Vulnerabilities exploitable today
354,867in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,656
New KEV · 24H0
Exploit Today ≥ 701,601
Distribution · last window
- Critical2,555
- High9,167
- Medium7,434
- Low691
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2023-26203—6.0%
——2——CVE-2025-38680—6.0%
——2——CVE-2020-29489—6.0%
——2——CVE-2024-6030—6.0%
——2——CVE-2023-28023—6.0%
——2——CVE-2025-24982—6.0%
——2——CVE-2023-41612—6.0%
——2——CVE-2025-8427—6.0%
——2——CVE-2021-0941—6.0%
——2——CVE-2018-9544—6.0%
——2——CVE-2024-32996—6.0%
——2——CVE-2022-49923—6.0%
——2——CVE-2025-23162—6.0%
——2——CVE-2025-39760—6.0%
——2——CVE-2025-11147—6.0%
——2——CVE-2026-639707.8 HIG6.0%
——2In the Linux kernel, the following vulnerability has been resolved:
vsock/virtio: bind uarg before filling zerocopy skb
virtio_transport_send_pkt_info() allocates or reuses the zerocopy uarg
before entering the send loop, but virtio_transport_alloc_skb() still
fills the skb before it inherits that uarg. When fixed-buffer vectored
zerocopy hits MAX_SKB_FRAGS, io_sg_from_iter() may partially attach
managed frags and return -EMSGSIZE. The rollback path call kfree_skb()
to free an skb that carries SKBFL_MANAGED_FRAG_REFS but no uarg, so
skb_release_data() falls through to ordinary frag unref.
Pass the uarg into virtio_transport_alloc_skb() and bind it immediately
before virtio_transport_fill_skb(). This keeps control or no-payload skbs
untouched while ensuring success and rollback share one lifetime rule.3dCVE-2025-7448—6.0%
——2——CVE-2025-54086—6.0%
——2——CVE-2025-37793—6.0%
——2——CVE-2026-47748—6.0%
——2——CVE-2024-38665—6.0%
——2——CVE-2025-57883—6.0%
——2——CVE-2026-6855—6.0%
——2——CVE-2025-383427.0 HIG6.0%
——2In the Linux kernel, the following vulnerability has been resolved:
software node: Correct a OOB check in software_node_get_reference_args()
software_node_get_reference_args() wants to get @index-th element, so
the property value requires at least '(index + 1) * sizeof(*ref)' bytes
but that can not be guaranteed by current OOB check, and may cause OOB
for malformed property.
Fix by using as OOB check '((index + 1) * sizeof(*ref) > prop->length)'.3dCVE-2025-21048—6.0%
——2——CVE-2026-137267.1 HIG6.0%
——2The MPG WordPress plugin before 4.1.8 does not sanitise and escape a parameter before reflecting it back in the response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting against a victim who is induced to send a crafted request.6dCVE-2026-98097.6 HIG6.0%
——2A stored Cross-Site Scripting (XSS) vulnerability exists in the Projects component of Mautic 7. When displaying project tags and popovers on administrative detail views (such as campaigns, emails, or forms), user-supplied project names are rendered without proper sanitization. An authenticated user with permissions to create or edit projects can exploit this to inject malicious script payloads. When an administrative user views an entity associated with a compromised project and hovers over its tag, the injected script executes within the context of their active browser session. This could allow an attacker to perform administrative actions on behalf of the victim, alter system configurations, or exfiltrate sensitive data.12dCVE-2022-49924—6.0%
——2——CVE-2026-476894.6 MED6.0%
——2FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the `buildRow()` method in `fogpage.class.php` substitutes data values into HTML table cell templates using `str_replace()` without any HTML escaping. An unauthenticated attacker who knows any registered host's MAC address can POST malicious inventory values (e.g. `sysproduct`, `sysserial`) to `/service/inventory.php`, which stores them in the database. When an administrator opens the Group Inventory tab, the payload renders as executable HTML/JavaScript in the admin's browser. Versions 1.5.10.1832 and 1.6.0-beta.2313 fix the issue.10dCVE-2025-36085—6.0%
——2——CVE-2020-0438—6.0%
——2——CVE-2026-21788—6.0%
——2——CVE-2022-39857—6.0%
——2——CVE-2024-46791—6.0%
——2——CVE-2026-27948—6.0%
——2——CVE-2025-406465.4 MED6.0%
——2Exposure of sensitive information in Viday. This vulnerability could allow an attacker to obtain sensitive information about customers by intercepting HTTP requests and searching for the JWT containing sensitive user information in the JWT payload.18dCVE-2019-2123—6.0%
——2——CVE-2024-57946—6.0%
——2——CVE-2026-129787.1 HIG6.0%
——2The FunnelKit WordPress plugin before 3.15.0.6 does not escape a user-supplied parameter before reflecting it into the HTML response of one of its page-builder AJAX actions, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting against logged-in users who open a crafted page. The affected action is only registered when the Divi /builder is active.17dCVE-2026-48985—6.0%
——2——