Vulnerabilities exploitable today
356,180in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,661
New KEV · 24H0
Exploit Today ≥ 701,603
Distribution · last window
- Critical2,782
- High11,115
- Medium7,374
- Low694
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-666637.1 HIG—
———Unauthenticated Cross Site Scripting (XSS) in WP Data Access <= 5.5.79 versions.6hCVE-2026-655708.1 HIG—
———Unauthenticated Bypass Vulnerability in Login with phone number <= 1.8.70 versions.6hCVE-2026-655698.5 HIG—
———Subscriber SQL Injection in WP Job Portal <= 2.5.6 versions.5hCVE-2026-655657.1 HIG—
———Unauthenticated Cross Site Scripting (XSS) in Survey Maker <= 5.2.3.3 versions.6hCVE-2026-655607.1 HIG—
———Unauthenticated Cross Site Scripting (XSS) in Houzez Property Feed <= 2.5.48 versions.6hCVE-2026-655597.2 HIG—
———Shop manager Privilege Escalation in Order Delivery Date for WooCommerce <= 4.6.0 versions.5hCVE-2026-666647.1 HIG—
———Unauthenticated Cross Site Scripting (XSS) in SEO Plugin by Squirrly SEO <= 14.2.0 versions.6hCVE-2026-655569.8 CRI—
———Unauthenticated PHP Object Injection in WPBruiser {no- Captcha anti-Spam} <= 3.1.43 versions.6hCVE-2026-655547.1 HIG—
———Subscriber Broken Access Control in AnsPress – Question and answer 4.4.4 versions.5hCVE-2026-6555310.0 CRI—
———Unauthenticated Remote Code Execution (RCE) in Spider Analyser – WordPress搜索引擎蜘蛛分析插件 <= 2.1.3 versions.6hCVE-2026-655529.8 CRI—
———Subscriber PHP Object Injection in Export User Data <= 2.2.6 versions.6hCVE-2026-655497.2 HIG—
———Author PHP Object Injection in Jeg Kit for Elementor <= 3.2.10 versions.5hCVE-2026-655489.9 CRI—
———Contributor Remote Code Execution (RCE) in Betheme <= 28.4.2 versions.6hCVE-2026-655478.5 HIG—
———Subscriber SQL Injection in Creative Mail <= 1.6.9 versions.5hCVE-2026-655469.3 CRI—
———Unauthenticated SQL Injection in Qode Tours <= 3.1.3.1 versions.6hCVE-2026-655457.1 HIG—
———Unauthenticated Cross Site Scripting (XSS) in AI Engine <= 3.6.8 versions.6hCVE-2026-655447.1 HIG—
———Unauthenticated Cross Site Scripting (XSS) in Super Socializer <= 7.14.5 versions.5hCVE-2026-655437.5 HIG—
———Subscriber Sensitive Data Exposure in Vimeo <= 1.2.2 versions.6hCVE-2026-655428.8 HIG—
———Unauthenticated Broken Authentication in Super Socializer <= 7.14.5 versions.5hCVE-2026-655417.3 HIG—
———Unauthenticated Broken Access Control in Staff Training <= 1.0.7 versions.6hCVE-2026-655237.5 HIG—
———Unauthenticated Insecure Direct Object References (IDOR) in Formidable Forms Signature Online Contract Automation <= 2.0.1 versions.6hCVE-2026-655209.3 CRI—
———Unauthenticated SQL Injection in WP OAuth Server <= 6.2.0 versions.5hCVE-2026-655177.1 HIG—
———Unauthenticated Cross Site Scripting (XSS) in Easy PayPal Buy Now Button <= 2.0.4 versions.6hCVE-2026-6666510.0 CRI—
———Unauthenticated Arbitrary File Upload in Type Hub <= 2.0.6 versions.6hCVE-2026-655157.1 HIG—
———Unauthenticated Cross Site Scripting (XSS) in AffiliateWP <= 2.35.0 versions.5hCVE-2026-666784.3 MED—
———Contributor Broken Access Control in Advanced Custom Fields: Font Awesome Field <= 6.1.1 versions.6hCVE-2026-655137.1 HIG—
———Unauthenticated Cross Site Scripting (XSS) in Simply Schedule Appointments <= 1.6.12.10 versions.6hCVE-2026-655097.1 HIG—
———Unauthenticated Cross Site Scripting (XSS) in wpDataTables <= 7.5.1 versions.6hCVE-2026-655089.3 CRI—
———Unauthenticated SQL Injection in Simply Schedule Appointments <= 1.6.12.10 versions.5hCVE-2026-655079.8 CRI—
———Unauthenticated Privilege Escalation in AIWU <= 1.5.6 versions.6hCVE-2026-655047.5 HIG—
———Unauthenticated Broken Access Control in BOX NOW Delivery Croatia <= 3.3.0 versions.5hCVE-2026-655025.3 MED—
———Unauthenticated Bypass Vulnerability in Element Pack Elementor Addons <= 8.7.13 versions.6hCVE-2026-666814.3 MED—
———Unauthenticated Cross Site Request Forgery (CSRF) in Theme My Login <= 7.1.14 versions.5hCVE-2026-619827.1 HIG—
———Unauthenticated Cross Site Scripting (XSS) in SiteGuard WP Plugin <= 1.8.6 versions.6hCVE-2026-666835.3 MED—
———Unauthenticated Sensitive Data Exposure in Custom CSS and JavaScript <= 2.0.16 versions.6hCVE-2026-619647.1 HIG—
———Unauthenticated Cross Site Scripting (XSS) in Ninja Tables <= 5.2.9 versions.5hCVE-2026-619637.1 HIG—
———Unauthenticated Cross Site Scripting (XSS) in Media LIbrary Assistant <= 3.38 versions.6hCVE-2026-619617.1 HIG—
———Unauthenticated Cross Site Scripting (XSS) in EmbedPress <= 4.5.6 versions.5hCVE-2026-619596.5 MED—
———Subscriber Cross Site Scripting (XSS) in Business Directory <= 6.4.24 versions.6hCVE-2026-544899.1 CRI—
———Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0, contain(s) a Sensitive Information Disclosure vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to information disclosure and session hijacking. This vulnerability is considered critical as it allows an unauthenticated attacker to obtain active session credentials and fully impersonate authenticated users, including administrators. Dell recommends customers to upgrade at the earliest opportunity.5h