—26.1%
——8——CVE-2026-41644—26.1%
——8——CVE-2023-53919—26.1%
——8——CVE-2025-65817—26.1%
——8——CVE-2026-8738—26.1%
——8——CVE-2024-30983—26.1%
——8——CVE-2022-36388—26.1%
——8——CVE-2024-1887—26.1%
——8——CVE-2026-77966.4 MED26.1%
——8The EmbedPress – PDF Embedder, Embed PDF viewer, YouTube Videos, 3D FlipBook, Social feeds & more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the block 'url' attribute in all versions up to, and including, 4.5.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page55dCVE-2026-750824.3 MED26.1%
——8A flaw has been found in Webkul Bagisto up to 2.4.4. The affected element is an unknown function of the file /customer/register of the component Customer-Registration Notification Email. This manipulation of the argument first_name/last_name causes basic cross site scripting. It is possible to initiate the attack remotely. The exploit has been published and may be used. The vendor confirms: "The reported issues were already identified through our internal security assessment process prior to this notification and are being handled through our established internal security and development lifecycle. Some of these items have already been addressed, while the remaining items are planned for resolution in upcoming product releases."26dCVE-2011-3164—26.1%
——8——CVE-2025-0343—26.1%
——8——CVE-2023-2549—26.1%
——8——CVE-2023-42926—26.1%
——8——CVE-2026-33790—26.1%
——8——