Vulnerabilities exploitable today
354,825in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,656
New KEV · 24H0
Exploit Today ≥ 701,601
Distribution · last window
- Critical2,569
- High9,189
- Medium7,426
- Low693
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-28230—5.6%
——2——CVE-2025-8736—5.6%
——2——CVE-2026-397045.3 MED5.6%
——2Missing Authorization vulnerability in nfusionsolutions Precious Metals Automated Product Pricing – Pro precious-metals-automated-product-pricing-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Precious Metals Automated Product Pricing – Pro: from n/a through <= 4.0.5.8dCVE-2026-32679—5.6%
——2——CVE-2025-9341—5.6%
——2——CVE-2022-50123—5.6%
——2——CVE-2026-32290—5.6%
——2——CVE-2022-22082—5.6%
——2——CVE-2022-50152—5.6%
——2——CVE-2022-50028—5.6%
——2——CVE-2022-50017—5.6%
——2——CVE-2025-38142—5.6%
——2——CVE-2026-129736.5 MED5.6%
——2The PayPlus Payment Gateway WordPress plugin before 8.2.2 does not perform authorization or order-ownership validation in one of its AJAX actions available to unauthenticated users, allowing them to disclose the secret order key of arbitrary WooCommerce orders and, under some configurations, to modify order statuses.11dCVE-2026-45915—5.6%
——2——CVE-2024-34043—5.6%
——2——CVE-2017-8445—5.6%
——2——CVE-2021-37675—5.6%
——2——CVE-2022-50025—5.6%
——2——CVE-2021-26093—5.6%
——2——CVE-2026-32986—5.6%
——2——CVE-2025-8758—5.6%
——2——CVE-2024-20842—5.6%
——2——CVE-2024-26022—5.6%
——2——CVE-2019-14089—5.6%
——2——CVE-2024-57994—5.6%
——2——CVE-2026-295985.4 MED5.6%
——2Multiple stored cross-site scripting (XSS) vulnerabilities in the submit_add_user.asp endpoint of DDSN Interactive Acora CMS v10.7.1 allow attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the First Name and Last Name parameters.27dCVE-2025-38282—5.6%
——2——CVE-2026-26050—5.6%
——2——CVE-2021-37643—5.6%
——2——CVE-2021-37637—5.6%
——2——CVE-2026-643187.1 HIG5.6%
——2In the Linux kernel, the following vulnerability has been resolved:
partitions: aix: bound the pp_count scan to the ppe array
aix_partition() reads the physical volume descriptor into a fixed-size
struct pvd and then scans its physical-partition-extent array:
int numpps = be16_to_cpu(pvd->pp_count);
...
for (i = 0; i < numpps; i += 1) {
struct ppe *p = pvd->ppe + i;
...
lp_ix = be16_to_cpu(p->lp_ix);
pvd points at a single kmalloc()'d struct pvd whose ppe[] member holds a
fixed ARRAY_SIZE(pvd->ppe) (1016) entries, but the loop runs up to the
on-disk pp_count. pp_count is an unvalidated __be16 read straight from
the descriptor, so a crafted AIX image with pp_count larger than 1016
drives the loop to read pvd->ppe[i] past the end of the allocation (up
to 65535 entries, ~2 MB out of bounds).
The partition scan runs without mounting anything, when a block device
with a crafted AIX/IBM partition table appears (an attacker-supplied
image attached with losetup -P, or a device auto-scanned by udev), via
msdos_partition() -> aix_partition().
Clamp the scan to the number of entries the ppe[] array can hold.6dCVE-2025-14409—5.6%
——2——CVE-2025-15311—5.6%
——2——CVE-2025-5471—5.6%
——2——CVE-2026-3930—5.6%
——2——CVE-2022-50104—5.6%
——2——CVE-2022-50162—5.6%
——2——CVE-2025-48255—5.6%
——2——CVE-2025-13936—5.6%
——2——CVE-2022-50158—5.6%
——2——