Vulnerabilities exploitable today
369,392in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,695
New KEV · 24H0
Exploit Today ≥ 701,636
Distribution · last window
- Critical2,099
- High7,540
- Medium5,594
- Low539
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-40552—20.8%
——6——CVE-2026-32156—20.8%
——6——CVE-2024-45832—20.8%
——6——CVE-2024-33807—20.8%
——6——CVE-2026-109198.3 HIG20.8%
——6Use after free in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)47dCVE-2026-447596.1 MED20.8%
——6SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter. The scripts are reflected in the server response and executed in a user's browser when the crafted URL is visited, leading to theft of session information, manipulation of portal content, or user redirection, resulting in a low impact on the application's confidentiality and integrity, with no impact on availability.55dCVE-2026-108848.3 HIG20.8%
——6Use after free in Chromecast in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)47dCVE-2026-494188.8 HIG20.8%
——6When msync(MS_INVALIDATE) is called on a mapping of an unmanaged device object, the physical pages in the mapping range are marked invalid but remain in the pager's page list. A subsequent page fault will cause the fault handler to re-insert the page into the object's list. This corrupts the list, and on object destruction the page is freed twice.
An unprivileged local user with access to a device that provides memory-mapped I/O can trigger a use-after-free in the kernel, though this is limited to a pool of objects ("fictitious pages") that are never recycled for a different purpose. It may be possible to exploit this to escalate privileges.6dCVE-2026-58674.3 MED20.8%
——6Heap buffer overflow in WebML in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)45dCVE-2026-109218.3 HIG20.8%
——6Integer overflow in Dawn in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)47dCVE-2025-30613—20.8%
——6——CVE-2021-22484—20.8%
——6——CVE-2024-30307—20.8%
——6——CVE-2023-50770—20.8%
——6——CVE-2023-52072—20.8%
——6——CVE-2026-27860—20.8%
——6——CVE-2025-0692—20.8%
——6——CVE-2026-14856—20.8%
——6A stored Cross-Site Scripting (XSS) vulnerability in the file upload functionality of the Media Manager in TastyIgniter v4.3.0, caused by insufficient validation and sanitization of SVG files. An authenticated user with low privileges can upload a malicious SVG file containing JavaScript code. When an administrator views that file, the code executes in the context of their browser. By chaining this vulnerability with a Cross-Site Request Forgery (CSRF) attack, an attacker can extract the administrator’s CSRF token and perform unauthorized actions—such as modifying credentials—thereby gaining full control of the administrative account.42dCVE-2026-187205.3 MED20.8%
——6A flaw has been found in kalcaddle kodbox 1.67 Build 02. This vulnerability affects unknown code of the file /index.php?plugin/msgWarning/action of the component msgWarning Plugin. Executing a manipulation can lead to improper authorization. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.25dCVE-2025-29710—20.8%
——6——CVE-2025-14911—20.8%
——6——CVE-2026-109258.3 HIG20.8%
——6Out of bounds write in Skia in Google Chrome on Mac prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)47dCVE-2026-170708.8 HIG20.8%
——6Missing Authorization vulnerability in HAVELSAN Inc. Liman MYS allows Accessing Functionality Not Properly Constrained by ACLs.
This issue affects Liman MYS: from 2.2.3 before 2.3.1.12dCVE-2020-8016—20.8%
——6——CVE-2025-59784—20.8%
——6——CVE-2025-27822—20.8%
——6——CVE-2025-1271—20.8%
——6——CVE-2025-27810—20.8%
——6——CVE-2020-14477—20.8%
——6——CVE-2024-44716—20.8%
——6——CVE-2025-31333—20.8%
——6——CVE-2026-136138.8 HIG20.8%
——6The KiviCare WordPress plugin before 4.5.2 does not properly sanitise and escape user-supplied parameters before using them in a SQL query, allowing authenticated users with a clinic staff-level role to perform SQL injection.12dCVE-2026-109188.3 HIG20.8%
——6Use after free in Viz in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)47dCVE-2023-52074—20.8%
——6——CVE-2026-754177.2 HIG20.8%
——6A SQL injection vulnerability was found in YzmCMS 7.5. The issue occurs in the get_arrchildid() function within application/admin/controller/category.class.php, where the user-controlled parentid parameter is concatenated directly into a FIND_IN_SET() SQL clause without proper sanitization. This allows an authenticated administrator to execute arbitrary SQL queries via boolean-based blind injection, potentially leading to full database compromise.4dCVE-2023-32556—20.8%
——6——CVE-2026-6298—20.8%
——6——CVE-2026-750044.3 MED20.8%
——6In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper rule name quoting could lead to managesieve_disabled_actions setting bypass via a crafted rule name in a Sieve script. This issue only affects Roundcube instances using the managesieve plugin.5dCVE-2026-737028.8 HIG20.8%
——6A privilege escalation vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated low privilege operator user to escalate their permissions to those of an administrative user, leading to complete system compromise.5dCVE-2023-50159—20.8%
——6——