Vulnerabilities exploitable today
356,768in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,662
New KEV · 24H0
Exploit Today ≥ 701,605
Distribution · last window
- Critical2,533
- High10,540
- Medium6,708
- Low668
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2025-43409—8.9%
——3——CVE-2025-53896—8.9%
——3——CVE-2026-179023.5 LOW8.9%
——3Inappropriate implementation in Editing in Google Chrome on Linux prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)6dCVE-2026-396055.3 MED8.9%
——3Missing Authorization vulnerability in Obadiah Super Custom Login super-custom-login allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Super Custom Login: from n/a through <= 1.1.16dCVE-2023-28411—8.9%
——3——CVE-2026-31916—8.9%
——3——CVE-2026-396485.3 MED8.9%
——3Missing Authorization vulnerability in themebeez Cream Blog cream-blog allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cream Blog: from n/a through <= 2.1.7.16dCVE-2021-27784—8.9%
——3——CVE-2026-57339—8.9%
——3——CVE-2024-50011—8.9%
——3——CVE-2025-55263—8.9%
——3——CVE-2020-3648—8.9%
——3——CVE-2026-396445.3 MED8.9%
——3Missing Authorization vulnerability in Roxnor Wp Ultimate Review wp-ultimate-review allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wp Ultimate Review: from n/a through <= 2.3.8.16dCVE-2026-578126.5 MED8.9%
——3Missing Authorization vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simply Schedule Appointments: from n/a through <= 1.6.12.4.27dCVE-2025-47678—8.9%
——3——CVE-2026-0496—8.9%
——3——CVE-2026-140134.3 MED8.9%
——3Inappropriate implementation in SVG in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)39dCVE-2026-99816.5 MED8.9%
——3Inappropriate implementation in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)20dCVE-2025-4539—8.9%
——3——CVE-2026-395855.3 MED8.9%
——3Missing Authorization vulnerability in Arraytics Booktics allows Exploiting Incorrectly Configured Access Control Security Levels.
This issue affects Booktics: from n/a through 1.0.16.16dCVE-2025-68457—8.9%
——3——CVE-2026-185687.5 HIG8.9%
——3XML::Sig versions from 0.29 before 0.72 for Perl allow signature verification bypass because verify returns true when every signature was skipped before any cryptographic check.
verify in lib/XML/Sig.pm counts the `//dsig:Signature` elements into `$numsigs` and iterates over them, but two paths reach `next` before any digest or key check runs: a `SignedInfo/Reference/@URI` that resolves to no element while `$numsigs` is greater than 1, and, when `id_attr` is set, a reference that does not match the requested ID. The loop records nothing about what it checked, so when every signature takes one of those paths control reaches the unconditional `return 1` that ends verify. Two `Signature` elements whose Reference URI names an ID that no element carries is enough, as is one such element combined with `id_attr`.
Any caller that passes untrusted XML to verify can receive a true return for a document in which no digest and no signature value was checked; a `cert` or `cert_text` trust anchor does not change this, because no key check runs. Versions up to 0.28 use an XML::XPath based verify that has no such skip and are not affected.4dCVE-2026-25963—8.9%
——3——CVE-2026-659116.1 MED8.9%
——3In DOMPurify through 3.3.3, function predicates supplied via ADD_ATTR or ADD_TAGS to DOMPurify.sanitize() persist in internal state (EXTRA_ELEMENT_HANDLING) across subsequent sanitize() calls on the same instance. If a later call on the same instance provides ADD_ATTR or ADD_TAGS as an array rather than a function, the previously set function handler is neither cleared nor overwritten, so it continues to approve attacker-controlled attributes or tags. This can allow dangerous event-handler attributes or forbidden tags (bypassing FORBID_TAGS) to survive sanitization, resulting in cross-site scripting. The vendor (Cure53) considers this an edge case outside DOMPurify's threat model; the referenced advisory lists 3.4.0 as the patched version.12dCVE-2023-40198—8.9%
——3——CVE-2023-52460—8.9%
——3——CVE-2025-1924—8.9%
——3——CVE-2018-9453—8.9%
——3——CVE-2018-9451—8.9%
——3——CVE-2026-99304.3 MED8.9%
——3Out of bounds write in Dawn in Google Chrome on Mac prior to 148.0.7778.216 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High)20dCVE-2022-30731—8.9%
——3——CVE-2024-36287—8.9%
——3——CVE-2025-14957—8.9%
——3——CVE-2025-52787—8.9%
——3——CVE-2024-48548—8.9%
——3——CVE-2022-49300—8.9%
——3——CVE-2026-396785.3 MED8.9%
——3Missing Authorization vulnerability in DOTonPAPER Pinpoint Booking System booking-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pinpoint Booking System: from n/a through <= 2.9.9.6.5.16dCVE-2025-54505—8.9%
——3——CVE-2025-27608—8.9%
——3——CVE-2025-52628—8.9%
——3——