Vulnerabilidades explotables hoy
15,681en la vista actual
Score único combinando CVSS, membresía KEV y EPSS. Cada CVE con su ficha propia — timeline desde publicación hasta explotación activa.
En catálogo KEV1,756
Nuevos KEV · 24H0
Exploit Today ≥ 701,689
Distribución · última ventana
- Crítico4,537
- Alto18,435
- Medio17,028
- Bajo1,708
Filtros
Ventana
Severidad
Filtros
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-9634910.0 CRÍ53.9%
——16Unauthenticated Remote Code Execution (RCE) in SiteSkite <= 2.1.8 versions.25dCVE-2026-963487.5 ALT17.3%
——5Unauthenticated Broken Access Control in Bookly <= 28.2 versions.25dCVE-2026-963476.5 MED19.6%
——6Subscriber Insecure Direct Object References (IDOR) in Bookly <= 28.2 versions.25dCVE-2026-963467.6 ALT19.1%
——6Author SQL Injection in WP ERP <= 1.17.9 versions.25dCVE-2026-963457.6 ALT19.1%
——6Administrator SQL Injection in Estatik <= 4.3.5 versions.25dCVE-2026-963447.2 ALT29.4%
——9Custom role PHP Object Injection in eCommerce Product Catalog <= 3.6.0 versions.25dCVE-2026-963437.2 ALT29.4%
——9Custom role PHP Object Injection in WP ERP <= 1.17.9 versions.25dCVE-2026-963386.5 MED10.4%
——3Subscriber Cross Site Scripting (XSS) in Profile Builder <= 4.0.2 versions.25dCVE-2026-956167.5 ALT34.9%
——10An integer overflow in WSS4J's DER bounds check lets an oversized allocation pass validation. An unauthenticated attacker can send a SOAP message carrying an X.509 certificate whose SubjectKeyIdentifier extension declares a length of 0x7FFFFFFF; WSS4J decodes this while resolving the signature's key reference, before the message is authenticated, so an eleven-byte extension triggers a 2 GB allocation. Repeated requests exhaust server memory.
Users are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4, which fix this issue.19dCVE-2026-955877.5 ALT20.1%
——6Unauthenticated Broken Access Control in Hostinger Migrator <= 1.0 versions.25dCVE-2026-955318.8 ALT40.3%
——12Subscriber PHP Object Injection in Conversational Forms for ChatBot <= 1.5.0 versions.25dCVE-2026-946838.8 ALT27.7%
——8Contributor PHP Object Injection in DesignSetGo <= 2.8.0 versions.25dCVE-2026-946815.9 MED21.1%
——6Unauthenticated Denial of Service Attack in WP Store Locator < 3.0.0 versions.25dCVE-2026-946788.8 ALT30.9%
——9Contributor PHP Object Injection in Go Live Update Urls <= 7.0.8 versions.25dCVE-2026-946777.2 ALT32.6%
——10Shop manager PHP Object Injection in Kadence WooCommerce Email Designer <= 1.5.19.1 versions.25dCVE-2026-946746.5 MED4.7%
——1Contributor Cross Site Scripting (XSS) in Pixel Manager for WooCommerce <= 1.69.0 versions.25dCVE-2026-946735.3 MED14.8%
——4Unauthenticated Insecure Direct Object References (IDOR) in Simply Schedule Appointments <= 1.6.12.31 versions.25dCVE-2026-946724.3 MED10.6%
——3Contributor Insecure Direct Object References (IDOR) in Safe SVG <= 2.5.0 versions.25dCVE-2026-944997.1 ALT20.0%
——6Subscriber Broken Access Control in FormGent <= 1.12.2 versions.25dCVE-2026-943899.0 CRÍ38.7%
——12Unauthenticated Remote Code Execution (RCE) in AcyMailing SMTP Newsletter <= 11.0.5 versions.25dCVE-2026-941787.5 ALT22.0%
——7Subscriber Privilege Escalation in Import and export users and customers <= 2.5.2 versions.25dCVE-2026-941778.5 ALT16.6%
——5Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ruben Garcia GamiPress gamipress allows Blind SQL Injection.This issue affects GamiPress: from n/a through 8.0.2.8dCVE-2026-941735.4 MED10.2%
——3Contributor Insecure Direct Object References (IDOR) in Business Directory <= 6.4.27 versions.25dCVE-2026-941237.5 ALT33.0%
——10Unauthenticated Arbitrary File Download in NextGEN Gallery <= 4.5.0 versions.25dCVE-2026-941227.2 ALT29.4%
——9Editor PHP Object Injection in Responsive Slider Gallery <= 1.5.5 versions.25dCVE-2026-941218.8 ALT30.9%
——9Contributor PHP Object Injection in 10Web Booster – Website speed optimization, Cache & Page Speed optimizer <= 2.33.6 versions.25dCVE-2026-941207.5 ALT20.1%
——6Unauthenticated Broken Access Control in GravityExport Lite for Gravity Forms <= 2.7.2 versions.25dCVE-2026-941158.5 ALT16.6%
——5Contributor SQL Injection in Easy Pricing Tables <= 4.1.2 versions.25dCVE-2026-940827.6 ALT19.1%
——6Author SQL Injection in Quiz Cat <= 3.1.1 versions.25dCVE-2026-940817.1 ALT6.9%
——2Unauthenticated Cross Site Scripting (XSS) in WordPress Persistent Login <= 3.1.3 versions.25dCVE-2026-940787.1 ALT9.1%
——3Unauthenticated Cross Site Scripting (XSS) in Site Reviews <= 8.3.1 versions.25dCVE-2026-940776.5 MED6.8%
——2Contributor Cross Site Scripting (XSS) in Safe SVG <= 2.5.0 versions.25dCVE-2026-940768.8 ALT27.7%
——8Contributor PHP Object Injection in SEO Plugin by Squirrly SEO <= 14.2.5 versions.25dCVE-2026-940746.5 MED10.2%
——3Unauthenticated Broken Access Control in Simply Schedule Appointments <= 1.6.12.29 versions.25dCVE-2026-937717.2 ALT29.4%
——9Shop manager PHP Object Injection in Cost of Goods for WooCommerce <= 3.5.2 versions.25dCVE-2026-937707.1 ALT9.1%
——3Unauthenticated Cross Site Scripting (XSS) in WP Statistics <= 14.16.13 versions.25dCVE-2026-936517.2 ALT29.4%
——9Author PHP Object Injection in Minimum and Maximum Quantity for WooCommerce <= 2.1.2 versions.25dCVE-2026-936247.2 ALT29.4%
——9Shop manager PHP Object Injection in Music Player for WooCommerce <= 1.9.1 versions.25dCVE-2026-936218.2 ALT15.7%
——5Unauthenticated SQL Injection in WP Data Access <= 5.5.84 versions.25dCVE-2026-935147.1 ALT6.9%
——2Unauthenticated Cross Site Scripting (XSS) in Notification for Telegram <= 3.5.2 versions.25d