Vulnerabilities exploitable today
354,538in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,656
New KEV · 24H0
Exploit Today ≥ 701,601
Distribution · last window
- Critical2,643
- High9,454
- Medium7,665
- Low698
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2025-69936——
——0CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /edit_member.php?id=1.17hCVE-2025-66322—0.0%
——0——CVE-2026-17543——
——0Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2.* before 8.2.33, from 8.3.* before 8.3.33, from 8.4.* before 8.4.24, and from 8.5.* before 8.5.9.10hCVE-2026-252717.8 HIG0.0%
——0Memory Corruption when processing asynchronous input parameters due to improper handling of modified values between check and use.24dCVE-2026-555027.1 HIG—
——0Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, POST /api/v4/admin/policy/oauth/signin requires only Admin.Read even though GetOauthRedirectService persists caller-supplied OneDrive secret and app_id values, allowing an OAuth token without Admin.Write to modify storage policy credentials. The route is inside the admin group that requires Admin.Read, but it does not add the local Admin.Write guard used by sibling policy mutation routes. Its handler persists attacker-supplied secret and app_id values into the selected OneDrive storage policy before returning an OAuth URL. This issue is fixed in version 4.17.0.3hCVE-2026-12697——
——0The wpForo Forum WordPress plugin before 3.1.2 does not verify that an AI chat conversation belongs to the requesting user before deleting its messages, allowing users with a subscriber-level account to permanently delete the stored AI chat message history of any other user.7hCVE-2026-49946——
——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.23dCVE-2026-11740——
——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.15dCVE-2026-14929——
——0The JS Help Desk WordPress plugin before 3.1.4 does not verify ownership of the targeted reply before updating it, allowing any authenticated user (Subscriber and above) to overwrite the content of any support-ticket reply on the site.7hCVE-2026-8281——
——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.16dCVE-2026-47105——
——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.31dCVE-2026-158115.8 MED0.0%
——0A vulnerability was found in kronosnet's (version <=1.34) cryptographic configuration management. The framework does not correctly zero-out or wipe sensitive memory segments after executing changes to its cryptographic configuration. This omission leaves raw encryption keys resident in memory after the associated structures are freed. A local attacker capable of leveraging memory disclosure techniques could exploit this flaw to retrieve the active encryption key, allowing them to decrypt cluster network communications or inject malicious packets to cause severe high-availability cluster instability.8dCVE-2026-62165——
——0Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-61446. Reason: This candidate is a duplicate of CVE-2026-61446. Notes: All CVE users should reference CVE-2026-61446 instead of this candidate.16dCVE-2025-66326—0.0%
——0——CVE-2026-62169——
——0Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-61430. Reason: This candidate is a duplicate of CVE-2026-61430. Notes: All CVE users should reference CVE-2026-61430 instead of this candidate.16dCVE-2026-0112—0.0%
——0——CVE-2026-24508—0.0%
——0——CVE-2026-50268—0.0%
——0——CVE-2026-16312——
——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.11dCVE-2026-61841——
——0Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-61449. Reason: This candidate is a duplicate of CVE-2026-61449. Notes: All CVE users should reference CVE-2026-61449 instead of this candidate.16dCVE-2026-240907.1 HIG0.0%
——0Cryptographic issue while processing partition table entries allows unauthorized modification of boot flow.9dCVE-2026-243497.1 HIG0.0%
——0A vulnerability has been identified in SIMATIC WinCC Unified PC Runtime V16 (All versions), SIMATIC WinCC Unified PC Runtime V17 (All versions), SIMATIC WinCC Unified PC Runtime V18 (All versions), SIMATIC WinCC Unified PC Runtime V19 (All versions), SIMATIC WinCC Unified PC Runtime V20 (All versions), SIMATIC WinCC Unified PC Runtime V21 (All versions < V21 Update 2). Insufficient protection of key material in WinCC Certificate Manager that could allow an attacker to extract sensitive information.8dCVE-2026-61606——
——0Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-61457. Reason: This candidate is a duplicate of CVE-2026-61457. Notes: All CVE users should reference CVE-2026-61457 instead of this candidate.16dCVE-2026-61710——
——0Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-61453. Reason: This candidate is a duplicate of CVE-2026-61453. Notes: All CVE users should reference CVE-2026-61453 instead of this candidate.16dCVE-2026-148685.5 MED0.0%
——0The encryption algorithm used to protect the configuration of user accounts, stored in the built-in user directory of PcVue projects, all versions prior to 17.0.0, is not strong enough for the level of protection required. A local attacker could alter the existing configuration and ultimately gain privileged access to the PcVue application.22dCVE-2025-66331—0.0%
——0——CVE-2026-16339——
——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.2dCVE-2026-18060——
——0Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage.2dCVE-2026-213705.3 MED0.0%
——0Memory Corruption when validating input batch size and buffer plane count exceeds maximum allowed values.24dCVE-2026-62168——
——0Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-61443. Reason: This candidate is a duplicate of CVE-2026-61443. Notes: All CVE users should reference CVE-2026-61443 instead of this candidate.16dCVE-2026-62173——
——0Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-61433. Reason: This candidate is a duplicate of CVE-2026-61433. Notes: All CVE users should reference CVE-2026-61433 instead of this candidate.16dCVE-2025-66333—0.0%
——0——CVE-2025-48625—0.0%
——0——CVE-2026-226218.3 HIG—
——0Improper input validation in one of the session management interface of Eaton's Tripp Lite Series PADM firmware could allow an authenticated administrator to execute arbitrary commands within a restricted environment.3hCVE-2025-68969—0.0%
——0——CVE-2026-66051——
——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.2dCVE-2026-28551—0.0%
——0——CVE-2026-15799——
——0Rejected reason: This is a duplicate.4dCVE-2026-58212——
——0Rejected reason: Further research determined the issue is not a vulnerability based on CNA Rule 4.1.12 The act of updating Product dependencies MUST NOT be determined to be a Vulnerability, regardless of whether the dependencies have Vulnerabilities.23dCVE-2025-47330—0.0%
——0——