Vulnerabilities exploitable today
363,850in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,673
New KEV · 24H0
Exploit Today ≥ 701,611
Distribution · last window
- Critical2,863
- High11,736
- Medium7,118
- Low667
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2024-23769—12.9%
——4——CVE-2026-39951—12.9%
——4——CVE-2026-350114.6 MED12.9%
——4Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in opena.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the frm_call GET parameter directly into page output. Attackers can craft a malicious URL containing a JavaScript payload in the frm_call parameter that executes in the victim's browser when the URL is visited.29dCVE-2025-8842—12.9%
——4——CVE-2023-51683—12.9%
——4——CVE-2026-350104.6 MED12.9%
——4Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in patient_JF.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the ticket_id GET parameter directly into a JavaScript variable assignment. Attackers can craft a malicious URL containing a JavaScript payload in the ticket_id parameter that executes in the victim's browser when the URL is visited.29dCVE-2018-252476.1 MED12.9%
——4MyBB Like Plugin 3.0.0 contains a stored cross-site scripting vulnerability. Authenticated attackers can inject script payloads into post or thread subjects; when other users view a profile that displays the attacker's liked posts, the unsanitized subject is rendered, executing the script in the viewer's browser.32dCVE-2026-350154.6 MED12.9%
——4Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in do_unit_mail.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the the_ticket GET parameter directly into a JavaScript variable assignment. Attackers can craft a malicious URL containing a JavaScript payload in the the_ticket parameter that executes in the victim's browser when the URL is visited.29dCVE-2025-30441—12.9%
——4——CVE-2026-27608—12.9%
——4——CVE-2026-614468.4 HIG12.9%
——4PraisonAI (praisonaiagents) before 1.6.78 contains a remote code execution vulnerability in the plugin manager, which loads and executes arbitrary Python (.py) files from project-level and user-home .praisonai/plugins/ directories using importlib spec_from_file_location() and exec_module() without code signing, integrity verification, or sandboxing. An attacker who can write a malicious .py file to a plugin directory (for example via path traversal, a supply chain attack, or a compromised dependency) achieves arbitrary code execution when the plugin system initializes.37dCVE-2022-39188—12.9%
——4——CVE-2021-475557.8 HIG12.9%
——4In the Linux kernel, the following vulnerability has been resolved:
net: vlan: fix underflow for the real_dev refcnt
Inject error before dev_hold(real_dev) in register_vlan_dev(),
and execute the following testcase:
ip link add dev dummy1 type dummy
ip link add name dummy1.100 link dummy1 type vlan id 100
ip link del dev dummy1
When the dummy netdevice is removed, we will get a WARNING as following:
=======================================================================
refcount_t: decrement hit 0; leaking memory.
WARNING: CPU: 2 PID: 0 at lib/refcount.c:31 refcount_warn_saturate+0xbf/0x1e0
and an endless loop of:
=======================================================================
unregister_netdevice: waiting for dummy1 to become free. Usage count = -1073741824
That is because dev_put(real_dev) in vlan_dev_free() be called without
dev_hold(real_dev) in register_vlan_dev(). It makes the refcnt of real_dev
underflow.
Move the dev_hold(real_dev) to vlan_dev_init() which is the call-back of
ndo_init(). That makes dev_hold() and dev_put() for vlan's real_dev
symmetrical.17dCVE-2023-29942—12.9%
——4——CVE-2025-8695—12.9%
——4——CVE-2025-21670—12.9%
——4——CVE-2026-167395.9 MED12.9%
——4The Epeken All Kurir for Woocommerce WordPress plugin through 2.1.2 does not verify that a payment-confirmation request originates from the owner of the targeted order, nor that any payment actually occurred, allowing unauthenticated attackers to mark arbitrary orders as confirmed and, in a non-default configuration, paid.7dCVE-2020-1690—12.9%
——4——CVE-2024-52415—12.9%
——4——CVE-2026-34236—12.9%
——4——CVE-2025-53663—12.9%
——4——CVE-2026-350134.6 MED12.9%
——4Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in street_view.php that allows authenticated attackers to inject arbitrary JavaScript by passing unsanitized values through the thelat and thelng GET parameters directly into JavaScript variable assignments. Attackers can craft a malicious URL containing a JavaScript payload in either parameter that executes in the victim's browser when the URL is visited.29dCVE-2026-44557—12.9%
——4——CVE-2025-5023—12.9%
——4——CVE-2025-64174—12.9%
——4——CVE-2023-44285—12.9%
——4——CVE-2024-31378—12.9%
——4——CVE-2025-10341—12.9%
——4——CVE-2025-10343—12.9%
——4——CVE-2025-53834—12.9%
——4——CVE-2026-493856.5 MED12.9%
——4In JetBrains YouTrack before 2026.1.13570 improper access control allowed low-privileged users to modify service accounts31dCVE-2025-10869—12.9%
——4——CVE-2018-25228—12.9%
——4——CVE-2025-49973—12.9%
——4——CVE-2023-40536—12.9%
——4——CVE-2025-21920—12.9%
——4——CVE-2023-44999—12.9%
——4——CVE-2025-10342—12.9%
——4——CVE-2026-342135.4 MED12.9%
——4Docmost is open-source collaborative wiki and documentation software. Starting in version 0.3.0 and prior to version 0.71.0, improper authorization in Docmost allows a low-privileged authenticated user to overwrite another page's attachment within the same workspace by supplying a victim `attachmentId` to `POST /api/files/upload`. This is a remote integrity issue requiring no victim interaction. Version 0.71.0 contains a patch.28dCVE-2026-144239.6 CRI12.9%
——4Type Confusion in Tint in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)50d