Vulnerabilities exploitable today
355,082in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,656
New KEV · 24H0
Exploit Today ≥ 701,601
Distribution · last window
- Critical2,577
- High9,224
- Medium7,474
- Low696
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2025-39913—6.7%
——2——CVE-2024-4018—6.7%
——2——CVE-2024-4017—6.7%
——2——CVE-2026-50099—6.7%
——2——CVE-2026-437534.6 MED6.7%
——2An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An attacker with physical access to a locked device may be able to view sensitive user information.6dCVE-2026-112226.5 MED6.7%
——2Incorrect security UI in Tab Strip in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform domain spoofing via a crafted HTML page. (Chromium security severity: Low)12dCVE-2025-67541—6.7%
——2——CVE-2023-43485—6.7%
——2——CVE-2025-66105—6.7%
——2——CVE-2022-34681—6.7%
——2——CVE-2023-0197—6.7%
——2——CVE-2023-39254—6.7%
——2——CVE-2026-580285.4 MED6.7%
——2Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki, Wikimedia Foundation CentralAuth.
This vulnerability is associated with program files includes/Api/ApiFormatBase.Php, includes/Api/ApiHelp.Php, includes/ResourceLoader/Module.Php, includes/Hooks/Handlers/PageDisplayHookHandler.Php, includes/LogFormatter/PermissionChangeLogFormatter.Php.
This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9; CentralAuth: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.25dCVE-2025-54746—6.7%
——2——CVE-2025-57887—6.7%
——2——CVE-2025-38635—6.7%
——2——CVE-2025-58776—6.7%
——2——CVE-2024-37438—6.7%
——2——CVE-2025-53587—6.7%
——2——CVE-2026-41526—6.7%
——2——CVE-2025-54747—6.7%
——2——CVE-2020-37079—6.7%
——2——CVE-2026-14841—6.7%
——2The King Addons for Elementor WordPress plugin before 51.1.76 does not escape a user-supplied grid setting before reflecting it into an HTML attribute in an unauthenticated AJAX response, allowing attackers to execute arbitrary JavaScript in the browser of a visitor who is tricked into loading a crafted page.2dCVE-2025-58775—6.7%
——2——CVE-2025-383177.8 HIG6.7%
——2In the Linux kernel, the following vulnerability has been resolved:
wifi: ath12k: Fix buffer overflow in debugfs
If the user tries to write more than 32 bytes then it results in memory
corruption. Fortunately, this is debugfs so it's limited to root users.5dCVE-2026-572607.8 HIG6.7%
——2The application opened a PDF file containing an abnormal Unity 3D object. During parsing, the application incorrectly resolved a portion of the abnormal object as a pointer and used it as a valid address, ultimately causing the application to crash.25dCVE-2026-7471—6.7%
——2——CVE-2026-493803.1 LOW6.7%
——2In JetBrains TeamCity before 2026.1 open redirect in the SAML plugin was possible13dCVE-2025-59546—6.7%
——2——CVE-2026-229277.8 HIG6.7%
——2Omnissa Workspace ONE® Tunnel for Windows addresses a Local Privilege Escalation Vulnerability.24dCVE-2022-20555—6.7%
——2——CVE-2026-57293—6.7%
——2——CVE-2023-5739—6.7%
——2——CVE-2026-7961—6.7%
——2——CVE-2025-55711—6.7%
——2——CVE-2026-26223—6.7%
——2——CVE-2024-54317—6.7%
——2——CVE-2026-178998.8 HIG6.7%
——2Insufficient policy enforcement in DevTools in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension to perform privilege escalation via a crafted Chrome Extension. (Chromium security severity: Low)5hCVE-2023-52371—6.7%
——2——CVE-2025-38406—6.7%
——2——