Vulnerabilities exploitable today
356,684in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,662
New KEV · 24H0
Exploit Today ≥ 701,605
Distribution · last window
- Critical2,537
- High10,637
- Medium6,742
- Low667
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-24368—8.3%
——2——CVE-2025-68482—8.3%
——2——CVE-2019-8757—8.3%
——2——CVE-2024-45527—8.3%
——2——CVE-2022-49585—8.3%
——2——CVE-2024-21044—8.3%
——2——CVE-2025-258237.3 HIG8.3%
——2A cross-site scripting (XSS) vulnerability in Emlog Pro v2.5.4 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the article header at /admin/article.php.35dCVE-2026-33386—8.3%
——2QuickCMS is vulnerable to Cross-Site Scripting (XSS) through its insecure HTTP-based plugin‑fetching mechanism. A malicious attacker can perform a Man‑in‑the‑Middle (MITM) attack by impersonating the opensolution.org server and serving arbitrary HTML or JavaScript at the plugin list endpoint. When a user accesses the plugin page, the malicious content is automatically fetched, rendered, and executed.
This issue was fixed in a patch to version 6.8 published on 15.05.2026, deployments without this patch are still vulnerable.19dCVE-2023-52609—8.3%
——2——CVE-2026-112106.5 MED8.3%
——2Inappropriate implementation in Safe Browsing in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass discretionary access control via a crafted RAR file. (Chromium security severity: Medium)17dCVE-2024-0131—8.3%
——2——CVE-2024-1543—8.3%
——2——CVE-2025-43832—8.3%
——2——CVE-2023-28514—8.3%
——2——CVE-2023-26300—8.3%
——2——CVE-2025-66845—8.3%
——2——CVE-2025-57104—8.3%
——2——CVE-2025-48245—8.3%
——2——CVE-2026-387647.8 HIG8.3%
——2An issue in Unistal Systems Pvt. Ltd.Protegent 360 v2.0.0.4 allows a local attacker to escalate privileges via the kernel driver pgsecdl.sys9dCVE-2026-100178.3 HIG8.3%
——2Out of bounds read in Headless in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)19dCVE-2026-394645.5 MED8.3%
——2Server-Side Request Forgery (SSRF) vulnerability in SeedProd Coming Soon Page, Under Construction & Maintenance Mode by SeedProd coming-soon allows Server Side Request Forgery.This issue affects Coming Soon Page, Under Construction & Maintenance Mode by SeedProd: from n/a through <= 6.19.8.15dCVE-2017-0706—8.3%
——2——CVE-2025-25590—8.3%
——2——CVE-2025-2327—8.3%
——2——CVE-2025-10136—8.3%
——2——CVE-2025-8615—8.3%
——2——CVE-2019-25603—8.3%
——2——CVE-2024-54536—8.3%
——2——CVE-2017-0705—8.3%
——2——CVE-2025-36183—8.3%
——2——CVE-2023-6143—8.3%
——2——CVE-2026-9039—8.3%
——2——CVE-2024-468637.3 HIG8.3%
——2In the Linux kernel, the following vulnerability has been resolved:
ASoC: Intel: soc-acpi-intel-lnl-match: add missing empty item
There is no links_num in struct snd_soc_acpi_mach {}, and we test
!link->num_adr as a condition to end the loop in hda_sdw_machine_select().
So an empty item in struct snd_soc_acpi_link_adr array is required.5dCVE-2022-40233—8.3%
——2——CVE-2022-49596—8.3%
——2——CVE-2024-33646—8.3%
——2——CVE-2024-3289—8.3%
——2——CVE-2022-46301—8.3%
——2——CVE-2024-3780—8.3%
——2——CVE-2024-47483—8.3%
——2——