Vulnerabilities exploitable today
369,308in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,695
New KEV · 24H0
Exploit Today ≥ 701,636
Distribution · last window
- Critical2,137
- High7,613
- Medium5,627
- Low542
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2020-24485—20.4%
——6——CVE-2012-1942—20.4%
——6——CVE-2025-11289—20.4%
——6——CVE-2026-33682—20.4%
——6——CVE-2024-8833—20.4%
——6——CVE-2025-54895—20.4%
——6——CVE-2022-38199—20.4%
——6——CVE-2024-7755—20.4%
——6——CVE-2026-844287.5 HIG20.4%
——6fastify versions before 5.12.2 implement the case-insensitive nature of HTTP header names by lowercasing names in a route's header schema before compiling it, but the transformation is incomplete: it lowercases the properties keys and the root-level required array, and does not lowercase the trigger and dependent names inside the JSON Schema Draft 7 dependencies keyword. Because Node stores request header names in lowercase, a canonical-case dependency such as requiring an authentication header whenever a privileged-mode header is present never matches, and the presence assertion is silently skipped. An unauthenticated remote client can therefore send the header that activates a privileged branch while omitting the header the dependency was meant to require, bypassing the conditional check. Users should upgrade to fastify 5.12.2 or later.2dCVE-2025-399427.5 HIG20.4%
——6In the Linux kernel, the following vulnerability has been resolved:
ksmbd: smbdirect: verify remaining_data_length respects max_fragmented_recv_size
This is inspired by the check for data_offset + data_length.38dCVE-2024-26982—20.4%
——6——CVE-2025-43555—20.4%
——6——CVE-2025-66545—20.4%
——6——CVE-2023-32384—20.4%
——6——CVE-2022-50761—20.4%
——6——CVE-2021-34719—20.4%
——6——CVE-2024-33662—20.4%
——6——CVE-2024-29869—20.4%
——6——CVE-2025-11458—20.4%
——6——CVE-2026-666718.1 HIG20.4%
——6Unauthenticated Local File Inclusion in Verdure Core <= 1.2 versions.13dCVE-2026-783226.5 MED20.4%
——6A flaw was found in file-roller. When opening or extracting a malicious 7z or RAR archive containing a file entry with an excessively long path, file-roller's progress-line parsing copies the path into a fixed-size stack buffer using an unbounded string copy. This can trigger a stack buffer overflow and cause file-roller to terminate, resulting in a denial of service. To exploit this flaw, a victim must open or extract the crafted archive using file-roller.9dCVE-2024-13041—20.4%
——6——CVE-2025-30325—20.4%
——6——CVE-2026-543385.3 MED20.4%
——6JupyterHub is software that allows users to create a multi-user server for Jupyter notebooks. Prior to 5.5.0, invalid input to form-based login authenticators can place an unbounded attacker-controlled username in failed-login logs, allowing an unauthenticated attacker to consume logging and storage resources. This issue is fixed in version 5.5.0.27dCVE-2022-50776—20.4%
——6——CVE-2021-479418.2 HIG20.4%
——6WordPress Plugin Survey & Poll 1.5.7.3 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the wp_sap cookie parameter. Attackers can craft SQL payloads in the cookie to extract sensitive database information including usernames, passwords, and other confidential data from the WordPress database.43dCVE-2025-26884—20.4%
——6——CVE-2020-9959—20.4%
——6——CVE-2023-32627—20.4%
——6——CVE-2025-10929—20.4%
——6——CVE-2023-40456—20.4%
——6——CVE-2025-54105—20.4%
——6——CVE-2019-14763—20.4%
——6——CVE-2025-13531—20.4%
——6——CVE-2017-7560—20.4%
——6——CVE-2026-24562—20.4%
——6——CVE-2021-479246.4 MED20.4%
——6Ultimate Product Catalogue 5.8.2 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through the price parameter. Attackers can submit POST requests to post.php with HTML/JavaScript payloads in the price field to execute arbitrary code when the product is viewed.43dCVE-2025-30326—20.4%
——6——CVE-2026-22447—20.4%
——6——CVE-2026-202788.8 HIG20.4%
——6As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening releases that address multiple internally discovered vulnerabilities.
The vulnerabilities tracked by CVE-2026-20278 are related to improper neutralization issues that are grouped under the Common Weakness Enumeration (CWE) CWE-707.3d