Vulnerabilities exploitable today
364,588in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,675
New KEV · 24H0
Exploit Today ≥ 701,620
Distribution · last window
- Critical2,394
- High10,137
- Medium5,050
- Low465
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-342296.1 MED13.6%
——4Emlog is an open source website building system. Prior to version 2.6.8, there is a stored cross-site scripting (XSS) vulnerability in emlog comment module via URI scheme validation bypass. This issue has been patched in version 2.6.8.32dCVE-2021-41196—13.6%
——4——CVE-2021-41198—13.6%
——4——CVE-2025-23489—13.6%
——4——CVE-2021-41199—13.6%
——4——CVE-2025-23711—13.6%
——4——CVE-2026-24050—13.6%
——4——CVE-2025-54232—13.6%
——4——CVE-2025-43459—13.6%
——4——CVE-2025-46308—13.6%
——4——CVE-2020-10710—13.6%
——4——CVE-2026-48871—13.6%
——4——CVE-2025-9541—13.6%
——4——CVE-2021-38976—13.6%
——4——CVE-2026-745288.0 HIG13.6%
——4In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: hci_sync: hold conn in hci_past_sync() callback
Avoids giving freed pointers to hci_conn_valid(), which kmalloc may have
reused.
Hold refcount to avoid that.9dCVE-2025-23461—13.6%
——4——CVE-2018-11847—13.6%
——4——CVE-2024-27260—13.6%
——4——CVE-2019-20546—13.6%
——4——CVE-2024-438467.8 HIG13.6%
——4In the Linux kernel, the following vulnerability has been resolved:
lib: objagg: Fix general protection fault
The library supports aggregation of objects into other objects only if
the parent object does not have a parent itself. That is, nesting is not
supported.
Aggregation happens in two cases: Without and with hints, where hints
are a pre-computed recommendation on how to aggregate the provided
objects.
Nesting is not possible in the first case due to a check that prevents
it, but in the second case there is no check because the assumption is
that nesting cannot happen when creating objects based on hints. The
violation of this assumption leads to various warnings and eventually to
a general protection fault [1].
Before fixing the root cause, error out when nesting happens and warn.
[1]
general protection fault, probably for non-canonical address 0xdead000000000d90: 0000 [#1] PREEMPT SMP PTI
CPU: 1 PID: 1083 Comm: kworker/1:9 Tainted: G W 6.9.0-rc6-custom-gd9b4f1cca7fb #7
Hardware name: Mellanox Technologies Ltd. MSN3700/VMOD0005, BIOS 5.11 01/06/2019
Workqueue: mlxsw_core mlxsw_sp_acl_tcam_vregion_rehash_work
RIP: 0010:mlxsw_sp_acl_erp_bf_insert+0x25/0x80
[...]
Call Trace:
<TASK>
mlxsw_sp_acl_atcam_entry_add+0x256/0x3c0
mlxsw_sp_acl_tcam_entry_create+0x5e/0xa0
mlxsw_sp_acl_tcam_vchunk_migrate_one+0x16b/0x270
mlxsw_sp_acl_tcam_vregion_rehash_work+0xbe/0x510
process_one_work+0x151/0x370
worker_thread+0x2cb/0x3e0
kthread+0xd0/0x100
ret_from_fork+0x34/0x50
ret_from_fork_asm+0x1a/0x30
</TASK>21dCVE-2024-31684—13.6%
——4——CVE-2026-13537—13.6%
——4——CVE-2026-185845.4 MED13.6%
——4A security vulnerability has been detected in GL.iNet E5800, E750, X2000, X3000, XE3000 and XE300 up to 20260707. Impacted is an unknown function of the file /sdk/v1 of the component eSIM LPA API. Such manipulation leads to improper authorization. The attack can only be initiated within the local network. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.13dCVE-2026-444519.3 CRI13.6%
——4Lumiverse is a full-featured AI chat application. Prior to 0.9.7, the component override system transpiles user-supplied TSX via Sucrase and evaluates it with new Function, shadowing dangerous globals (fetch, window, eval, etc.) with undefined. A static source validator (validateComponentOverrideSource) additionally blocks these identifiers by word-boundary regex. Both controls are bypassed. String-split bypass of the static validator: any blocked identifier can be reconstructed at runtime from string fragments ('ownerDoc' + 'ument'). DOM ref escape from the sandbox: useRef and useEffect are provided in scope. A ref attached to a rendered element gives a live DOM node. From any real DOM node, node['ownerDoc'+'ument']['def'+'aultView'] yields the real window, bypassing all identifier shadows. Theme packs (.lumitheme / .lumiverse-theme) are the shareable delivery mechanism. A malicious pack is an exploit path: the victim imports the file, enables one component override in the Theme Editor, and the payload fires in their authenticated session.This vulnerability is fixed in 0.9.7.33dCVE-2021-46965—13.6%
——4——CVE-2025-43460—13.6%
——4——CVE-2025-12281—13.6%
——4——CVE-2025-12280—13.6%
——4——CVE-2024-56603—13.6%
——4——CVE-2024-47082—13.6%
——4——CVE-2026-57646—13.6%
——4——CVE-2026-44567—13.6%
——4——CVE-2023-43577—13.6%
——4——CVE-2026-162164.3 MED13.6%
——4A weakness has been identified in geex-arts django-jet up to 1.0.8. Affected is an unknown function of the component OAuth Handler. Executing a manipulation can lead to cross-site request forgery. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.35dCVE-2023-43578—13.6%
——4——CVE-2024-45687—13.6%
——4——CVE-2024-44129—13.6%
——4——CVE-2025-8224—13.6%
——4——CVE-2026-176178.5 HIG13.6%
——4IBM Application Gateway Operator 22.2 through 26.06 is vulnerable to Server-Side Request Forgery (SSRF) due to insufficient validation of URLs specified in custom resources.15dCVE-2026-46396—13.6%
——4——