Vulnerabilities exploitable today
364,588in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,675
New KEV · 24H0
Exploit Today ≥ 701,620
Distribution · last window
- Critical2,394
- High10,137
- Medium5,050
- Low465
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2021-33897—13.6%
——4——CVE-2026-733827.1 HIG13.6%
——4Unauthenticated Cross Site Scripting (XSS) in Site Reviews <= 8.2.0 versions.5dCVE-2024-24245—13.6%
——4——CVE-2024-46726—13.6%
——4——CVE-2025-14618—13.6%
——4——CVE-2021-27209—13.6%
——4——CVE-2023-23750—13.6%
——4——CVE-2023-42529—13.6%
——4——CVE-2025-53055—13.6%
——4——CVE-2021-47121—13.6%
——4——CVE-2022-50080—13.6%
——4——CVE-2025-59016—13.6%
——4——CVE-2022-31224—13.6%
——4——CVE-2025-1540—13.6%
——4——CVE-2022-50712—13.6%
——4——CVE-2025-69296—13.6%
——4——CVE-2026-1080—13.6%
——4——CVE-2026-24095—13.6%
——4——CVE-2026-130586.5 MED13.6%
——4An authenticated user with basic write privileges can cause the mongod process to terminate abnormally by sending a crafted transaction command with an incomplete set of required fields. The issue stems from inconsistent validation across related transaction command parameters, resulting in a fatal internal invariant failure and denial of service.20dCVE-2026-175067.2 HIG13.6%
——4The Independent Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 404 not_found_url tracking parameter in versions up to, and including, 2.15.0. This is due to the get_cell_content() function applying urldecode() after esc_url() when rendering the URL column for 404 entries — a sequence that allows percent-encoded HTML to pass URL validation and then be reconstructed as raw markup, which wp_kses_post() does not strip because it retains img elements and data-* attributes, and because the public REST endpoint /iawp/search accepts unauthenticated requests as long as they carry a signature that is itself embedded in public page HTML. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.13dCVE-2026-25025—13.6%
——4——CVE-2024-530917.8 HIG13.6%
——4In the Linux kernel, the following vulnerability has been resolved:
bpf: Add sk_is_inet and IS_ICSK check in tls_sw_has_ctx_tx/rx
As the introduction of the support for vsock and unix sockets in sockmap,
tls_sw_has_ctx_tx/rx cannot presume the socket passed in must be IS_ICSK.
vsock and af_unix sockets have vsock_sock and unix_sock instead of
inet_connection_sock. For these sockets, tls_get_ctx may return an invalid
pointer and cause page fault in function tls_sw_ctx_rx.
BUG: unable to handle page fault for address: 0000000000040030
Workqueue: vsock-loopback vsock_loopback_work
RIP: 0010:sk_psock_strp_data_ready+0x23/0x60
Call Trace:
? __die+0x81/0xc3
? no_context+0x194/0x350
? do_page_fault+0x30/0x110
? async_page_fault+0x3e/0x50
? sk_psock_strp_data_ready+0x23/0x60
virtio_transport_recv_pkt+0x750/0x800
? update_load_avg+0x7e/0x620
vsock_loopback_work+0xd0/0x100
process_one_work+0x1a7/0x360
worker_thread+0x30/0x390
? create_worker+0x1a0/0x1a0
kthread+0x112/0x130
? __kthread_cancel_work+0x40/0x40
ret_from_fork+0x1f/0x40
v2:
- Add IS_ICSK check
v3:
- Update the commits in Fixes21dCVE-2021-1423—13.6%
——4——CVE-2023-54059—13.6%
——4——CVE-2023-36608—13.6%
——4——CVE-2026-22520—13.6%
——4——CVE-2025-6024—13.6%
——4——CVE-2023-43573—13.6%
——4——CVE-2026-2400—13.6%
——4——CVE-2026-666977.1 HIG13.6%
——4Unauthenticated Cross Site Scripting (XSS) in Colissimo Officiel : Méthodes de livraison pour WooCommerce <= 2.10.0 versions.11dCVE-2026-6399—13.6%
——4——CVE-2025-67833—13.6%
——4——CVE-2025-62928—13.6%
——4——CVE-2025-69096—13.6%
——4——CVE-2026-22339—13.6%
——4——CVE-2022-493937.8 HIG13.6%
——4In the Linux kernel, the following vulnerability has been resolved:
misc: fastrpc: fix list iterator in fastrpc_req_mem_unmap_impl
This is another instance of incorrect use of list iterator and
checking it for NULL.
The list iterator value 'map' will *always* be set and non-NULL
by list_for_each_entry(), so it is incorrect to assume that the
iterator value will be NULL if the list is empty (in this case, the
check 'if (!map) {' will always be false and never exit as expected).
To fix the bug, use a new variable 'iter' as the list iterator,
while use the original variable 'map' as a dedicated pointer to
point to the found element.
Without this patch, Kernel crashes with below trace:
Unable to handle kernel access to user memory outside uaccess routines
at virtual address 0000ffff7fb03750
...
Call trace:
fastrpc_map_create+0x70/0x290 [fastrpc]
fastrpc_req_mem_map+0xf0/0x2dc [fastrpc]
fastrpc_device_ioctl+0x138/0xc60 [fastrpc]
__arm64_sys_ioctl+0xa8/0xec
invoke_syscall+0x48/0x114
el0_svc_common.constprop.0+0xd4/0xfc
do_el0_svc+0x28/0x90
el0_svc+0x3c/0x130
el0t_64_sync_handler+0xa4/0x130
el0t_64_sync+0x18c/0x190
Code: 14000016 f94000a5 eb05029f 54000260 (b94018a6)
---[ end trace 0000000000000000 ]---21dCVE-2025-67971—13.6%
——4——CVE-2024-35822—13.6%
——4——CVE-2024-35936—13.6%
——4——CVE-2024-41344—13.6%
——4——