Vulnerabilities exploitable today
373,020in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,709
New KEV · 24H0
Exploit Today ≥ 701,644
Distribution · last window
- Critical2,213
- High8,121
- Medium6,188
- Low613
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-608277.4 HIG24.6%
——7Vulnerability in the Oracle iSupport product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle iSupport. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle iSupport, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle iSupport accessible data. CVSS 3.1 Base Score 7.4 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N).44dCVE-2022-33317—24.6%
——7——CVE-2026-33618—24.6%
——7——CVE-2016-4749—24.6%
——7——CVE-2024-31387—24.6%
——7——CVE-2026-25598—24.6%
——7——CVE-2026-165866.5 MED24.6%
——7The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress is vulnerable to Second-Order SQL Injection via MultipleFiles Second-Order Payload via 'cg_multiple_files_for_post' -> 'cgRealId' in all versions up to, and including, 30.0.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with author-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.24dCVE-2025-11454—24.6%
——7——CVE-2026-29648—24.6%
——7——CVE-2026-20118—24.6%
——7——CVE-2026-476147.5 HIG24.6%
——7NVIDIA Dynamo for Linux contains a vulnerability where an attacker may cause server-side request forgery. A successful exploit of this vulnerability might lead to information disclosure.36dCVE-2024-31930—24.6%
——7——CVE-2022-38085—24.6%
——7——CVE-2026-71445—24.6%
——7AIL Framework contained a reflected cross-site scripting vulnerability in the /tag/add_tags endpoint. When an error occurred while processing a tag operation, the application returned the error value directly as an HTML response using str(res[0]).
If attacker-controlled input was included in the generated error message, a crafted request could cause arbitrary HTML or JavaScript to be reflected in the response without appropriate output encoding. An attacker could exploit the vulnerability by convincing an authenticated AIL Framework user to open a specially crafted link.
Successful exploitation could allow JavaScript to execute in the victim’s browser within the security context of the AIL Framework application. Depending on the victim’s privileges and the application’s protections, the attacker could perform actions using the victim’s session, access information available to the victim, or modify data through authenticated application requests.
The vulnerability requires user interaction because the authenticated victim must follow or open the crafted request. The attacker does not necessarily require an AIL Framework account, provided that the crafted request can be delivered to an already authenticated user.18dCVE-2026-470606.5 MED24.6%
——7Vulnerability in the JDBC component of Oracle Database Server. Supported versions that are affected are 19.3-19.31, 21.3-21.22 and 23.4.0-23.26.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise JDBC. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all JDBC accessible data. CVSS 3.1 Base Score 6.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N).38dCVE-2023-41881—24.6%
——7——CVE-2026-697387.8 HIG24.6%
——7Integer overflow or wraparound in Windows Biometric Service allows an authorized attacker to elevate privileges locally.4dCVE-2023-31142—24.6%
——7——CVE-2026-729677.8 HIG24.6%
——7Heap-based buffer overflow in Windows Network Connection Broker allows an authorized attacker to elevate privileges locally.4dCVE-2019-0171—24.6%
——7——CVE-2026-36235—24.6%
——7——CVE-2024-12755—24.6%
——7——CVE-2024-32083—24.6%
——7——CVE-2026-688447.8 HIG24.6%
——7Heap-based buffer overflow in Windows Storage Spaces Controller allows an authorized attacker to execute code locally.3dCVE-2013-0527—24.6%
——7——CVE-2026-712256.5 MED24.6%
——7A flaw was found in libkcapi. When performing one-shot symmetric cipher operations on large inputs (over 64 KiB) in stateful modes such as Counter (CTR) or Cipher Block Chaining (CBC), the library improperly reuses the Initialization Vector (IV) for each internal data chunk. A remote attacker could potentially exploit this by making an application that uses libkcapi process specially crafted large inputs. This can lead to a significant weakening of data confidentiality, as the repeated IV use can expose relationships in encrypted plaintext, and may also affect data integrity by causing incorrect cryptographic processing.12dCVE-2008-5162—24.6%
——7——CVE-2026-114216.5 MED24.6%
——7The ERP: Complete HR, Accounting & CRM Suite with WooCommerce CRM Support plugin for WordPress is vulnerable to SQL Injection via the 'erpadvancefilter' parameter in all versions up to, and including, 1.17.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. The handler runs the value through sanitize_text_field, which preserves single quotes, and the downstream erp_crm_contact_advance_filter() function interpolates it directly into a single-quoted SQL WHERE clause before execution via $wpdb->get_results(). This makes it possible for authenticated attackers, with the plugin-supplied CRM Agent role (or higher CRM Manager / WordPress admin) and the erp_crm_list_contact capability, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.31dCVE-2024-40605—24.6%
——7——CVE-2022-40744—24.6%
——7——CVE-2025-26393—24.6%
——7——CVE-2014-8938—24.6%
——7——CVE-2026-90477.6 HIG24.6%
——7Improper handling of factor key state in the multi-factor authentication management feature in Devolutions Server allows an attacker with knowledge of a user's password to bypass the user's multi-factor authentication after the user reconfigures their factors.
This issue affects :
* Devolutions Server 2026.1.6.0 through 2026.1.16.052dCVE-2025-62702—24.6%
——7——CVE-2024-31296—24.6%
——7——CVE-2022-38069—24.6%
——7——CVE-2026-26712—24.6%
——7——CVE-2026-97676.5 MED24.6%
——7The The School Management – Education & Learning ERP plugin for WordPress is vulnerable to generic SQL Injection via 'order[0][dir]' Parameter in all versions up to, and including, 5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with custom-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This vulnerability is replicated across seven or more AJAX handlers including wlsm-fetch-staff-classes, wlsm-fetch-notices, wlsm-fetch-subjects, wlsm-fetch-inquiries, wlsm-fetch-staff-employee, and wlsm-fetch-payments, and the missing nonce verification on several of these handlers also enables CSRF-chained exploitation.24dCVE-2026-697207.8 HIG24.6%
——7Heap-based buffer overflow in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally.4dCVE-2026-2034—24.6%
——7——