Vulnerabilities exploitable today
369,598in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,695
New KEV · 24H0
Exploit Today ≥ 701,638
Distribution · last window
- Critical2,115
- High7,606
- Medium5,692
- Low556
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2024-30962—21.4%
——6——CVE-2025-9913—21.4%
——6——CVE-2026-32358—21.4%
——6——CVE-2026-69127—21.4%
——6Kirby is an open-source content management system. Prior to 4.9.5 and from 5.0.0 through 5.5.1, the REST API error handler can return unsanitized PHP error messages that expose the full filesystem path of the Kirby installation to unauthenticated API users. This vulnerability affects all Kirby sites that have not disabled the REST API with the 'api' => false option. This issue is fixed in versions 4.9.5 and 5.5.2.27dCVE-2026-53670—21.4%
——6PREVAIL is a Polynomial-Runtime EBPF Verifier using an Abstract Interpretation Layer. Prior to version 0.2.4, in the Prevail eBPF verifier, EbpfTransformer::add() silently skips offset-variable updates when the destination register carries a non-singleton typeset (two or more simultaneously possible pointer types). Subsequent bounds checks use the stale offset and accept out-of-bounds memory accesses, so a crafted BPF program passes verification even though it would corrupt memory at runtime. This issue has been patched in version 0.2.4.5dCVE-2021-0090—21.4%
——6——CVE-2024-13902—21.4%
——6——CVE-2026-40942—21.4%
——6——CVE-2011-1769—21.4%
——6——CVE-2013-2786—21.4%
——6——CVE-2026-429027.8 HIG21.4%
——6Improper authorization in Microsoft PowerToys allows an authorized attacker to elevate privileges locally.47dCVE-2024-6986—21.4%
——6——CVE-2010-5174—21.3%
——6——CVE-2026-666099.3 CRI21.4%
——6Unauthenticated SQL Injection in TheGem (Elementor) <= 5.12.3 versions.19dCVE-2024-10864—21.3%
——6——CVE-2026-6402—21.4%
——6——CVE-2024-3247—21.4%
——6——CVE-2024-3248—21.4%
——6——CVE-2026-34300—21.4%
——6——CVE-2026-25129—21.4%
——6——CVE-2026-117904.9 MED21.4%
——6A flaw was found in 389 Directory Server. The PBKDF2-SHA256 password storage plugin does not enforce an upper bound on the iteration count extracted from stored password hashes. A privileged attacker who can modify a user's password hash can cause excessive CPU consumption during authentication, resulting in denial of service.47dCVE-2024-35180—21.4%
——6——CVE-2026-85062—21.4%
——6Colord is a tiny yet powerful tool for high-performance color manipulations and conversions. Prior to 2.9.4, synchronous CSS color string matchers in src/colorModels/rgbString.ts, src/colorModels/hslString.ts, src/colorModels/hwbString.ts, src/colorModels/lchString.ts, and src/colorModels/cmykString.ts use the ambiguous numeric regular expression ([+-]?\d*.?\d+), allowing the same digits to be divided between overlapping quantifiers in quadratically many ways when malformed input is rejected. An attacker who can supply an unbounded color string to colord(), getFormat(), isEqual(), mix(), or contrast(), including through a request body, JSON field, or uploaded stylesheet, can block the processing thread with a multi-kilobyte payload. The affected matchers are parseRgbaString, parseHslaString, parseHwbaString, parseLchaString, and parseCmykaString. This issue is fixed in version 2.9.4.4dCVE-2023-29576—21.4%
——6——CVE-2026-685669.3 CRI21.4%
——6Unauthenticated SQL Injection in BookingPress Appointment Booking Pro <= 6.0.2 versions.19dCVE-2025-1784—21.4%
——6——CVE-2026-53706—21.4%
——6PREVAIL is a Polynomial-Runtime EBPF Verifier using an Abstract Interpretation Layer. Prior to version 0.2.4, the prevail eBPF verifier accepts ALU32 ADD and SUB instructions that operate on pointer-typed registers without checking the is64 flag. Because ALU32 arithmetic zero-extends the 32-bit result, the upper half of any pointer is silently destroyed at runtime, yet prevail marks the program as verified safe. Any caller that can submit an eBPF program for verification — including unprivileged users on kernels that permit BPF program loading — can produce a program that passes verification but faults or misbehaves at runtime. This issue has been patched in version 0.2.4.5dCVE-2026-32199—21.4%
——6——CVE-2026-665929.3 CRI21.4%
——6Unauthenticated SQL Injection in rtMedia for WordPress, BuddyPress and bbPress <= 4.7.11 versions.19dCVE-2026-53671—21.4%
——6PREVAIL is a Polynomial-Runtime EBPF Verifier using an Abstract Interpretation Layer. Prior to version 0.2.4, the abstract transformer in prevail treats writes through a T_CTX-typed base register as a silent no-op: do_mem_store in src/crab/ebpf_transformer.cpp only models T_STACK stores, and the checker's T_CTX bounds arm never tests AccessType::write. An attacker can craft an eBPF program that overwrites a context field (e.g., ctx->data), reload that field typed as T_PACKET, and dereference an attacker-controlled address — and prevail will report the program as safe. This issue has been patched in version 0.2.4.3dCVE-2026-628127.8 HIG21.4%
——6Improper link resolution before file access ('link following') in Windows DHCP Server allows an authorized attacker to elevate privileges locally.6dCVE-2025-28136—21.4%
——6——CVE-2024-32505—21.4%
——6——CVE-2026-32418—21.4%
——6——CVE-2025-52830—21.4%
——6——CVE-2024-20276—21.4%
——6——CVE-2020-8473—21.4%
——6——CVE-2024-13651—21.4%
——6——CVE-2022-49388—21.4%
——6——CVE-2025-41108—21.4%
——6——