Vulnerabilities exploitable today
365,446in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,682
New KEV · 24H0
Exploit Today ≥ 701,626
Distribution · last window
- Critical2,324
- High9,977
- Medium4,917
- Low460
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2025-9327—14.5%
——4——CVE-2023-20168—14.5%
——4——CVE-2025-39989—14.5%
——4——CVE-2026-675294.3 MED14.5%
——4OpenProject is open-source, web-based project management software. Prior to 17.6.0, GET /api/v3/time_entries and GET /api/v3/cost_entries rendered _links.workPackage.title and _links.workPackage.href through associated_resource in modules/costs/lib/api/v3/time_entries/time_entry_representer.rb and modules/costs/lib/api/v3/cost_entries/cost_entry_representer.rb without checking WorkPackage.visible or view_work_packages, allowing users with view_time_entries or view_cost_entries to read private work package subjects and ids. This issue is fixed in 17.6.0.27dCVE-2026-31873—14.5%
——4——CVE-2026-199326.3 MED14.5%
——4A security flaw has been discovered in DefaultFuction Notice-System-Managent 2.0. This issue affects the function GroovyShell.evaluate of the file /execute of the component NoticeController. The manipulation results in code injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The project confirms, that "it’s being processed".7dCVE-2025-30615—14.5%
——4——CVE-2022-50238—14.5%
——4——CVE-2025-9323—14.5%
——4——CVE-2026-7494—14.5%
——4Nexus Repository 3 is vulnerable to Server-Side Request Forgery (SSRF) via the SSL Certificate Retrieval endpoint. A user holding the nexus:ssl-truststore:read permission could cause the server to initiate outbound connections to internal or otherwise restricted network hosts. This issue affects Nexus Repository 3.0.0 through versions prior to 3.94.0.43dCVE-2026-738715.3 MED14.5%
——4Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 3.2.18. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Helidon accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).3dCVE-2022-27089—14.5%
——4——CVE-2025-58055—14.5%
——4——CVE-2023-41051—14.5%
——4——CVE-2025-24330—14.5%
——4——CVE-2025-9325—14.5%
——4——CVE-2025-5834—14.5%
——4——CVE-2024-46802—14.5%
——4——CVE-2023-0058—14.5%
——4——CVE-2023-3438—14.5%
——4——CVE-2024-30140—14.5%
——4——CVE-2025-12481—14.5%
——4——CVE-2026-131762.7 LOW14.5%
——4The Eventin WordPress plugin before 4.1.21 does not validate a user-supplied webhook URL stored on events nor verify event ownership, allowing users with contributor-level access and above to trigger blind server-side requests to arbitrary hosts.6dCVE-2024-2113—14.5%
——4——CVE-2023-7125—14.5%
——4——CVE-2024-46768—14.5%
——4——CVE-2022-33954—14.5%
——4——CVE-2026-182777.1 HIG14.5%
——4Missing authorization in the OcrModelRight create and delete views in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to grant themselves access to another user's private OCR model and to revoke any user's OCR model access via a POST request, because the ownership check is placed in get_context_data() and therefore runs only on the GET rendering path9dCVE-2026-178736.5 MED14.5%
——4Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to bypass discretionary access control via a crafted HTML page. (Chromium security severity: Medium)24dCVE-2025-8337—14.5%
——4——CVE-2026-31887—14.5%
——4——CVE-2024-41746—14.5%
——4——CVE-2025-10732—14.5%
——4——CVE-2026-738725.3 MED14.5%
——4Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Helidon accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).3dCVE-2026-29780—14.5%
——4——CVE-2024-359197.8 HIG14.5%
——4In the Linux kernel, the following vulnerability has been resolved:
media: mediatek: vcodec: adding lock to protect encoder context list
Add a lock for the ctx_list, to avoid accessing a NULL pointer
within the 'vpu_enc_ipi_handler' function when the ctx_list has
been deleted due to an unexpected behavior on the SCP IP block.23dCVE-2021-25504—14.5%
——4——CVE-2026-44244—14.5%
——4——CVE-2025-63739—14.5%
——4——CVE-2024-38615—14.5%
——4——