Vulnerabilities exploitable today
374,073in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,710
New KEV · 24H0
Exploit Today ≥ 701,645
Distribution · last window
- Critical2,342
- High8,460
- Medium6,416
- Low712
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2023-26375—25.5%
——8——CVE-2025-47022—25.5%
——8——CVE-2024-30886—25.5%
——8——CVE-2024-32905—25.5%
——8——CVE-2023-22231—25.5%
——8——CVE-2021-40044—25.5%
——8——CVE-2018-254098.8 HIG25.5%
——8SIM-PKH 2.4.1 contains an arbitrary file upload vulnerability that allows authenticated attackers to upload malicious files by submitting PHP code through the fupload parameter. Attackers can upload PHP files via the aksi_pengurus.php endpoint with module=pengurus and act=update parameters, which are stored in the foto directory and executed as web scripts.55dCVE-2025-47081—25.5%
——8——CVE-2025-6663—25.5%
——8——CVE-2026-46343—25.5%
——8Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta2, WazuhCommon.end_receiving_file() in framework/wazuh/core/cluster/common.py allows a cluster-authenticated node to delete files outside WAZUH_PATH. A syn_i_w_m_e request with an unknown task_id reaches the cleanup branch, where an attacker-controlled filename is passed to os.path.join without canonicalization or confinement. Absolute paths and traversal sequences can therefore target files such as ossec.conf, jwt_secret.json, TLS certificates, and ruleset files that are accessible to the Wazuh manager process. Deletion can disable the manager, invalidate API tokens, or disrupt cluster and API connectivity. This issue is fixed in versions 4.14.6 and 5.0.0-beta2.6dCVE-2023-21578—25.5%
——8——CVE-2022-33741—25.5%
——8——CVE-2024-34714—25.5%
——8——CVE-2025-12049—25.5%
——8——CVE-2024-47267—25.5%
——8——CVE-2023-29277—25.5%
——8——CVE-2024-13698—25.5%
——8——CVE-2011-3154—25.5%
——8——CVE-2022-31322—25.5%
——8——CVE-2025-65404—25.5%
——8——CVE-2026-0934—25.5%
——8——CVE-2025-47034—25.5%
——8——CVE-2023-26400—25.5%
——8——CVE-2022-35656—25.5%
——8——CVE-2019-8537—25.5%
——8——CVE-2026-26709—25.5%
——8——CVE-2023-25877—25.5%
——8——CVE-2026-1432—25.5%
——8——CVE-2023-26376—25.5%
——8——CVE-2016-7624—25.5%
——8——CVE-2024-24858—25.5%
——8——CVE-2026-698208.2 HIG25.5%
——8Heap-based buffer overflow in Windows Hello allows an authorized attacker to elevate privileges locally.6dCVE-2024-9599—25.5%
——8——CVE-2026-154148.8 HIG25.5%
——8The Subscriptions for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 2.0.0. This is due to the `save_meta_boxes()` function persisting the `_wps_plan_user_role` membership plan meta from `$_POST` without an allowlist that excludes privileged roles — the only validations applied, `sanitize_key()` and `wp_roles()->is_role()`, both accept `'administrator'` as a valid value, and the UI's `disabled` attribute on the role dropdown is a client-side-only control trivially bypassed via DevTools or a direct POST request; additionally, because the `wps_membership_plan` custom post type is registered with `capability_type => 'post'`, any user who can edit posts satisfies the `current_user_can('edit_post', $post_id)` guard in `save_meta_boxes()`. This makes it possible for authenticated attackers, with Contributor-level access and above, to escalate their privileges to Administrator by storing `'administrator'` as the role granted on membership acquisition, which the Pro companion plugin then applies via `add_role()` during membership lifecycle events. Successful exploitation requires the Subscriptions for WooCommerce Pro companion plugin to be active, as it is the component that reads the stored `_wps_plan_user_role` meta via `get_post_meta()` and calls `add_role()` to apply the role during membership lifecycle events.34dCVE-2024-46531—25.5%
——8——CVE-2018-18089—25.5%
——8——CVE-2023-50377—25.5%
——8——CVE-2025-27281—25.5%
——8——CVE-2025-46982—25.5%
——8——CVE-2024-6018—25.5%
——8——