Vulnerabilities exploitable today
367,284in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,687
New KEV · 24H0
Exploit Today ≥ 701,629
Distribution · last window
- Critical2,311
- High9,414
- Medium5,381
- Low529
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-472625.5 MED18.1%
——5containerd is an open-source container runtime. Versions prior to 1.7.33, 2.0.10, 2.1.9, 2.2.5 and 2.3.2, contain a vulnerability that allows a maliciously crafted image to cause a Denial of Service (DoS) condition. When creating a container from this image, memory exhaustion occurs, leading to an Out Of Memory (OOM) kill of the containerd process. This renders the container runtime API unavailable and can disrupt clients such as the Docker Engine or Kubernetes control-plane components. This issue has been fixed in versions 1.7.33, 2.0.10, 2.1.9, 2.2.5 and 2.3.2.61dCVE-2023-28368—18.1%
——5——CVE-2017-8214—18.1%
——5——CVE-2026-28499—18.1%
——5——CVE-2025-58004—18.1%
——5——CVE-2025-10466—18.1%
——5——CVE-2026-0511—18.1%
——5——CVE-2025-65500—18.1%
——5——CVE-2025-49997—18.1%
——5——CVE-2025-9735—18.1%
——5——CVE-2024-11180—18.1%
——5——CVE-2025-10332—18.1%
——5——CVE-2024-52358—18.1%
——5——CVE-2022-32875—18.1%
——5——CVE-2025-65501—18.1%
——5——CVE-2025-58685—18.1%
——5——CVE-2025-27600—18.1%
——5——CVE-2024-7019—18.1%
——5——CVE-2026-134407.2 HIG18.1%
——5The StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'message_popup' parameter in all versions up to, and including, 2.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit is possible because the 'ajd_protected' nonce required by the create_popup handler is exposed to all unauthenticated frontend visitors via wp_localize_script under bogo_save_url.ajd_nonce, effectively bypassing the nonce-only access control.35dCVE-2026-44460—18.1%
——5——CVE-2025-40577—18.1%
——5——CVE-2026-105867.2 HIG18.1%
——5The Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.1.3 via the `save_ai_generated_image()` function. This makes it possible for authenticated attackers, with Author-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.41dCVE-2024-39591—18.1%
——5——CVE-2020-6024—18.1%
——5——CVE-2025-50008—18.1%
——5——CVE-2023-5463—18.1%
——5——CVE-2016-6770—18.1%
——5——CVE-2024-41745—18.1%
——5——CVE-2026-45800—18.1%
——5——CVE-2022-28190—18.1%
——5——CVE-2025-65498—18.1%
——5——CVE-2022-49119—18.1%
——5——CVE-2025-48166—18.1%
——5——CVE-2024-24764—18.1%
——5——CVE-2024-32091—18.1%
——5——CVE-2026-4399—18.1%
——5——CVE-2025-65497—18.1%
——5——CVE-2025-63714—18.1%
——5——CVE-2025-62944—18.1%
——5——CVE-2024-52354—18.1%
——5——