CVE Watch353,604 in full archive

Vulnerabilities exploitable today

353,604in current view

Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.

In KEV catalog1,655

New KEV · 24H0

Exploit Today ≥ 701,602

Distribution · last window

Critical
2,451
High
8,318
Medium
7,448
Low
696

Filters

Window

Severity

Flags

Vulnerabilities353,281–353,320 · 353,604

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-18197—

—

——0Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Link Library allows Cross-Site Scripting (XSS). This issue affects Link Library: before 7.9.4.4h CVE-2026-149009.8 CRI

—

——0The Cost Calculator Builder PRO plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.0.3 via the js_to_php function. This is due to insufficient sanitization of the orderDetails[*].originalValue field, which is injected verbatim into a calculator formula string passed to PHP eval() inside js_to_php(), with the regex allow-list in evaluateFormula() only filtering alphanumeric tokens and leaving non-word punctuation characters intact. This makes it possible for unauthenticated attackers to execute code on the server. The only authentication barrier is a nonce check, but the required nonce is publicly emitted on every front-end page via the wp_head hook, making it freely obtainable by unauthenticated visitors. Payloads must be non-word XOR gadgets to bypass sanitization.1h CVE-2026-144889.1 CRI

—

——0The Meta Box AIO plugin for WordPress is vulnerable to Missing Authorization via the template_redirect dispatcher in the MB Frontend Submission extension in versions up to, and including, 3.8.0. This is due to the handle_request() function routing the mbfs_delete action without any capability or ownership check, and the nonce verification in check_ajax() being gated behind is_ajax() which is false for template_redirect requests, making it bypassable. This makes it possible for unauthenticated attackers to delete arbitrary posts and pages by supplying an attacker-controlled post ID via the rwmb_frontend_field_object_id GET parameter on any page that hosts a frontend submission form regardless of whether allow_delete is enabled.1h CVE-2026-12895—

—

——0SQL injection in Frappe's ERPNext, versions ERPNext 15.107.0 and Frappe 15.107.2. The application constructs SQL queries through direct string interpolation using `str.format()` without employing parameterized queries, allowing the name (docname) of a Supplier record containing SQL metacharacters to be interpreted as part of the query. Exploitation of this vulnerability could allow an authenticated user with low privileges to execute arbitrary SQL queries, bypass Frappe’s access restrictions (DocPerm), extract confidential information from the database—including fragments of the administrator’s password hash—and access other sensitive data, such as credentials, integration tokens, or financial information.1h CVE-2026-220688.2 HIG

—

——0Regular Expression without Anchors vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 10.0.X through 10.1.3, from 9.0.X through 9.2.14. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue.4h CVE-2026-240337.2 HIG

—

——0Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 10.0.0 through 10.1.3, from 9.0.0 through 9.2.14. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue.4h CVE-2026-3326710.0 CRI

—

——0Improper Input Validation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.14, from 10.1.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue.4h CVE-2026-12374—

0.0%

——0Improper certificate validation and a time-of-check time-of-use (TOCTOU) race condition in the PrivilegedHelperTool XPC service in Cato Client before v.5.13.1 on macOS allows a local authenticated attacker to escalate privileges to root via a self-signed certificate that bypasses the XPC caller verification and a symlink swap during package installation.27d CVE-2025-45764—

0.0%

——0——CVE-2026-58125—

—

——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.20d CVE-2025-27070—

0.0%

——0——CVE-2026-62174—

—

——0Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-61435. Reason: This candidate is a duplicate of CVE-2026-61435. Notes: All CVE users should reference CVE-2026-61435 instead of this candidate.14d CVE-2026-00947.8 HIG

0.0%

——0In getApplicationLabel of KeyChainActivity.java, there is a possible way to trick the user into approving access to certificates due to misleading or insufficient UI. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.7d CVE-2025-47344—

0.0%

——0——CVE-2026-252717.8 HIG

0.0%

——0Memory Corruption when processing asynchronous input parameters due to improper handling of modified values between check and use.22d CVE-2025-596106.4 MED

0.0%

——0Memory Corruption when processing IOCTL requests with mismatched API versions due to concurrent modification of user-space buffer.7d CVE-2026-14286—

—

——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.19d CVE-2023-20940—

0.0%

——0——CVE-2026-252607.8 HIG

0.0%

——0Memory Corruption when accessing shared buffers without validation of concurrent user-mode input modifications.7d CVE-2025-47407—

——0——CVE-2026-180729.8 CRI

—

——0The Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick … plugin for WordPress is vulnerable to Authentication Bypass via a Hardcoded Backdoor in version 10.8.7. The vulnerability exists because the `_arve_uc_init()` function — registered on WordPress's `init` hook at priority 1 so that it runs before any authentication checks on every request — reads an attacker-supplied token from the `_wplogin` (or `_wpm`) parameter and compares it against a hardcoded SHA-256 hash embedded directly in the plugin source, with no nonce verification, no capability check, and no password validation anywhere in the flow. Because this static hash constitutes a set of universal credentials that are publicly accessible in the plugin's source code, unauthenticated attackers can supply the known token to be authenticated as an arbitrarily selected existing administrator account, gaining full administrative control over the affected WordPress site. This was likely introduced by an attacker who gained commit access to the developers account.7h CVE-2026-0112—

——0——CVE-2026-240907.1 HIG

0.0%

——0Cryptographic issue while processing partition table entries allows unauthorized modification of boot flow.7d CVE-2025-48625—

——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.6d CVE-2025-47330—

0.0%

——0——CVE-2026-11950—

—

——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.28d CVE-2026-582464.3 MED

—

——0SAP NetWeaver Application Server for ABAP and ABAP Platform writes sensitive session identifier information into a diagnostic trace when the trace is activated by a privileged user. An attacker with access to the resulting trace data could obtain identifiers that allow impersonation of legitimate users during their validity period. This leads to high impact on confidentiality. Integrity and availability are not impacted.16h CVE-2023-20914—

0.0%

——0——CVE-2026-14170—

—

——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.1d CVE-2026-62180—

—

——0Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-61440. Reason: This candidate is a duplicate of CVE-2026-61440. Notes: All CVE users should reference CVE-2026-61440 instead of this candidate.14d CVE-2026-50238—

—

——0Rejected reason: Red Hat Product Security has concluded that this CVE is not required. The reported issue has been classified as a regular bug and will be addressed through the standard bug-fixing process.26d CVE-2026-58407—

—

——0Rejected reason: Please submit CVE requests for each vulnerability.16d