CVE Watch372,967 in full archive

Vulnerabilities exploitable today

372,967in current view

Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.

In KEV catalog1,705

New KEV · 24H0

Exploit Today ≥ 701,644

Distribution · last window

Critical
2,231
High
8,251
Medium
6,234
Low
615

Filters

Window

Severity

Flags

Vulnerabilities282,441–282,480 · 372,967

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2025-10975—

23.9%

——7——CVE-2026-654525.3 MED

23.9%

——7Unauthenticated Broken Access Control in Ebook Store <= 6.19 versions.51d CVE-2023-36243—

23.9%

——7——CVE-2026-187539.1 CRI

23.9%

——7The product firmware contains an embedded, static RSA private key utilized by the Lighttpd web server for TLS termination. Exposure of this private key allows malicious actors to breach the confidentiality and integrity of HTTPS communications, enabling traffic decryption and server spoofing.3d CVE-2026-811585.3 MED

23.9%

——7Incorrect Authorization vulnerability in Drupal Entity API allows Forceful Browsing. This issue affects Entity API versions: from 0.0.0 to 1.8.0.10d CVE-2026-57323—

——7Backend users with file download permissions were able to download files from the fallback storage of the file abstraction layer (FAL) via the Media Module. Since the fallback storage resolves paths relative to the server's document root, this could expose sensitive files such as log files. This issue affects TYPO3 CMS versions 11.0.0-11.5.50, 12.0.0-12.4.45, 13.0.0-13.4.30 and 14.0.0-14.3.2.51d CVE-2025-30087—

23.9%

——7——CVE-2026-65765—

23.9%

——7Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.1 - Improper limitation of paths for save and download actions lead to path traversal vulnerabilities.46d CVE-2022-495358.8 HIG

23.9%

——7In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix null pointer dereference after failing to issue FLOGI and PLOGI If lpfc_issue_els_flogi() fails and returns non-zero status, the node reference count is decremented to trigger the release of the nodelist structure. However, if there is a prior registration or dev-loss-evt work pending, the node may be released prematurely. When dev-loss-evt completes, the released node is referenced causing a use-after-free null pointer dereference. Similarly, when processing non-zero ELS PLOGI completion status in lpfc_cmpl_els_plogi(), the ndlp flags are checked for a transport registration before triggering node removal. If dev-loss-evt work is pending, the node may be released prematurely and a subsequent call to lpfc_dev_loss_tmo_handler() results in a use after free ndlp dereference. Add test for pending dev-loss before decrementing the node reference count for FLOGI, PLOGI, PRLI, and ADISC handling.39d CVE-2026-737009.0 CRI

23.9%

——7A vulnerability in the web-based management interface of HPE Networking Fabric Composer could allow an authenticated low privilege operator user to conduct a stored cross-site scripting (XSS) attack against an administrative user of the interface. A successful exploit could allow an attacker to execute arbitrary script code in a victim's browser in the context of the affected interface.10d CVE-2026-582165.3 MED

23.9%

——7An out-of-bounds read flaw was found in Samba's Kerberos Key Distribution Center's (KDC) password change (kpasswd) service. When processing malformed ASN.1-encoded Kerberos password change request, Samba server miscalculates the structure size and attempts to read up to six bytes beyond the end of the allocated buffer. While this out-of-bounds read typically results in a harmless decryption failure, if the read hits unmapped memory, it causes the KDC process to crash. An authenticated attacker can send a specially crafted kpasswd request containing malformed ASN.1 data to trigger the out-of-bounds read, which may cause the KDC process to terminate, resulting in a denial of service.42d CVE-2026-697857.8 HIG

23.9%

——7Untrusted search path in Windows Smart Card allows an authorized attacker to elevate privileges locally.3d CVE-2026-57665—

——7——CVE-2026-43336.4 MED

23.9%

——7The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'skin' attribute of the learn_press_courses shortcode in all versions up to and including 4.3.3. This is due to insufficient input sanitization and output escaping on the 'skin' shortcode attribute. The attribute value is used directly in an sprintf() call that generates HTML (class attribute and data-layout attribute) without any esc_attr() escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.49d CVE-2024-10560—

23.9%

——7——CVE-2020-22659—

23.9%

——7——CVE-2018-253967.5 HIG

23.9%

——7Heatmiser Wifi Thermostat 1.7 contains a credential disclosure vulnerability that allows unauthenticated attackers to retrieve administrative credentials by accessing the networkSetup.htm page. Attackers can request the networkSetup.htm endpoint and extract plaintext username and password values from HTML form fields to gain administrative access to the thermostat.53d CVE-2026-567937.7 HIG

23.9%

——7Dell OpenManage Server Administrator, versions prior to 11.1.0.2, contains an Improper Authentication vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access.35d CVE-2026-305216.5 MED

23.9%

——7A Business Logic vulnerability exists in SourceCodester Loan Management System v1.0 due to improper server-side validation. The application allows administrators to create "Loan Plans" with specific interest rates. While the frontend interface prevents users from entering negative numbers, this constraint is not enforced on the backend. An authenticated attacker can bypass the client-side restriction by manipulating the HTTP POST request to submit a negative value for the interest_percentage. This results in the creation of loan plans with negative interest rates.49d CVE-2022-50940—

23.9%

——7——CVE-2026-654865.3 MED

23.9%

——7Unauthenticated Broken Access Control in Event post <= 6.0.1 versions.51d CVE-2022-48626—

23.9%

——7——CVE-2026-811655.3 MED

23.9%

——7Incorrect Authorization vulnerability in Drupal Blazy allows Forceful Browsing. This issue affects Blazy versions: from 0.0.0 to 3.0.18.10d CVE-2022-36798—

——7——CVE-2026-502927.4 HIG

23.9%

——7In libinput before 1.30.4 and 1.31.x before 1.31.3, libinput-device-group unescaped phys output can inject udev properties leading to arbitrary root code execution51d CVE-2026-187549.1 CRI

23.9%

——7——CVE-2024-49554—

23.9%

——7——CVE-2026-654895.3 MED

23.9%

——7Unauthenticated Broken Access Control in LA-Studio Element Kit for Elementor <= 1.6.2 versions.51d CVE-2025-32403—

23.9%

——7——CVE-2026-75115—

23.9%

——7Joomla Extension - yootheme.com - Authenticated, privileged arbitrary file read in YOOtheme Pro 2.3.0-5.0.40 - The Filesystem source's path filter is vulnerable to glob-based pattern attacks, allowing authorized users to read arbitrary files.22d CVE-2026-704269.0 CRI

23.9%

——7In Remoting 3384.v60d89463d9e0 and earlier, except 3355.3357.v931d3c992987, included in Jenkins 2.575 and earlier, LTS 2.568.1 and earlier, the JEP-200 class filter is not applied to classes resolved via a fallback path in the Remoting deserialization implementation, allowing agent processes, code running on agents, and attackers with Agent/Connect permission to bypass the JEP-200 deserialization filter for classes on the Jenkins core classpath.12d CVE-2026-41240—

23.9%

——7——