Vulnerabilities exploitable today
355,017in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,656
New KEV · 24H0
Exploit Today ≥ 701,601
Distribution · last window
- Critical2,558
- High9,191
- Medium7,449
- Low695
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-36948—6.6%
——2——CVE-2025-24301—6.6%
——2——CVE-2024-29370—6.6%
——2——CVE-2025-46310—6.6%
——2——CVE-2025-6538—6.6%
——2——CVE-2024-12399—6.6%
——2——CVE-2026-3476—6.6%
——2——CVE-2025-70058—6.6%
——2——CVE-2025-70102—6.6%
——2——CVE-2025-23420—6.6%
——2——CVE-2025-66605—6.6%
——2——CVE-2024-25075—6.6%
——2——CVE-2024-42274—6.6%
——2——CVE-2021-479485.4 MED6.6%
——2WordPress GetPaid Plugin 2.4.6 contains an HTML injection vulnerability that allows authenticated attackers to inject arbitrary HTML code by exploiting the Help Text field in payment forms. Attackers can inject malicious HTML including image tags and scripts into the Help Text field during payment form creation, which gets stored in the database and executed in the browser when the form is viewed.9dCVE-2024-52059—6.6%
——2——CVE-2025-6546—6.6%
——2——CVE-2025-20091—6.6%
——2——CVE-2026-139914.3 MED6.6%
——2Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)33dCVE-2022-41998—6.6%
——2——CVE-2025-24309—6.6%
——2——CVE-2026-482265.4 MED6.6%
——2Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in os_watch.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the ref and mode_orig POST parameters directly into HTML form hidden input value attributes. Attackers can craft a malicious request containing a JavaScript payload that executes in the victim's browser when the response is rendered.11dCVE-2025-6290—6.6%
——2——CVE-2025-59734—6.6%
——2——CVE-2022-26086—6.6%
——2——CVE-2025-674057.3 HIG6.6%
——2Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in update_password.php via the parameter new_password.4dCVE-2026-22617—6.6%
——2——CVE-2022-41982—6.6%
——2——CVE-2025-66607—6.6%
——2——CVE-2026-482285.4 MED6.6%
——2Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in patient_w.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the id and ticket_id GET parameters directly into an HTML form action URL. Attackers can craft a malicious request containing a JavaScript payload that executes in the victim's browser when the response is rendered.11dCVE-2025-12629—6.6%
——2——CVE-2017-11048—6.6%
——2——CVE-2025-59094—6.6%
——2——CVE-2025-699457.3 HIG6.6%
——2kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in /doctor/edit-patient.php?editid=1.4dCVE-2024-12577—6.6%
——2——CVE-2026-31353—6.6%
——2——CVE-2025-37933—6.6%
——2——CVE-2024-20071—6.6%
——2——CVE-2025-11560—6.6%
——2——CVE-2025-22835—6.6%
——2——CVE-2026-606338.8 HIG6.6%
——2Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).5d