Vulnerabilities exploitable today
367,851in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,687
New KEV · 24H0
Exploit Today ≥ 701,629
Distribution · last window
- Critical2,393
- High9,631
- Medium5,587
- Low548
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2024-53952—18.4%
——6——CVE-2023-41304—18.4%
——6——CVE-2024-6634—18.4%
——6——CVE-2026-227547.5 HIG18.4%
——6Vulnerability in Spring Spring Security. If an application uses <sec:intercept-url servlet-path="/servlet-path" pattern="/endpoint/**"/> to define the servlet path for computing a path matcher, then the servlet path is not included and the related authorization rules are not exercised. This can lead to an authorization bypass.This issue affects Spring Security: from 7.0.0 through 7.0.4.49dCVE-2022-26864—18.4%
——6——CVE-2020-24491—18.4%
——6——CVE-2022-50942—18.4%
——6——CVE-2014-7392—18.4%
——6——CVE-2022-49320—18.4%
——6——CVE-2026-1110—18.4%
——6——CVE-2025-25733—18.4%
——6——CVE-2014-6961—18.4%
——6——CVE-2026-86246.1 MED18.4%
——6The LJ comments import: reloaded plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via PHP_SELF Parameter in all versions up to, and including, 0.97.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The vulnerability arises specifically because PHP_SELF includes attacker-controllable PATH_INFO appended to the script name, and there are two distinct unsanitized echo points for this value in the same function.40dCVE-2026-86266.1 MED18.4%
——6The SponsorMe plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via PHP_SELF Parameter in all versions up to, and including, 0.5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The PHP_SELF value is reflected in two separate locations within the vulnerable function — a form action attribute and an anchor href attribute — both of which can be exploited by appending a crafted payload to the wp-admin/admin.php URL path.40dCVE-2025-27028—18.4%
——6——CVE-2026-792014.3 MED18.4%
——6Improper access control in Workers in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)5dCVE-2025-59023—18.4%
——6——CVE-2023-39070—18.4%
——6——CVE-2025-25178—18.4%
——6——CVE-2026-5706—18.4%
——6In Bluetooth Mesh SDK 6.1.4 and earlier, malformed extended advertisements can trigger out-of-bounds writes leading to stack corruption and remote code execution. These messages must come from a device that has already joined the network. Only provisioners supporting extended advertisements may be impacted.4dCVE-2024-2089—18.4%
——6——CVE-2025-62479—18.4%
——6——CVE-2026-324639.9 CRI18.4%
——6Contributor Arbitrary File Upload in Sync Post With Other Site <= 1.9.3 versions.13dCVE-2026-1782—18.4%
——6——CVE-2014-7449—18.4%
——6——CVE-2014-6960—18.4%
——6——CVE-2026-102225.6 MED18.4%
——6A security flaw has been discovered in NousResearch hermes-agent up to 2026.4.30. Affected by this issue is the function _sanitize_env_lines of the file hermes_cli/config.py. The manipulation results in injection. It is possible to launch the attack remotely. The attack requires a high level of complexity. The exploitation is known to be difficult. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.42dCVE-2025-5984—18.4%
——6——CVE-2026-658996.1 MED18.4%
——6DOMPurify 3.0.0 before 3.4.9 does not reset the retained Trusted Types policy when clearConfig() is called, so a DOMPurify instance reused across trust boundaries stays bound to a previously supplied TRUSTED_TYPES_POLICY. A later caller that requests RETURN_TRUSTED_TYPE output receives a TrustedHTML object created by the old (potentially unsafe) policy rather than a clean default, which can lead to script execution at a Trusted Types sink. Passing TRUSTED_TYPES_POLICY: null on the later call also does not clear the retained policy.35dCVE-2024-23288—18.4%
——6——CVE-2025-62244—18.4%
——6——CVE-2024-49531—18.4%
——6——CVE-2026-0561—18.4%
——6——CVE-2024-2506—18.4%
——6——CVE-2026-41068—18.4%
——6——CVE-2025-15450—18.4%
——6——CVE-2025-13147—18.4%
——6——CVE-2025-60096—18.4%
——6——CVE-2026-33617—18.4%
——6——CVE-2024-34477—18.4%
——6——