Vulnerabilities exploitable today
372,967in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,705
New KEV · 24H0
Exploit Today ≥ 701,644
Distribution · last window
- Critical2,230
- High8,250
- Medium6,233
- Low615
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-610505.3 MED24.0%
——7Vulnerability in the Oracle Production Scheduling product of Oracle E-Business Suite (component: User Interface). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Production Scheduling. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Production Scheduling accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N).37dCVE-2018-12572—24.0%
——7——CVE-2025-64270—24.0%
——7——CVE-2024-45037—24.0%
——7——CVE-2024-27731—24.0%
——7——CVE-2026-713779.8 CRI24.0%
——7Command Argument Injection Vulnerability in Cosminexus Component Container.
This issue affects Cosminexus Component Container: from 11-70-01 before 11-70-03, from 11-60 before 11-60-03, from 11-50 through 11-50-03, from 11-40 through 11-40-03, from 11-30 through 11-30-08, from 11-20 before 11-20-10, from 11-10 through 11-10-11, from 11-00 through 11-00-12, from 09-87 before 09-87-10, from 09-80 through 09-80-04, from 09-70 before 09-70-28, from 09-50 through 09-50-22, and from 09-00 through 09-00-18.4dCVE-2026-78000—24.0%
——7Joomla Extension - j2commerce.com - Reflected XSS via `filter_tag`, `pricefrom` and `priceto` in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 - Four task handlers accepted a base64-encoded URL from user input and redirected to it without validating the destination host, enabling phishing using the shop's trusted domain. No authentication required.9dCVE-2026-3263—24.0%
——7——CVE-2023-37919—24.0%
——7——CVE-2024-4488—24.0%
——7——CVE-2023-28200—24.0%
——7——CVE-2023-3201—24.0%
——7——CVE-2023-25074—24.0%
——7——CVE-2022-47087—24.0%
——7——CVE-2024-47057—24.0%
——7——CVE-2026-75971—24.0%
——7——CVE-2009-1763—24.0%
——7——CVE-2024-4489—24.0%
——7——CVE-2025-64272—24.0%
——7——CVE-2025-36368—24.0%
——7——CVE-2020-2004—24.0%
——7——CVE-2026-15183—24.0%
——7Multiple input validation vulnerabilities in the Snowflake Spark Connector (spark-snowflake) versions prior to 3.2.1 can allow attackers to exfiltrate OAuth client credentials, execute arbitrary SQL with the connector's Snowflake role, or redirect COPY operations to attacker-controlled storage. An attacker could exploit these vulnerabilities by supplying a crafted OAuth token request URL, placing malicious files in an ingestion pipeline, injecting SQL via staging options in a shared Spark environment , or issuing runtime SET commands in a shared Spark-SQL session to inject arbitrary SQL into the SnowflakeFallbackCatalog's option map, which executes under the cluster admin's JDBC credentials. Successful exploitation may result in credential theft, unauthorized access to Snowflake account data, or privilege escalation within connected infrastructure.59dCVE-2026-810317.2 HIG24.0%
——7IDURAR ERP CRM changes the password of whichever account a request names rather than the account making the request. The update handler in backend/src/controllers/middlewaresControllers/createUserController/updatePassword.js resolves the authenticated user from the request that the token middleware populated, then issues its update against a filter built from the identifier in the URL path, and never compares the two. The route is mounted behind the administrator token check only, so any valid administrator session is sufficient, and the sole ownership-like guard in the handler rejects a single hardcoded demo address. A caller can therefore set an arbitrary password on any other administrator account and sign in as it. The read handler in the same controller directory accepts an identifier the same way, which supplies the identifiers needed to pick a target.14dCVE-2021-21910—24.0%
——7——CVE-2026-53646—24.0%
——7FOSSBilling is a free, open-source billing and client management system. In versions 0.5.6 through 0.7.2, when a `ClientPasswordReset` record already exists for a client (from a previous unexpired reset request), subsequent calls to the `reset_password` guest API endpoint reuse the existing token instead of generating a new one. The 15-minute validity window is anchored to the first request's `created_at` timestamp, not the time of the most recent email. An attacker who obtained the original reset link remains able to use it even after the victim requests a new reset, because the original token is never invalidated or rotated. Version 0.8.0 patches the issue. Some workarounds are available. Configure a reverse proxy (e.g., Nginx, Apache, Cloudflare) to apply per-IP rate limiting to the `/client/reset-password` endpoint to minimize the window of opportunity, and/or manually clear expired `client_password_reset` records from the database after a client reports a suspected compromise.67dCVE-2016-4704—24.0%
——7——CVE-2021-21555—24.0%
——7——CVE-2024-3565—24.0%
——7——CVE-2024-6688—24.0%
——7——CVE-2024-47646—24.0%
——7——CVE-2025-69358—24.0%
——7——CVE-2009-3304—24.0%
——7——CVE-2025-5483—24.0%
——7——CVE-2024-25741—24.0%
——7——CVE-2021-32755—24.0%
——7——CVE-2026-168187.5 HIG24.0%
——7IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption.23dCVE-2024-37489—24.0%
——7——CVE-2024-47354—24.0%
——7——CVE-2025-67518—24.0%
——7——CVE-2026-53928—24.0%
——7——