Vulnerabilities exploitable today
366,901in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,685
New KEV · 24H0
Exploit Today ≥ 701,629
Distribution · last window
- Critical2,291
- High9,346
- Medium5,292
- Low508
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-15305—16.7%
——5Users were able to upload files with arbitrary MIME types to forms using FileUpload or ImageUpload elements with allowedMimeTypes configured. The restriction was not enforced server-side because the MimeTypeValidator was registered during form building before concrete form definition properties were applied, resulting in the validator never being added to the processing pipeline. This issue affects TYPO3 CMS versions 14.2.0-14.3.4.45dCVE-2026-6167—16.7%
——5——CVE-2026-6165—16.7%
——5——CVE-2025-31586—16.7%
——5——CVE-2025-22064—16.7%
——5——CVE-2026-136907.4 HIG16.7%
——5The UsersWP WordPress plugin before 1.2.67 does not validate the selected authentication provider in its two-factor login handler, allowing an attacker who already knows a user's credentials to bypass the second authentication factor and log in as that user.31dCVE-2026-5175—16.7%
——5——CVE-2025-58210—16.7%
——5——CVE-2026-6166—16.7%
——5——CVE-2026-3738—16.7%
——5——CVE-2026-7063—16.7%
——5——CVE-2026-2363—16.7%
——5——CVE-2026-4232—16.7%
——5——CVE-2024-54212—16.7%
——5——CVE-2025-14064—16.7%
——5——CVE-2025-2953—16.7%
——5——CVE-2024-33068—16.7%
——5——CVE-2024-445753.7 LOW16.7%
——5RELY-PCIe v22.2.1 to v23.1.0 does not set the Secure attribute for sensitive cookies in HTTPS sessions, which could cause the user agent to send those cookies in cleartext over an HTTP session.56dCVE-2025-31597—16.7%
——5——CVE-2024-29225—16.7%
——5——CVE-2025-31590—16.7%
——5——CVE-2021-3585—16.7%
——5——CVE-2026-4594—16.7%
——5——CVE-2026-4229—16.7%
——5——CVE-2025-49926—16.7%
——5——CVE-2026-4612—16.7%
——5——CVE-2025-31574—16.7%
——5——CVE-2025-23955—16.7%
——5——CVE-2025-31556—16.7%
——5——CVE-2026-56727.3 HIG16.7%
——5A vulnerability has been found in code-projects Simple IT Discussion Forum 1.0. Affected by this issue is some unknown functionality of the file /edit-category.php of the component Parameter Handler. The manipulation of the argument cat_id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.37dCVE-2025-31535—16.7%
——5——CVE-2026-41174—16.7%
——5——CVE-2026-4235—16.7%
——5——CVE-2022-37009—16.7%
——5——CVE-2023-529207.8 HIG16.7%
——5In the Linux kernel, the following vulnerability has been resolved:
bpf: support non-r10 register spill/fill to/from stack in precision tracking
Use instruction (jump) history to record instructions that performed
register spill/fill to/from stack, regardless if this was done through
read-only r10 register, or any other register after copying r10 into it
*and* potentially adjusting offset.
To make this work reliably, we push extra per-instruction flags into
instruction history, encoding stack slot index (spi) and stack frame
number in extra 10 bit flags we take away from prev_idx in instruction
history. We don't touch idx field for maximum performance, as it's
checked most frequently during backtracking.
This change removes basically the last remaining practical limitation of
precision backtracking logic in BPF verifier. It fixes known
deficiencies, but also opens up new opportunities to reduce number of
verified states, explored in the subsequent patches.
There are only three differences in selftests' BPF object files
according to veristat, all in the positive direction (less states).
File Program Insns (A) Insns (B) Insns (DIFF) States (A) States (B) States (DIFF)
-------------------------------------- ------------- --------- --------- ------------- ---------- ---------- -------------
test_cls_redirect_dynptr.bpf.linked3.o cls_redirect 2987 2864 -123 (-4.12%) 240 231 -9 (-3.75%)
xdp_synproxy_kern.bpf.linked3.o syncookie_tc 82848 82661 -187 (-0.23%) 5107 5073 -34 (-0.67%)
xdp_synproxy_kern.bpf.linked3.o syncookie_xdp 85116 84964 -152 (-0.18%) 5162 5130 -32 (-0.62%)
Note, I avoided renaming jmp_history to more generic insn_hist to
minimize number of lines changed and potential merge conflicts between
bpf and bpf-next trees.
Notice also cur_hist_entry pointer reset to NULL at the beginning of
instruction verification loop. This pointer avoids the problem of
relying on last jump history entry's insn_idx to determine whether we
already have entry for current instruction or not. It can happen that we
added jump history entry because current instruction is_jmp_point(), but
also we need to add instruction flags for stack access. In this case, we
don't want to entries, so we need to reuse last added entry, if it is
present.
Relying on insn_idx comparison has the same ambiguity problem as the one
that was fixed recently in [0], so we avoid that.
[0] https://patchwork.kernel.org/project/netdevbpf/patch/20231110002638.4168352-3-andrii@kernel.org/26dCVE-2023-31997—16.7%
——5——CVE-2026-42237—16.7%
——5——CVE-2025-31538—16.7%
——5——CVE-2025-31593—16.7%
——5——CVE-2026-8126—16.7%
——5——