Vulnerabilities exploitable today
369,598in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,695
New KEV · 24H0
Exploit Today ≥ 701,638
Distribution · last window
- Critical2,115
- High7,606
- Medium5,692
- Low556
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2025-46918—21.3%
——6——CVE-2025-46947—21.3%
——6——CVE-2019-19788—21.3%
——6——CVE-2024-43991—21.3%
——6——CVE-2024-1809—21.3%
——6——CVE-2025-156636.8 MED21.3%
——6The Ultimate Before After Image Slider & Gallery WordPress plugin before 4.7.19 does not properly escape the slider's after-label value before its bundled client-side script re-injects it into the DOM, allowing users with the Author role and above to store a payload that executes in the browser of anyone (including an administrator) who views the slider.4dCVE-2026-6363—21.3%
——6——CVE-2026-749926.8 MED21.3%
——6The Kirki WordPress plugin before 6.2.3 does not properly validate the files contained in archives uploaded by users with the Editor role, and does not remove all unwanted files after extracting them, allowing such users to upload arbitrary files to a web accessible directory, leading to Stored XSS as well as RCE on some server configurations.19dCVE-2025-46971—21.3%
——6——CVE-2026-478919.8 CRI21.3%
——6A Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not correctly enforce the maxInMemorySize limit.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Spring Framework 6.1.0 - 6.1.28
Spring Framework 6.0.0 - 6.0.30
Spring Framework 5.3.0 - 5.3.49
Spring Framework 5.2.25.RELEASE and earlier5dCVE-2024-9292—21.3%
——6——CVE-2025-46923—21.3%
——6——CVE-2024-23332—21.3%
——6——CVE-2025-59525—21.3%
——6——CVE-2025-49193—21.3%
——6——CVE-2024-53027—21.3%
——6——CVE-2026-658889.8 CRI21.3%
——6Joomla Extension - balbooa.com - Account takeover vulnerability in Gridbox < 2.20.2 - The socialLogin method allows actors to login as any given user on the target site.33dCVE-2025-1287—21.3%
——6——CVE-2026-29606—21.3%
——6——CVE-2026-46399—21.3%
——6——CVE-2025-46915—21.3%
——6——CVE-2024-27873—21.3%
——6——CVE-2025-46904—21.3%
——6——CVE-2026-69075—21.3%
——6FlowIntel is affected by a stored cross-site scripting vulnerability through multiple user-controlled or administrator-controlled fields.
Persisted values—including case titles, ticket identifiers, recurring-case information, user profile attributes, organisation names, and role names—were rendered inside DOM elements subsequently compiled by Vue. Although normal HTML escaping could neutralize direct HTML markup, it did not prevent an attacker from injecting Vue interpolation expressions using the configured [[ ... ]] delimiters.
An authenticated attacker able to modify one of the affected fields could store a malicious Vue expression. When another user viewed an affected case, report, profile, recurring-case page, or navigation component, Vue could evaluate the injected expression in the context of the FlowIntel application.
Successful exploitation could allow arbitrary JavaScript execution in the victim’s browser under the FlowIntel origin. This could expose information available to the victim, perform actions using the victim’s authenticated session, or modify application data within the victim’s privileges.
The patch introduces a dedicated vue_escape filter that escapes HTML-sensitive characters and breaks Vue interpolation delimiters before the values are rendered. The filter is applied to the affected case, account, organisation, role, configuration, and navigation fields.12dCVE-2024-55069—21.3%
——6——CVE-2025-47072—21.3%
——6——CVE-2024-26328—21.3%
——6——CVE-2026-37579—21.3%
——6——CVE-2022-22302—21.3%
——6——CVE-2025-46945—21.3%
——6——CVE-2023-30402—21.3%
——6——CVE-2025-50819—21.3%
——6——CVE-2026-182026.8 MED21.3%
——6The JetEngine WordPress plugin before 3.8.14 adds SVG to the site-wide list of allowed upload types without sanitising the file contents, allowing users with the upload files capability, such as Authors, to upload a file containing malicious JavaScript that executes in the browser of any user who opens it (Stored Cross-Site Scripting). On multisite, this also overrides an upload-type restriction set by the network administrator.19dCVE-2026-501367.4 HIG21.3%
——6Budibase is an open-source low-code platform. Prior to 3.39.3, the application server exposes an unauthenticated endpoint that generates S3 PutObject presigned URLs using credentials stored in a workspace datasource. The route is protected only by the recaptcha middleware and does not require authentication, table permission, datasource permission, or builder access. A public caller who knows a workspace ID and S3 datasource ID can request a signed upload URL for attacker-controlled bucket and key values. This vulnerability is fixed in 3.39.3.69dCVE-2023-6748—21.3%
——6——CVE-2025-662769.8 CRI21.3%
——6QuTS hero is not affected.
We have already fixed the vulnerability in the following version:
QTS 5.2.7.3256 build 20250913 and later47dCVE-2022-28164—21.3%
——6——CVE-2024-43995—21.3%
——6——CVE-2025-47634—21.3%
——6——CVE-2026-130745.3 MED21.3%
——6An unauthenticated remote client can cause excessive CPU consumption on a MongoDB server by sending a specific combination of parameters to the awaitable hello command in exhaust mode. The server's handling of this combination results in a response loop that bypasses normal throttling, allowing a small number of connections to degrade server availability.20d