Vulnerabilities exploitable today
369,308in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,695
New KEV · 24H0
Exploit Today ≥ 701,636
Distribution · last window
- Critical2,136
- High7,610
- Medium5,624
- Low542
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-585206.1 MED20.4%
——6URL redirection to untrusted site ('open redirect') vulnerability in The Wikimedia Foundation Mediawiki - UrlShortener Extension allows Cross-Site Flashing.
This issue affects Mediawiki - UrlShortener Extension: from * before 1.43.9, 1.44.6, 1.45.4.59dCVE-2025-15450—20.4%
——6——CVE-2022-32966—20.4%
——6——CVE-2022-0555—20.4%
——6——CVE-2026-73212—20.4%
——6Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.1, good_peer_addr() in src/server/ns_turn_server.c uses ioa_addr_in_range() in src/client/ns_turn_ioaddr.c without canonicalizing IPv4-compatible, 6to4, and 64:ff9b::/96 NAT64 address forms, allowing an authenticated RFC 6062 TCP CONNECT relay client to bypass an IPv4 denied-peer-ip range when the Coturn host has a useful translation route. This issue is fixed in version 4.13.1.26dCVE-2026-177436.5 MED20.4%
——6Insufficient policy enforcement in ControlledFrame in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)27dCVE-2024-53773—20.4%
——6——CVE-2025-43873—20.4%
——6——CVE-2019-8630—20.4%
——6——CVE-2010-5143—20.4%
——6——CVE-2020-37180—20.4%
——6——CVE-2026-562525.4 MED20.4%
——6Capgo before 12.128.2 contains a scope isolation vulnerability in the POST /webhooks/test endpoint that allows app-scoped API keys to invoke org-scoped webhook operations. Attackers with app-scoped credentials can trigger signed outbound webhook deliveries for arbitrary organization webhooks outside their declared app boundary, bypassing the limited_to_apps authorization check.55dCVE-2023-5630—20.4%
——6——CVE-2025-67747—20.4%
——6——CVE-2022-43673—20.4%
——6——CVE-2025-50978—20.4%
——6——CVE-2023-22392—20.4%
——6——CVE-2025-6712—20.4%
——6——CVE-2026-175408.8 HIG20.4%
——6The File Manager WordPress plugin before 6.9.1 does not properly authorise its file management commands, allowing any authenticated user, such as a subscriber, to read and delete arbitrary files under the WordPress installation directory, which could lead to the disclosure of the site's configuration secrets and to denial of service.11dCVE-2024-41050—20.4%
——6——CVE-2024-42175—20.4%
——6——CVE-2024-46372—20.4%
——6——CVE-2026-33065—20.4%
——6——CVE-2025-59921—20.4%
——6——CVE-2024-13398—20.4%
——6——CVE-2024-53772—20.4%
——6——CVE-2026-42426—20.4%
——6——CVE-2026-33874—20.4%
——6——CVE-2025-7881—20.4%
——6——CVE-2016-1963—20.4%
——6——CVE-2025-54571—20.4%
——6——CVE-2023-46616—20.4%
——6——CVE-2025-7426—20.4%
——6——CVE-2022-22359—20.4%
——6——CVE-2025-378867.8 HIG20.4%
——6In the Linux kernel, the following vulnerability has been resolved:
pds_core: make wait_context part of q_info
Make the wait_context a full part of the q_info struct rather
than a stack variable that goes away after pdsc_adminq_post()
is done so that the context is still available after the wait
loop has given up.
There was a case where a slow development firmware caused
the adminq request to time out, but then later the FW finally
finished the request and sent the interrupt. The handler tried
to complete_all() the completion context that had been created
on the stack in pdsc_adminq_post() but no longer existed.
This caused bad pointer usage, kernel crashes, and much wailing
and gnashing of teeth.38dCVE-2025-7259—20.4%
——6——CVE-2025-20379—20.4%
——6——CVE-2024-270507.8 HIG20.4%
——6In the Linux kernel, the following vulnerability has been resolved:
libbpf: Use OPTS_SET() macro in bpf_xdp_query()
When the feature_flags and xdp_zc_max_segs fields were added to the libbpf
bpf_xdp_query_opts, the code writing them did not use the OPTS_SET() macro.
This causes libbpf to write to those fields unconditionally, which means
that programs compiled against an older version of libbpf (with a smaller
size of the bpf_xdp_query_opts struct) will have its stack corrupted by
libbpf writing out of bounds.
The patch adding the feature_flags field has an early bail out if the
feature_flags field is not part of the opts struct (via the OPTS_HAS)
macro, but the patch adding xdp_zc_max_segs does not. For consistency, this
fix just changes the assignments to both fields to use the OPTS_SET()
macro.33dCVE-2020-9092—20.4%
——6——CVE-2008-4832—20.4%
——6——