Vulnerabilities exploitable today
354,449in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,656
New KEV · 24H0
Exploit Today ≥ 701,602
Distribution · last window
- Critical2,641
- High9,461
- Medium7,688
- Low693
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-83066.1 MED4.6%
——1Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Armiya Information Technologies Ltd. Co. Access Control System (GKS) allows Stored XSS.
This issue affects Access Control System (GKS): before Version 2.24dCVE-2022-20280—4.6%
——1——CVE-2026-624894.2 MED4.6%
——1Vulnerability in the Oracle Contracts Integration product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Contracts Integration. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Contracts Integration accessible data as well as unauthorized read access to a subset of Oracle Contracts Integration accessible data. CVSS 3.1 Base Score 4.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N).3dCVE-2026-24456.1 MED4.6%
——1The affected product accepts user-supplied input within a URL parameter without enforcing expected sanitization or encoding before rendering it within the response. This condition allows for the injection of malicious JavaScript payloads.
An attacker can leverage this vulnerability to cause the user's browser to redirect to a malicious website, modify the user interface of the webpage, or retrieve sensitive information from the browser. However, the impact is mitigated for session hijacking as all session-related sensitive cookies are protected by the httpOnly flag.8dCVE-2024-27200—4.6%
——1——CVE-2026-45560—4.6%
——1——CVE-2026-134006.1 MED4.6%
——1Simply Schedule Appointments is vulnerable to unauthenticated Stored Cross-Site Scripting in all versions up to and including 1.6.12.2. The root cause is a sanitization-ordering defect: the rendered notification content is decoded back into live HTML after it has already passed through the Simply Schedule Appointments WordPress plugin before 1.6.12.4's wp_kses_post() filter, so a double-encoded payload survives intake and is reintroduced as an executable element at render time.3dCVE-2026-483677.8 HIG4.6%
——1After Effects is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.14dCVE-2026-347186.1 MED4.6%
——1Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1 and 6.5.4, the HTML sanitizer for ticket articles was missing proper sanitization of data: ... URI schemes, resulting in storing such malicious content in the database of the Zammad instance. The Zammad GUI is rendering this content, due to applied CSP rules no harm was done by e.g., clicking such a link. This vulnerability is fixed in 7.0.1 and 6.5.4.6dCVE-2025-24843—4.6%
——1——CVE-2022-50349—4.6%
——1——CVE-2022-50458—4.6%
——1——CVE-2022-50414—4.6%
——1——CVE-2022-50481—4.6%
——1——CVE-2022-50257—4.6%
——1——CVE-2022-50444—4.6%
——1——CVE-2022-50346—4.6%
——1——CVE-2026-28919—4.6%
——1——CVE-2026-90666.1 MED4.6%
——1The WP Compress WordPress plugin before 7.10.04 does not validate the value of a query parameter that controls the asset CDN host before using it to build the URLs of JavaScript files emitted on the page, leading to Reflected XSS. When a visitor follows a crafted link, the WP Compress WordPress plugin before 7.10.04's loader injects script elements pointing to an attacker-controlled origin, which lets the attacker execute arbitrary JavaScript in the visitor's session on the target site.8dCVE-2024-45356—4.6%
——1——CVE-2026-658826.1 MED4.6%
——1Joomla Extension - joomdle.com - Reflected XSS vulnerability in Joomdle < 3.1.1 - The goto url parameter of the moodle wrapper endpoint allowed a reflected XSS vector.2dCVE-2025-397029.8 CRI4.6%
——1In the Linux kernel, the following vulnerability has been resolved:
ipv6: sr: Fix MAC comparison to be constant-time
To prevent timing attacks, MACs need to be compared in constant time.
Use the appropriate helper function for this.22hCVE-2025-64641—4.6%
——1——CVE-2025-12070—4.6%
——1——CVE-2026-24348—4.6%
——1——CVE-2025-22399—4.6%
——1——CVE-2022-50504—4.6%
——1——CVE-2023-53450—4.6%
——1——CVE-2025-69209—4.6%
——1——CVE-2026-34951—4.6%
——1——CVE-2026-31053—4.6%
——1——CVE-2026-57936.1 MED4.6%
——1Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Inrove Software and Internet Services BiEticaret allows Reflected XSS.
This issue affects BiEticaret: before v3.3.57.22dCVE-2025-7047—4.6%
——1——CVE-2026-105516.1 MED4.6%
——1The Breeze Cache WordPress plugin before 2.5.6 is vulnerable to unauthenticated Stored Cross-Site Scripting (XSS) due to a predictable replacement hash used during the HTML minification process and abusing a regular expression. This allows an attacker to inject arbitrary HTML attributes in the final HTML output by anticipating the placeholder format.17dCVE-2026-40966.5 MED4.6%
——1IBM DevOps Plan 3.0.0 through 3.0.6 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking3dCVE-2025-54675—4.6%
——1——CVE-2022-50476—4.6%
——1——CVE-2025-38063—4.6%
——1——CVE-2025-21017—4.6%
——1——CVE-2022-50297—4.6%
——1——