Vulnerabilities exploitable today
368,008in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,687
New KEV · 24H0
Exploit Today ≥ 701,629
Distribution · last window
- Critical2,385
- High9,639
- Medium5,593
- Low552
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-49288—18.9%
——6——CVE-2025-46067—18.9%
——6——CVE-2018-254058.2 HIG18.9%
——6eNdonesia Portal 8.7 contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through parameters in mod.php. Attackers can inject SQL through the artid, cid, did, contid, and aboutid parameters to extract sensitive database information including usernames, database names, and version details.42dCVE-2025-29782—18.9%
——6——CVE-2016-20072—18.9%
——6——CVE-2016-200658.2 HIG18.9%
——6Product Catalog 8 1.2 plugin for WordPress contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the selectedCategory parameter. Attackers can submit POST requests to the admin-ajax.php endpoint with the UpdateCategoryList action to extract sensitive database information from WordPress tables.43dCVE-2022-49314—18.9%
——6——CVE-2024-40840—18.9%
——6——CVE-2024-270227.8 HIG18.9%
——6In the Linux kernel, the following vulnerability has been resolved:
fork: defer linking file vma until vma is fully initialized
Thorvald reported a WARNING [1]. And the root cause is below race:
CPU 1 CPU 2
fork hugetlbfs_fallocate
dup_mmap hugetlbfs_punch_hole
i_mmap_lock_write(mapping);
vma_interval_tree_insert_after -- Child vma is visible through i_mmap tree.
i_mmap_unlock_write(mapping);
hugetlb_dup_vma_private -- Clear vma_lock outside i_mmap_rwsem!
i_mmap_lock_write(mapping);
hugetlb_vmdelete_list
vma_interval_tree_foreach
hugetlb_vma_trylock_write -- Vma_lock is cleared.
tmp->vm_ops->open -- Alloc new vma_lock outside i_mmap_rwsem!
hugetlb_vma_unlock_write -- Vma_lock is assigned!!!
i_mmap_unlock_write(mapping);
hugetlb_dup_vma_private() and hugetlb_vm_op_open() are called outside
i_mmap_rwsem lock while vma lock can be used in the same time. Fix this
by deferring linking file vma until vma is fully initialized. Those vmas
should be initialized first before they can be used.29dCVE-2022-49525—18.9%
——6——CVE-2017-13094—18.9%
——6——CVE-2026-57649—18.9%
——6——CVE-2025-24460—18.9%
——6——CVE-2026-6586—18.9%
——6——CVE-2022-49235—18.9%
——6——CVE-2025-63079—18.9%
——6——CVE-2021-27244—18.9%
——6——CVE-2018-254078.2 HIG18.9%
——6eNdonesia Portal 8.7 contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through parameters in mod.php. Attackers can inject SQL through the artid, cid, did, contid, and aboutid parameters across publisher, diskusi, galeri, content, and about modules to extract database information including usernames, database names, and version details.44dCVE-2025-67479—18.9%
——6——CVE-2026-116298.8 HIG18.9%
——6Use after free in Ozone in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)41dCVE-2026-45671—18.9%
——6——CVE-2021-47966—18.9%
——6——CVE-2023-36839—18.9%
——6——CVE-2025-92116.7 MED18.9%
——6Unescaped stored values in application security page in Otalio Ship Property Management System versions before 2.22.0 allows authenticated attackers to escalate privileges via persistent cross-site scripting2dCVE-2023-49761—18.9%
——6——CVE-2026-150558.2 HIG18.9%
——6In Bouncy Castle for Java before 1.85, PKCS#8 / PBES2 decryptors honour unbounded KDF cost from input. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.12 (1.0.X series), 2.0.12 (2.0.X series) and 2.1.12 (2.1.X series).5dCVE-2023-48363—18.9%
——6——CVE-2026-57622—18.9%
——6——CVE-2025-12249—18.9%
——6——CVE-2026-98244.3 MED18.9%
——6Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to check the manage_shared_channels permission in the /share-channel autocomplete handler, which allows an authenticated user without that permission to enumerate configured remote cluster connection metadata via slash command autocomplete.. Mattermost Advisory ID: MMSA-2026-0067651dCVE-2026-654914.3 MED18.9%
——6Subscriber Broken Access Control in Query Wrangler <= 1.5.57 versions.41dCVE-2026-576894.3 MED18.9%
——6Subscriber Broken Access Control in Werkstatt <= 4.7.2 versions.62dCVE-2024-9628—18.9%
——6——CVE-2026-43881—18.9%
——6——CVE-2026-421427.1 HIG18.9%
——6TypeBot is a chatbot builder tool. Prior to version 3.17.0, the `handleGetSheets` API handler (`POST /api/sheets/getSheets`) does not validate workspace membership, allowing any authenticated user to access and decrypt another workspace's Google Sheets OAuth credentials and retrieve spreadsheet data (sheet names, IDs, column headers). Version 3.17.0 fixes the issue.22dCVE-2026-178125.4 MED18.9%
——6Inappropriate implementation in DigitalCredentials in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)30dCVE-2026-33673—18.9%
——6——CVE-2026-550667.1 HIG18.9%
——6Vikunja is an open-source self-hosted task management platform. Prior to 2.4.0, POST /api/v1/projects/{project}/views/{view}/buckets/{bucket}/tasks accepts a body supplied task_id but TaskBucket.CanUpdate in pkg/models/kanban_task_bucket.go authorizes only the project, view, and bucket from the URL. updateTaskBucket then calls Task.ReadOne without a separate task permission check, returns the victim task contents, and can update the task done state when the attacker chooses a done bucket. Because task identifiers are global sequential values, an authenticated user can enumerate cross-tenant tasks and modify their completion metadata through both the v1 and v2 routes that share this model. This issue is fixed in version 2.4.0.2dCVE-2024-26651—18.9%
——6——CVE-2026-782037.1 HIG18.9%
——6Ghostwriter before 7.1.2 fails to validate template ownership in the report template swap endpoint, allowing attackers to attach client-scoped templates from other clients to their own reports. Attackers can exploit sequential template primary keys to enumerate and attach foreign templates, then generate reports to disclose template contents including letterhead, boilerplate, and methodology text.10d