Vulnerabilities exploitable today
370,813in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,695
New KEV · 24H0
Exploit Today ≥ 701,637
Distribution · last window
- Critical2,187
- High8,406
- Medium6,046
- Low572
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2024-4028—21.8%
——7——CVE-2025-66513—21.8%
——7——CVE-2023-3290—21.8%
——7——CVE-2023-45720—21.8%
——7——CVE-2026-33759—21.8%
——7——CVE-2026-125118.1 HIG21.8%
——7The AI Engine WordPress plugin before 3.5.5 does not sanitize a user-supplied filename before using it to write a downloaded file, allowing authenticated users with editor-level access to write attacker-controlled bytes to an arbitrary location on the server via path traversal.56dCVE-2026-728386.5 MED21.8%
——7FileBrowser versions before 2.63.19 fail to enforce the declared Upload-Length in the TUS resumable-upload PATCH endpoint, allowing authenticated users to write arbitrary data to disk. Attackers can send oversized request bodies that exceed the declared upload length to exhaust available disk space and cause service unavailability.22dCVE-2024-5252—21.8%
——7——CVE-2025-13014—21.8%
——7——CVE-2025-15235—21.8%
——7——CVE-2020-372776.5 MED21.8%
——7PocketMine-MP versions before 3.15.4 contain a denial of service vulnerability in the InventoryTransaction component's findResultItem() method. Malicious clients can send specially crafted InventoryTransactionPackets with multiple conflicting pathways to cause exponential processing complexity, freezing the server.6hCVE-2025-378858.8 HIG21.8%
——7In the Linux kernel, the following vulnerability has been resolved:
KVM: x86: Reset IRTE to host control if *new* route isn't postable
Restore an IRTE back to host control (remapped or posted MSI mode) if the
*new* GSI route prevents posting the IRQ directly to a vCPU, regardless of
the GSI routing type. Updating the IRTE if and only if the new GSI is an
MSI results in KVM leaving an IRTE posting to a vCPU.
The dangling IRTE can result in interrupts being incorrectly delivered to
the guest, and in the worst case scenario can result in use-after-free,
e.g. if the VM is torn down, but the underlying host IRQ isn't freed.41dCVE-2023-38905—21.8%
——7——CVE-2023-40457—21.8%
——7——CVE-2026-167516.5 MED21.8%
——7Authorization Bypass in the emergency recovery approval component in Ente Technologies Ente Museum Server allows an authenticated attacker configured as a victim's emergency contact to bypass the configured recovery waiting period and take over the victim's account via a crafted `approve-recovery` API request.40dCVE-2024-4971—21.8%
——7——CVE-2024-5251—21.8%
——7——CVE-2025-32526—21.8%
——7——CVE-2026-72774—21.8%
——7n8n before 1.123.67, 2.31.5, and 2.32.1 contains a credential authorization bypass in the HTTP Request node. An authenticated member with edit access to a shared workflow can reference another user's credential while specifying the credential type via an expression. Because the pre-execution permission check compares the unresolved expression instead of the resolved credential type, the ownership check is skipped and the credential is loaded at execution time, allowing the member to use or exfiltrate a credential they were not granted. Exploitation requires knowing the target credential's identifier.28dCVE-2024-13564—21.8%
——7——CVE-2026-482908.2 HIG21.8%
——7CAI Content Credentials is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.12dCVE-2026-212865.3 MED21.8%
——7Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain limited unauthorized view access of data. Exploitation of this issue does not require user interaction.12dCVE-2025-54877—21.8%
——7——CVE-2024-35761—21.8%
——7——CVE-2024-44045—21.8%
——7——CVE-2025-13701—21.8%
——7——CVE-2025-24439—21.8%
——7——CVE-2012-6646—21.8%
——7——CVE-2025-1489—21.8%
——7——CVE-2025-21169—21.8%
——7——CVE-2017-8155—21.8%
——7——CVE-2026-26069—21.8%
——7——CVE-2026-466285.4 MED21.8%
——7Twig is a template language for PHP. Prior to 3.26.0, the deprecated spaceless filter is registered as safe for HTML, causing Twig autoescaping to emit attacker-controlled markup unescaped when spaceless is applied to untrusted input. This issue is fixed in version 3.26.0.55dCVE-2024-4200—21.8%
——7——CVE-2024-3288—21.8%
——7——CVE-2025-55267—21.8%
——7——CVE-2026-554645.4 MED21.8%
——7Snipe-IT is an IT asset/license management system. Prior to 8.6.2, CommonMark escapes raw HTML but does not sanitize javascript: URIs in Markdown hyperlinks, allowing a user with assets.edit permission to place a malicious link in a markdown-textarea custom field that executes arbitrary JavaScript when another user opens the asset detail page and clicks the link. This issue is fixed in version 8.6.2.57dCVE-2024-44042—21.8%
——7——CVE-2025-34247—21.8%
——7——CVE-2003-0524—21.8%
——7——