Vulnerabilities exploitable today
352,969in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,653
New KEV · 24H0
Exploit Today ≥ 701,600
Distribution · last window
- Critical2,334
- High8,050
- Medium7,230
- Low682
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-41257—3.9%
——1——CVE-2026-57333—3.9%
——1——CVE-2026-30987—3.9%
——1——CVE-2026-578147.1 HIG3.9%
——1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMU DEV - Your All-in-One WordPress Platform Forminator forminator allows DOM-Based XSS.This issue affects Forminator: from n/a through <= 1.55.0.1.14dCVE-2022-34376—3.9%
——1——CVE-2025-23258—3.9%
——1——CVE-2022-39852—3.9%
——1——CVE-2026-42653—3.9%
——1——CVE-2026-27275—3.9%
——1——CVE-2024-8766—3.9%
——1——CVE-2026-46848—3.9%
——1——CVE-2026-6245—3.9%
——1——CVE-2026-42762—3.9%
——1——CVE-2025-22098—3.9%
——1——CVE-2024-45672—3.9%
——1——CVE-2022-20141—3.9%
——1——CVE-2026-7958—3.9%
——1——CVE-2025-381625.5 MED3.9%
——1In the Linux kernel, the following vulnerability has been resolved:
netfilter: nft_set_pipapo: prevent overflow in lookup table allocation
When calculating the lookup table size, ensure the following
multiplication does not overflow:
- desc->field_len[] maximum value is U8_MAX multiplied by
NFT_PIPAPO_GROUPS_PER_BYTE(f) that can be 2, worst case.
- NFT_PIPAPO_BUCKETS(f->bb) is 2^8, worst case.
- sizeof(unsigned long), from sizeof(*f->lt), lt in
struct nft_pipapo_field.
Then, use check_mul_overflow() to multiply by bucket size and then use
check_add_overflow() to the alignment for avx2 (if needed). Finally, add
lt_size_check_overflow() helper and use it to consolidate this.
While at it, replace leftover allocation using the GFP_KERNEL to
GFP_KERNEL_ACCOUNT for consistency, in pipapo_resize().13dCVE-2026-3351—3.9%
——1——CVE-2025-21900—3.9%
——1——CVE-2026-41554—3.9%
——1——CVE-2025-38250—3.9%
——1——CVE-2026-156847.3 HIG3.9%
——1Glarysoft Glary Utilities Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Glarysoft Glary Utilities. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
The specific flaw exists within the Disk Clean functionality. By creating a junction, an attacker can abuse the service to delete arbitrary files. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-27004.13dCVE-2026-57336—3.9%
——1——CVE-2024-40703—3.9%
——1——CVE-2026-27711—3.9%
——1——CVE-2025-69082—3.9%
——1——CVE-2021-1898—3.9%
——1——CVE-2026-29126—3.9%
——1——CVE-2026-22186—3.9%
——1——CVE-2026-578167.1 HIG3.9%
——1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FunnelKit Funnel Builder by FunnelKit funnel-builder allows Reflected XSS.This issue affects Funnel Builder by FunnelKit: from n/a through <= 3.15.0.8.14dCVE-2020-0390—3.9%
——1——CVE-2026-426837.1 HIG3.9%
——1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikBooking Hotel Booking Engine & PMS allows DOM-Based XSS.
This issue affects VikBooking Hotel Booking Engine & PMS: from n/a through 1.8.8.6dCVE-2020-36906—3.9%
——1——CVE-2025-23272—3.9%
——1——CVE-2026-39437—3.9%
——1——CVE-2018-21053—3.9%
——1——CVE-2025-38176—3.9%
——1——CVE-2021-1901—3.9%
——1——CVE-2025-38175—3.9%
——1——