CVE Watch401,106 in full archive

Vulnerabilities exploitable today

401,106in current view

Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.

In KEV catalog1,754

New KEV · 24H0

Exploit Today ≥ 701,665

Distribution · last window

Critical
3,504
High
15,968
Medium
14,895
Low
1,474

Filters

Window

Severity

Flags

Vulnerabilities400,441–400,480 · 401,106

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2018-16905—

—

——0Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none3d CVE-2026-25973—

—

——0Rejected reason: Not used3d CVE-2020-13604—

—

——0Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none3d CVE-2018-4551—

—

——0Rejected reason: This candidate is unused by its CNA.3d CVE-2025-55718—

—

——0Rejected reason: Not used3d CVE-2025-55719—

—

——0Rejected reason: Not used3d CVE-2026-108519—

—

——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.3d CVE-2020-8363—

—

——0Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none3d CVE-2025-47858—

—

——0Rejected reason: Not used3d CVE-2023-36856—

—

——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused55d CVE-2026-915146.5 MED

—

——0Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Server). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle BI Publisher. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle BI Publisher accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).13h CVE-2020-8372—

—

——0Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none3d CVE-2025-71149—

—

——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.5d CVE-2013-5294—

—

——0Rejected reason: This candidate is unused by its CNA.3d CVE-2020-8414—

—

——0Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none3d CVE-2026-915068.1 HIG

—

——0Vulnerability in the Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Workflow. Successful attacks of this vulnerability can result in takeover of Workflow. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).13h CVE-2012-3768—

—

——0Rejected reason: This candidate is unused by its CNA.3d CVE-2012-3662—

—

——0Rejected reason: This candidate is unused by its CNA.3d CVE-2020-13001—

—

——0Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none3d CVE-2011-0171—

—

——0Rejected reason: This candidate is unused by its CNA.3d CVE-2010-4017—

—

——0Rejected reason: This candidate is unused by its CNA.3d CVE-2014-7854—

—

——0Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none3d CVE-2026-1140926.5 MED

—

——0Trigger.dev before 4.5.0 performs no authentication or organization check in the action handler of the dashboard run replay route (resources.taskruns.$runParam.replay) and looks up the run by friendlyId alone. A remote attacker who knows a victim's run friendlyId can replay it into an environment of their choosing, exposing the victim's task payload or running the task again with the victim's secrets.10h CVE-2026-29024—

—

——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.5d CVE-2026-1140948.8 HIG

—

——0Dulwich before 1.2.9 fails to validate DOS drive letter prefixes in Git tree path elements on Windows, allowing arbitrary file write. Attackers can craft a malicious repository with a tree entry named 'C:' that bypasses NTFS validation and writes files outside the worktree to achieve remote code execution.10h CVE-2026-1140956.5 MED

—

——0Dulwich before 1.2.9 contains a denial of service vulnerability in Pack.resolve_object that allows attackers to cause infinite recursion via self-referential OFS_DELTA objects. Attackers can supply a malicious packfile with an OFS_DELTA delta_offset of 0 to exhaust CPU during clone, fetch, or cat-file operations.10h CVE-2026-1140967.8 HIG

—

——0Dulwich from 0.24.0 before 1.2.8 contains a symlink following vulnerability in porcelain.checkout(paths=[...]) that allows attackers to write arbitrary files by abusing raw os.open without O_NOFOLLOW. Attackers can craft a repository where a worktree symlink points to .git/hooks/post-checkout, so restoring the file from a tag writes a malicious hook for code execution.10h CVE-2016-0625—

—

——0Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none3d CVE-2026-1141089.8 CRI

—

——0HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a missing authentication vulnerability that allows unauthenticated attackers to access the FastAPI surface because require_auth() returns early when API_AUTH_KEY is unset. Attackers can post messages to /sessions/{id}/messages to trigger root shell commands via BashTool, upload .py or .sh files via /upload, read session histories, and obtain partial API keys.10h CVE-2026-1141098.8 HIG

—

——0uv before 0.11.15 contains a path traversal vulnerability that allows malicious wheels to write files outside the scripts directory via crafted console_scripts or gui_scripts entry point names. Attackers who induce users to install a malicious wheel can place executables in PATH directories, shadowing or overwriting existing binaries for code execution.10h CVE-2019-6174—

—

——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.3d CVE-2026-1141105.3 MED

—

——0Astral uv before 0.11.6 contains a path traversal vulnerability that allows attackers to delete arbitrary files by supplying wheels with relative traversal paths in RECORD entries. Attackers can craft a malicious wheel whose RECORD references files outside the installation prefix, causing uv to delete those files when the user uninstalls the package.10h CVE-2026-114111—

—

——0sharp before 0.35.5 bundles a librsvg dependency affected by a memory-related vulnerability (CVE-2026-96889) that, under certain runtime-specific conditions, can lead to code execution on glibc-based Linux. An attacker can supply a crafted SVG image that, when decoded by sharp through librsvg, may result in arbitrary code execution.10h CVE-2026-1141165.3 MED

—

——0Vyper 0.1.0b1 before 0.1.0b17 and 0.4.1 through 0.5.0b1 builds its source-line table with str.splitlines(), which treats characters like form feed and U+2028 as line breaks the Python parser ignores, so numeric literals are classified and validated from shifted source text. An attacker contributing source code can hide these characters in comments, strings or indentation to silently change address, integer or decimal constants.10h CVE-2023-44376—

—

——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.3d CVE-2020-8361—

—

——0Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none3d CVE-2025-64453—

—

——0Rejected reason: Not used3d CVE-2017-4189—

—

——0Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017. Notes: none3d CVE-2017-17336—

—

——0Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none3d CVE-2023-35761—

—

——0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused55d