Vulnerabilities exploitable today
358,921in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,665
New KEV · 24H0
Exploit Today ≥ 701,607
Distribution · last window
- Critical2,711
- High11,665
- Medium7,447
- Low684
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2025-64847—9.9%
——3——CVE-2026-344166.1 MED9.9%
——3OSCAL-GUI contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser by injecting malicious input through the project request parameter. Attackers can craft a malicious URL containing unsanitized input that breaks out of the JavaScript string and HTML attribute context in the body onload event handler to execute arbitrary scripts when the link is visited by a victim.21dCVE-2025-55311—9.9%
——3——CVE-2024-57916—9.9%
——3——CVE-2025-64547—9.9%
——3——CVE-2024-23237—9.9%
——3——CVE-2025-64840—9.9%
——3——CVE-2026-161553.5 LOW9.9%
——3A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0. Affected by this issue is some unknown functionality of the file /schoolyr.php. The manipulation of the argument sy leads to cross site scripting. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.23dCVE-2026-115343.5 LOW9.9%
——3A vulnerability was detected in imvks786 student_management_system up to 9599b560ad3c3b83e75d328b76bedcd489ef1f46. Affected by this issue is some unknown functionality of the file /add.php. The manipulation of the argument name/address/fname results in cross site scripting. It is possible to launch the attack remotely. The exploit is now public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.21dCVE-2026-162033.5 LOW9.9%
——3A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0. Affected by this issue is some unknown functionality of the file /forCYS.php. Such manipulation of the argument course leads to cross site scripting. The attack may be performed from remote. The exploit is publicly available and might be used.24dCVE-2022-48225—9.9%
——3——CVE-2019-5257—9.9%
——3——CVE-2019-16354—9.9%
——3——CVE-2025-2763—9.9%
——3——CVE-2024-32857—9.9%
——3——CVE-2025-8607—9.9%
——3——CVE-2026-93045.0 MED9.9%
——3A security flaw has been discovered in calcom cal.diy up to 4.9.4. The affected element is the function validateUrlForSSRF of the file apps/web/app/api/logo/route.ts of the component Logo API. The manipulation results in server-side request forgery. It is possible to launch the attack remotely. Attacks of this nature are highly complex. The exploitability is described as difficult. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.21dCVE-2025-0056—9.9%
——3——CVE-2020-1875—9.9%
——3——CVE-2026-1333—9.9%
——3——CVE-2025-48294—9.9%
——3——CVE-2024-21067—9.9%
——3——CVE-2025-64827—9.9%
——3——CVE-2025-47183—9.9%
——3——CVE-2025-1112—9.9%
——3——CVE-2025-8896—9.9%
——3——CVE-2021-21591—9.9%
——3——CVE-2021-33634—9.9%
——3——CVE-2021-21590—9.9%
——3——CVE-2025-2862—9.9%
——3——CVE-2025-21446—9.9%
——3——CVE-2021-29526—9.9%
——3——CVE-2026-497825.4 MED9.9%
——3Missing Authorization vulnerability in Elementor Elementor Website Builder allows Exploiting Incorrectly Configured Access Control Security Levels.
This issue affects Elementor Website Builder: from n/a through 4.1.0.22dCVE-2023-22282—9.9%
——3——CVE-2023-41372—9.9%
——3——CVE-2026-4994—9.9%
——3——CVE-2025-55003—9.9%
——3——CVE-2025-220157.8 HIG9.9%
——3In the Linux kernel, the following vulnerability has been resolved:
mm/migrate: fix shmem xarray update during migration
A shmem folio can be either in page cache or in swap cache, but not at the
same time. Namely, once it is in swap cache, folio->mapping should be
NULL, and the folio is no longer in a shmem mapping.
In __folio_migrate_mapping(), to determine the number of xarray entries to
update, folio_test_swapbacked() is used, but that conflates shmem in page
cache case and shmem in swap cache case. It leads to xarray multi-index
entry corruption, since it turns a sibling entry to a normal entry during
xas_store() (see [1] for a userspace reproduction). Fix it by only using
folio_test_swapcache() to determine whether xarray is storing swap cache
entries or not to choose the right number of xarray entries to update.
[1] https://lore.kernel.org/linux-mm/Z8idPCkaJW1IChjT@casper.infradead.org/
Note:
In __split_huge_page(), folio_test_anon() && folio_test_swapcache() is
used to get swap_cache address space, but that ignores the shmem folio in
swap cache case. It could lead to NULL pointer dereferencing when a
in-swap-cache shmem folio is split at __xa_store(), since
!folio_test_anon() is true and folio->mapping is NULL. But fortunately,
its caller split_huge_page_to_list_to_order() bails out early with EBUSY
when folio->mapping is NULL. So no need to take care of it here.14dCVE-2023-21448—9.9%
——3——CVE-2021-29553—9.9%
——3——