Vulnerabilities exploitable today
412,870in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,779
New KEV · 24H0
Exploit Today ≥ 701,703
Distribution · last window
- Critical5,666
- High22,249
- Medium20,641
- Low2,127
Filters
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-1209745.3 MED—
——0On affected platforms running Arista EOS with IPsec AutoVPN Feature configured with dynamic paths, the configured IPsec replay window may not be applied as expected. As a result, IPsec anti-replay protection may be silently inactive even when it has been configured via an SA policy, contrary to the operator's expectation. This issue does not allow decryption of the affected IPsec traffic, but it may allow replay of previously valid protected traffic.11hCVE-2017-4777——
——0Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2017. Notes: none26dCVE-2026-1208147.2 HIG—
——0An improper privilege management issue in the sharding subsystem of MongoDB Server may allow a user holding certain shard-level administrative privileges to cause persisted internal coordination state to be reprocessed with elevated internal authority. Because that state is trusted rather than re-validated, operations may be carried out beyond the user's authorized scope, including changes to cluster-wide security configuration. Successful triggering this issue requires an authenticated session directly against a cluster member and can result in unauthorized access to and modification of data across the cluster.9hCVE-2014-3644——
——0Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none24dCVE-2026-1208135.9 MED—
——0An issue in MongoDB Server's client-side field-level encryption (CSFLE) schema processing component allows encryption metadata to be silently dropped during schema parsing under certain conditions. A party who can deliver a specially crafted schema to a user's CSFLE client may cause sensitive data intended for encryption to be stored in plaintext, bypassing confidentiality protections. Exploitation requires the ability to deliver the malicious schema to the user's client, such as through a man-in-the-middle position or an untrusted server.9hCVE-2026-1208115.9 MED—
——0A use-after-free issue exists in the MongoDB server’s classic query engine plan cache. Under certain query conditions, an unowned reference to data from an earlier command can be retained in cached plan statistics. After the originating memory is freed, a subsequent diagnostic command serializing those statistics can read freed heap memory, potentially returning sensitive server process memory contents to the authenticated client. Under certain heap reuse conditions, this may also cause the server to crash.9hCVE-2026-1208106.5 MED—
——0An issue in MongoDB server’s aggregation framework allows an authenticated user with read privileges to cause a denial of service by sending specially crafted aggregate commands using an internal expression. Despite its internal naming, this expression is registered as accessible to any authenticated client. By supplying crafted input parameters across multiple concurrent connections, each evaluation triggers unbounded memory allocations with no per-expression memory limits enforced. This can exhaust available server memory and cause the mongod process to be terminated by the operating system’s out-of-memory killer.9hCVE-2026-1208037.1 HIG—
——0A use-after-free issue exists in MongoDB’s SBE (Slot-Based Execution) implementation of a window function accumulator used by certain $setWindowFields aggregation pipelines. Under specific conditions, the accumulator can retain a dangling pointer to memory that has since been freed. When this stale pointer is later dereferenced during serialization of the carried-forward value, it can result in a heap out-of-bounds read that may expose adjacent heap contents and crash the mongod server. An authenticated user with readWrite privileges on a database can trigger this issue by crafting a specific aggregation pipeline.9hCVE-2026-0195——
——0In fill of dma.rs, there is a possible way to trigger an out of bounds stack read during direct memory access fills due to a logic error. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.10hCVE-2026-0193——
——0In handle_rx_msg of tipc_virtio_dev, there is a possible Double Fetch TOCTOU due to Double Fetch. This could lead to local information disclosure with execution privileges needed. User interaction is for exploitation.10hCVE-2026-0191——
——0In event_set_sub of acropora_event.c, there is a possible Logic error due to a logic error in the code. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation.10hCVE-2026-969937.5 HIG—
——0Release of invalid pointer or reference in Windows Performance Monitor allows an unauthorized attacker to execute code over a network.9hCVE-2026-969864.9 MED—
——0Out-of-bounds read in Windows DNS allows an authorized attacker to disclose information over a network.5hCVE-2026-969854.9 MED—
——0Out-of-bounds read in Windows DNS allows an authorized attacker to disclose information over a network.5hCVE-2026-969844.9 MED—
——0Out-of-bounds read in Windows DNS allows an authorized attacker to disclose information over a network.5hCVE-2026-969835.3 MED—
——0Use after free in Windows DNS allows an unauthorized attacker to deny service over an adjacent network.5hCVE-2017-13973——
——0Rejected reason: This candidate is unused by its CNA.24dCVE-2026-969826.8 MED—
——0Integer overflow or wraparound in HID Parser Library allows an unauthorized attacker to elevate privileges with a physical attack.6hCVE-2026-969816.4 MED—
——0Out-of-bounds write in Windows PCI Bus Driver allows an unauthorized attacker to elevate privileges with a physical attack.6hCVE-2026-969804.9 MED—
——0Out-of-bounds read in Windows DNS allows an authorized attacker to disclose information over a network.5hCVE-2026-969796.8 MED—
——0Integer overflow or wraparound in HID Parser Library allows an unauthorized attacker to elevate privileges with a physical attack.6hCVE-2026-969787.0 HIG—
——0Use after free in Windows Credential User Interface allows an authorized attacker to elevate privileges locally.6hCVE-2026-969764.9 MED—
——0Out-of-bounds read in Windows DNS allows an authorized attacker to disclose information over a network.5hCVE-2026-969755.9 MED—
——0Out-of-bounds read in DNS Server allows an unauthorized attacker to deny service over a network.5hCVE-2025-22154——
——0Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.2dCVE-2024-34157——
——0Rejected reason: reserved but not needed2dCVE-2024-54651——
——0Rejected reason: This candidate was in a CNA pool that was not assigned to any issues.14dCVE-2026-120730——
——0Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in the device API, device forms, signing key and product forms and JITP settings in nerves-hub nerves_hub_web allows an authenticated user who manages devices in any organization to write into other organizations via submitted org_id, product_id and deployment_id fields. The device API create and update actions and the dashboard device forms pass the request parameters to NervesHub.Devices.Device.changeset/2, which casts the organization, product, deployment group and update state as given. The signing key and product forms merge the session's organization into the submitted parameters so that a submitted org_id wins, and the JITP changeset accepts any product_id. Each request requires the manage role only in the user's own organization, and any account can create one.
A device placed on another organization's deployment group, or moved into its product, is sent that organization's firmware with a download URL. The user cannot change or control devices that already belong to the other organization, and cannot upload firmware to it.
This issue affects nerves_hub: from 1.0.0 before 2.5.3.20hCVE-2026-120997——
——0Improper Session Invalidation vulnerability in the dashboard pages, device console and local shell channels in nerves-hub nerves_hub_web allows an organization member who is removed or given a lower role to keep acting at their old role through anything they had open at the time. The dashboard reads the member's role once when a page mounts, in the assign_org_to_scope hook of NervesHubWeb.Auth, and the console, local shell and device event stream channels check membership once at join. Removing a member or changing their role tells none of them, so open pages keep carrying out actions and open consoles keep running commands on the device until the page reloads or the socket disconnects.
The dashboard also opens consoles over NervesHubWeb.UserSocket with a token that holds only the user's id, is accepted for 24 hours, and is not revoked by signing out, which disconnects only the session's LiveViews. Whoever holds a token taken from a page can open consoles as that user, within the user's current membership, until it expires.
This issue affects nerves_hub: from 1.0.0 before 2.5.3.20hCVE-2026-1256726.6 MED—
——0A flaw was found in cockpit-storaged. A Tang keyserver address read from a clevis token in a LUKS header is concatenated into curl's argument vector without a "--" separator. An address beginning with "-" is parsed by curl as an option instead of a hostname, allowing an attacker who can attach a crafted LUKS/clevis block device (for example, a local unprivileged user with an active console or desktop login session) to have an administratively-privileged Cockpit user unknowingly trigger curl option injection when editing the device's Tang keyserver settings. This can lead to arbitrary file read or write as the Cockpit session user.14hCVE-2026-956468.0 HIG—
——0Zoho Corporation ManageEngine DDI Central versions 6500 and below are vulnerable to a Unicode-based command injection vulnerability in the Cisco IOS DHCP configuration functionality. This vulnerability could allow cluster-scoped operators to inject specially crafted Unicode characters, resulting in the execution of unintended device commands.9hCVE-2026-1090978.2 HIG—
——0A vulnerability has been identified in ROS# (All versions < V2.3.1). Affected systems do not properly escape text of message definition files. This could allow an attacker that is able to pass a crafted message definition file to the user to inject arbitrary code into the generated program.19hCVE-2026-1098307.3 HIG—
——0A vulnerability has been identified in meta-iot2050 (All versions >= V01.03.01). Affected devices take parts from a configuration file and execute them unchecked. This could allow an attacker which is able to manipulate the configuration file to make the user execute arbitrary code on the device.15hCVE-2026-969746.8 MED—
——0Integer overflow or wraparound in HID Parser Library allows an unauthorized attacker to elevate privileges with a physical attack.6hCVE-2026-969737.0 HIG—
——0Use after free in Windows Encrypting File System (EFS) allows an authorized attacker to elevate privileges locally.6hCVE-2026-969727.5 HIG—
——0Out-of-bounds read in Windows DNS allows an unauthorized attacker to disclose information over a network.5hCVE-2024-58247——
——0Rejected reason: ** REJECT ** DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was in a CNA pool that was not assigned to any issues during 2024. Notes: none.2dCVE-2026-969717.0 HIG—
——0Use after free in Windows NetBIOS allows an authorized attacker to elevate privileges locally.6hCVE-2026-969704.9 MED—
——0Out-of-bounds read in Windows DNS allows an authorized attacker to disclose information over a network.5hCVE-2019-1288——
——0Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2019. Notes: none24d