Vulnerabilities exploitable today
356,750in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,662
New KEV · 24H0
Exploit Today ≥ 701,605
Distribution · last window
- Critical2,532
- High10,540
- Medium6,698
- Low663
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2025-10955—8.8%
——3——CVE-2026-398825.3 MED8.8%
——3OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to 1.43.0, the otlp HTTP exporters (traces/metrics/logs) read the full HTTP response body into an in-memory bytes.Buffer without a size cap. This is exploitable for memory exhaustion when the configured collector endpoint is attacker-controlled (or a network attacker can mitm the exporter connection). This vulnerability is fixed in 1.43.0.16dCVE-2025-8915—8.8%
——3——CVE-2022-490017.0 HIG8.8%
——3In the Linux kernel, the following vulnerability has been resolved:
riscv: fix race when vmap stack overflow
Currently, when detecting vmap stack overflow, riscv firstly switches
to the so called shadow stack, then use this shadow stack to call the
get_overflow_stack() to get the overflow stack. However, there's
a race here if two or more harts use the same shadow stack at the same
time.
To solve this race, we introduce spin_shadow_stack atomic var, which
will be swap between its own address and 0 in atomic way, when the
var is set, it means the shadow_stack is being used; when the var
is cleared, it means the shadow_stack isn't being used.
[Palmer: Add AQ to the swap, and also some comments.]6dCVE-2026-21278—8.8%
——3——CVE-2025-9214—8.8%
——3——CVE-2025-150287.2 HIG8.8%
——3The FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form submission fields in all versions up to, and including, 1.9.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.3dCVE-2018-6243—8.8%
——3——CVE-2024-45039—8.8%
——3——CVE-2025-27259—8.8%
——3——CVE-2025-22103—8.8%
——3——CVE-2020-11125—8.8%
——3——CVE-2024-30547—8.8%
——3——CVE-2020-26071—8.8%
——3——CVE-2023-53101—8.8%
——3——CVE-2026-40431—8.8%
——3——CVE-2022-36840—8.8%
——3——CVE-2025-22106—8.8%
——3——CVE-2026-81417.2 HIG8.8%
——3The Ajax Load More - Filters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'taxonomy_include_children' parameter in all versions up to, and including, 3.4.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.40dCVE-2024-35109—8.8%
——3——CVE-2025-6396—8.8%
——3——CVE-2026-66785.3 MED8.8%
——3Integer underflow in wc_PKCS7_DecryptOri when handling crafted Other Recipient Info, leading to incorrect length handling during decryption.39dCVE-2019-25276—8.8%
——3——CVE-2025-41439—8.8%
——3——CVE-2024-6356—8.8%
——3——CVE-2019-14094—8.8%
——3——CVE-2024-21202—8.8%
——3——CVE-2025-3000—8.8%
——3——CVE-2026-8007—8.8%
——3——CVE-2026-3652—8.8%
——3——CVE-2024-39314—8.8%
——3——CVE-2018-5906—8.8%
——3——CVE-2020-3636—8.8%
——3——CVE-2020-3635—8.8%
——3——CVE-2024-13523—8.8%
——3——CVE-2020-11133—8.8%
——3——CVE-2025-62857—8.8%
——3——CVE-2025-21507—8.8%
——3——CVE-2022-0652—8.8%
——3——CVE-2022-21816—8.8%
——3——