Vulnerabilities exploitable today
358,291in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,662
New KEV · 24H0
Exploit Today ≥ 701,606
Distribution · last window
- Critical2,645
- High11,456
- Medium7,216
- Low681
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-57918—9.4%
——3——CVE-2022-48633—9.4%
——3——CVE-2025-21165—9.4%
——3——CVE-2025-21164—9.4%
——3——CVE-2025-5035—9.4%
——3——CVE-2023-52634—9.4%
——3——CVE-2018-11257—9.4%
——3——CVE-2025-24099—9.4%
——3——CVE-2026-712046.2 MED9.4%
——3changedetection.io's /settings save handler builds an update dict from form.data['application'] and blind-merges it into the stored application settings via .update.1dCVE-2025-21166—9.4%
——3——CVE-2026-226624.3 MED9.4%
——3prompts.chat prior to commit 1464475 contains a blind server-side request forgery vulnerability in the Wiro media generator that allows authenticated users to perform server-side fetches of user-controlled inputImageUrl parameters. Attackers can exploit this vulnerability by sending POST requests to the /api/media-generate endpoint to probe internal networks, access internal services, and exfiltrate data through the upstream Wiro service without receiving direct response bodies.18dCVE-2025-32802—9.4%
——3——CVE-2026-340493.3 LOW9.4%
——3Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. From 4.0.0-beta.451 through 4.0.0-beta.470, database backup handling for MongoDB collection names did not fully validate shell metacharacters, allowing a highly privileged attacker who can configure backup inputs to inject commands. This issue is fixed in version 4.0.0-beta.471.35dCVE-2026-6532—9.4%
——3——CVE-2023-53798—9.4%
——3——CVE-2026-143436.4 MED9.4%
——3The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'note_before' and 'note_after' Shortcode Attributes in all versions up to, and including, 3.3.61 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Because wp_kses_post filters post content on save for users without unfiltered_html, only kses-allowed tag and attribute payloads that survive save-time filtering will reach the unescaped sink; however, the sink itself remains unsafe and such payloads can still execute in the browser when a user renders the shortcode.33dCVE-2017-13269—9.4%
——3——CVE-2026-27360—9.4%
——3——CVE-2026-22863—9.4%
——3——CVE-2026-6551—9.4%
——3——CVE-2023-532577.1 HIG9.4%
——3In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: check S1G action frame size
Before checking the action code, check that it even
exists in the frame.7dCVE-2024-29773—9.4%
——3——CVE-2026-7209—9.4%
——3——CVE-2025-24034—9.4%
——3——CVE-2026-2721—9.4%
——3——CVE-2026-28882—9.4%
——3——CVE-2024-26275—9.4%
——3——CVE-2022-49851—9.4%
——3——CVE-2026-59368.5 HIG9.4%
——3An attacker can control a server-side HTTP request by supplying a crafted URL, causing the server to initiate requests to arbitrary destinations. This behavior may be exploited to probe internal network services, access otherwise unreachable endpoints (e.g., cloud metadata services), or bypass network access controls, potentially leading to sensitive information disclosure and further compromise of the internal environment.35dCVE-2022-50617—9.4%
——3——CVE-2021-47723—9.4%
——3——CVE-2025-13136—9.4%
——3——CVE-2026-1591—9.4%
——3——CVE-2025-21921—9.4%
——3——CVE-2026-428625.0 MED9.4%
——3Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, a mass assignment vulnerability exists in the tool update endpoint of FlowiseAI. The endpoint allows authenticated users to modify server-controlled properties such as workspaceId, createdDate, and updatedDate when updating a tool resource. Due to missing server-side validation and authorization checks, an attacker can manipulate the workspaceId field and reassign tools to arbitrary workspaces. This breaks tenant isolation in multi-workspace environments. This issue has been patched in version 3.1.2.20dCVE-2022-50637—9.4%
——3——CVE-2026-530728.8 HIG9.4%
——3In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER
When protocol sets HCI_PROTO_DEFER, hci_conn_request_evt() calls
hci_connect_cfm(conn) without hdev->lock. Generally hci_connect_cfm()
assumes it is held, and if conn is deleted concurrently -> UAF.
Only SCO and ISO set HCI_PROTO_DEFER and only for defer setup listen,
and HCI_EV_CONN_REQUEST is not generated for ISO. In the non-deferred
listening socket code paths, hci_connect_cfm(conn) is called with
hdev->lock held.
Fix by holding the lock.21dCVE-2023-38411—9.4%
——3——CVE-2020-10040—9.4%
——3——CVE-2017-13268—9.4%
——3——