Vulnerabilities exploitable today
360,835in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,665
New KEV · 24H0
Exploit Today ≥ 701,607
Distribution · last window
- Critical2,641
- High11,456
- Medium7,085
- Low644
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2023-45605—12.1%
——4——CVE-2022-48942—12.1%
——4——CVE-2022-3111—12.0%
——4——CVE-2025-22821—12.0%
——4——CVE-2018-253527.1 HIG12.0%
——4WordPress Ultimate Form Builder Lite plugin version 1.3.7 and below contains an SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code through the entry_id POST parameter. Attackers can send POST requests to the admin-ajax.php endpoint with the ufbl_get_entry_detail_action action to extract, modify, or escalate privileges within the WordPress database.26dCVE-2022-36337—12.0%
——4——CVE-2024-36250—12.0%
——4——CVE-2022-3106—12.0%
——4——CVE-2024-42252—12.0%
——4——CVE-2026-40590—12.0%
——4——CVE-2025-22585—12.0%
——4——CVE-2025-0249—12.0%
——4——CVE-2025-22339—12.0%
——4——CVE-2026-33738—12.0%
——4——CVE-2025-22818—12.0%
——4——CVE-2026-482337.1 HIG12.0%
——4Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in ajax/sit_incidents.php where the offset GET parameter is concatenated into the LIMIT clause of a SELECT statement without sanitization. Authenticated attackers can craft requests that alter query semantics to read, modify, or destroy database contents.26dCVE-2025-22267—12.0%
——4——CVE-2022-50859—12.0%
——4——CVE-2018-253477.1 HIG12.0%
——4WordPress Contact Form Maker Plugin 1.12.20 contains SQL injection vulnerabilities that allow authenticated attackers to manipulate database queries through the FormMakerSQLMapping and generete_csv_fmc AJAX actions. Attackers can inject malicious SQL code via the 'name' and 'search_labels' parameters to extract sensitive database information or escalate privileges.26dCVE-2019-25299—12.0%
——4——CVE-2020-0256—12.0%
——4——CVE-2025-43731—12.0%
——4——CVE-2020-36774—12.0%
——4——CVE-2025-43734—12.0%
——4——CVE-2024-38890—12.0%
——4——CVE-2026-584452.7 LOW12.0%
——4Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API4dCVE-2022-50843—12.0%
——4——CVE-2025-43791—12.0%
——4——CVE-2025-43756—12.0%
——4——CVE-2026-147756.3 MED12.0%
——4A vulnerability was identified in SourceCodester Onlne Examination & Learning Management System 1.0. Affected is an unknown function of the file /process_lesson.php. Such manipulation of the argument user_id leads to unrestricted upload. The attack may be launched remotely. The exploit is publicly available and might be used. The name of the affected product appears to have a typo in it.42dCVE-2025-521626.5 MED12.0%
——4agorum Software GmbH Agorum core open v11.9.2 & v11.10.1 was discovered to contain an XML External Entity (XXE) via the RSSReader endpoint. This vulnerability allows attackers to access sensitive data via providing a crafted XML input.44dCVE-2025-43256—12.0%
——4——CVE-2024-38822—12.0%
——4——CVE-2026-114406.3 MED12.0%
——4A vulnerability was determined in theonedev onedev up to 15.0.5. This affects an unknown part of the file /repositories/{projectId}/default-branch of the component REST API. This manipulation of the argument project.defaultBranch causes improper authorization. It is possible to initiate the attack remotely. Upgrading to version 15.0.6 is able to mitigate this issue. Upgrading the affected component is advised.26dCVE-2025-22825—12.0%
——4——CVE-2022-3107—12.0%
——4——CVE-2022-3105—12.0%
——4——CVE-2024-48970—12.0%
——4——CVE-2022-3108—12.0%
——4——CVE-2025-220457.8 HIG12.0%
——4In the Linux kernel, the following vulnerability has been resolved:
x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs
On the following path, flush_tlb_range() can be used for zapping normal
PMD entries (PMD entries that point to page tables) together with the PTE
entries in the pointed-to page table:
collapse_pte_mapped_thp
pmdp_collapse_flush
flush_tlb_range
The arm64 version of flush_tlb_range() has a comment describing that it can
be used for page table removal, and does not use any last-level
invalidation optimizations. Fix the X86 version by making it behave the
same way.
Currently, X86 only uses this information for the following two purposes,
which I think means the issue doesn't have much impact:
- In native_flush_tlb_multi() for checking if lazy TLB CPUs need to be
IPI'd to avoid issues with speculative page table walks.
- In Hyper-V TLB paravirtualization, again for lazy TLB stuff.
The patch "x86/mm: only invalidate final translations with INVLPGB" which
is currently under review (see
<https://lore.kernel.org/all/20241230175550.4046587-13-riel@surriel.com/>)
would probably be making the impact of this a lot worse.19d