CVE Watch401,106 in full archive

Vulnerabilities exploitable today

16,675in current view

Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.

In KEV catalog1,754

New KEV · 24H0

Exploit Today ≥ 701,665

Distribution · last window

Critical
3,504
High
15,968
Medium
14,895
Low
1,474

Filters

Window

Severity

Flags

Vulnerabilities12,561–12,600 · 16,675

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-475017.8 HIG

3.5%

——1NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where a user could cause an out-of-bounds write by supplying mismatched memory buffers during event buffer setup. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.20d CVE-2026-475007.8 HIG

3.2%

——1NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where improper cleanup of reference counts during error paths could lead to a use-after-free condition. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.20d CVE-2026-474997.8 HIG

2.1%

——1NVIDIA vGPU Virtual GPU Manager for Windows and Linux contains a vulnerability in the kernel mode layer where a guest could cause an out-of-bounds read. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.20d CVE-2026-474987.8 HIG

2.1%

——1NVIDIA vGPU Manager contains a vulnerability in the GPU System Processor (GSP) plugin where a guest VM user may cause an out-of-bounds write by sending a specially crafted RPC message. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, denial of service, and information disclosure.20d CVE-2026-474977.8 HIG

0.9%

——0NVIDIA Virtual GPU Manager contains a vulnerability in the GPU System Processor (GSP) tracing component where a guest VM user may cause improper access by sending crafted data through a shared buffer. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, denial of service, and information disclosure.20d CVE-2026-474967.3 HIG

1.6%

——0NVIDIA GPU Display Driver for Linux contains a vulnerability in the Virtual GPU Manager (vGPU plugin) where a guest VM user may cause an out-of-bounds write by sending a specially crafted RPC call to the host. A successful exploit of this vulnerability might lead to escalation of privileges, data tampering, and denial of service.20d CVE-2026-474957.8 HIG

2.1%

——1NVIDIA vGPU Virtual GPU Manager for Windows and Linux contains a vulnerability in the kernel mode layer where a user could cause an out-of-bounds write. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.20d CVE-2026-474947.8 HIG

3.5%

——1NVIDIA GPU Display Driver for Linux contains a vulnerability where a user might be able to cause a format string issue. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, denial of service, and information disclosure.20d CVE-2026-474937.8 HIG

1.4%

——0NVIDIA vGPU software for Windows and Linux contains a vulnerability in the GPU kernel driver where a guest may access privileged host GPU resources for which it is not authorized. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, denial of service, and information disclosure.20d CVE-2026-474917.8 HIG

3.5%

——1NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an unprivileged user can cause improper release of memory resources, leaving a mapping accessible after the underlying memory is reused. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.20d CVE-2026-1034363.7 LOW

20.5%

——6apcupsd through 3.14.14 discloses uninitialized stack memory in getupsvar() in src/cgi/upsfetch.c (used by upsstats.cgi, multimon.cgi, and upsfstats.cgi. On the single-field path, when the matched STATUS line has fewer than three whitespace-separated tokens, sscanf("%*s %*s %s", answer) performs no assignment but the function returns success, and thus the caller prints the uninitialized destination buffer into the HTTP response.19d CVE-2026-1032317.3 HIG

34.1%

——10A vulnerability was identified in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. The affected element is the function mysqli_query of the file User/cancel.php of the component Order Cancellation. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.19d CVE-2026-10242710.0 CRI

55.6%

——17Joomla Extension - ordasoft.com - Unauthenticated Remote Code Execution in OrdaSoft Joomla CCK < 8.3.16 - site/uploader.php is reached through the component’s normal frontend routing (task=getContent), a task with no authentication or ACL check anywhere in the dispatch chain. The handler validates the uploaded file’s content with a real magic-byte MIME check, but the extension allow-list that would otherwise restrict the saved file’s extension was present in the source and commented out. The saved file’s extension was taken directly from the attacker-supplied filename with no validation, and the file was written to a path directly under the Joomla web root that is executed by the PHP handler. An image/PHP polyglot, a file whose header bytes satisfy the MIME check with PHP source appended after, passed the content check while carrying a .php extension of the attacker’s choosing.20d CVE-2026-1002803.1 LOW

6.2%

——2In JetBrains YouTrack before 2026.2.19197 creating a project from an unreadable custom template was possible19d CVE-2026-1002796.5 MED

15.1%

——5In JetBrains YouTrack before 2026.2.19197 changing an integration URL exposed its stored credentials19d CVE-2026-1002784.9 MED

13.5%

——4In JetBrains YouTrack before 2026.2.19197 users with restricted permission could edit and hide other users' comments19d CVE-2026-1002778.9 HIG

19.5%

——6In JetBrains YouTrack before 2026.2.19197 account takeover was possible by replaying a notification signature19d CVE-2026-1002765.9 MED

11.4%

——3In JetBrains YouTrack before 2026.2.19197 guest users could remove a workflow action's visibility restriction and run the action19d CVE-2026-1002756.9 MED

8.2%

——2In JetBrains YouTrack before 2026.2.19197 stored XSS in the workflow error notification toast was possible19d CVE-2026-1002746.5 MED

57.2%

——17In JetBrains YouTrack before 2026.2.19197 project Admin could trigger DoS via a notification template19d CVE-2026-1002738.2 HIG

21.6%

——6In JetBrains YouTrack before 2026.2.19197 authorisation bypass in the scripts debugger allowed arbitrary code execution19d CVE-2026-1002724.9 MED

19.9%

——6In JetBrains YouTrack before 2026.2.19197 missing authorisation in the notification template preview allowed Project Administrators to read restricted issues19d CVE-2026-1002712.7 LOW

12.7%

——4In JetBrains YouTrack before 2026.2.19197 missing authorisation on several endpoints allowed authenticated users to access information from other projects19d CVE-2026-1002703.3 LOW

5.9%

——2In JetBrains YouTrack before 2026.2.19197 low-level Admin Read permission users could disclose integration credentials via import configurations19d CVE-2026-1002694.3 MED

9.6%

——3In JetBrains YouTrack before 2026.2.19197 helpdesk project's Authorized Reporters list could be bypassed20d CVE-2026-1002687.7 HIG

12.8%

——4In JetBrains YouTrack before 2026.2.19197 project administrators could read comments from other projects via notification templates20d CVE-2026-1002675.9 MED

19.9%

——6In JetBrains YouTrack before 2026.2.19197 reDoS attack was possible via mailbox regex mail-rule filters20d CVE-2026-1002667.7 HIG

12.7%

——4In JetBrains Hub before 2026.2.52366 missing authorisation allowed authenticated users to send arbitrary emails from the server's trusted address19d CVE-2026-1002654.8 MED

0.9%

——0In JetBrains Rider before 2026.2.1 aI Assistant could auto-update third-party skills without user confirmation19d CVE-2026-1002642.7 LOW

12.7%

——4In JetBrains YouTrack before 2026.2.18991 stored SMTP server credentials could be disclosed by changing the server host19d CVE-2026-1002634.7 MED

8.4%

——3In JetBrains YouTrack before 2026.2.18991 stored HTML injection via the User-Agent header was possible19d CVE-2026-1002627.6 HIG

10.8%

——3In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed users with read-only project access to overwrite project notification templates19d CVE-2026-1002615.4 MED

6.6%

——2In JetBrains YouTrack before 2026.2.18991 changing article visibility settings was possible without update permission19d CVE-2026-1002605.3 MED

17.3%

——5In JetBrains YouTrack before 2026.2.18991 mailbox integration allowed authentication after a password reset19d CVE-2026-1002594.3 MED

8.5%

——3In JetBrains YouTrack before 2026.2.18991 improper access control on Gantt chart allowed edits by users with view-only access19d CVE-2026-1002584.3 MED

50.3%

——15In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed read-only users to read project settings19d CVE-2026-1002574.3 MED

10.0%

——3In JetBrains YouTrack before 2026.2.18991 sSRF via stored XHTML injection was possible during PDF export19d CVE-2026-1002567.8 HIG

2.6%

——1In JetBrains IntelliJ IDEA before 2026.2.3 rCE via Structural Search script constraints was possible in untrusted projects19d CVE-2026-1002558.1 HIG

27.2%

——8In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 administrator account takeover was possible via password reset19d CVE-2026-1002548.8 HIG

39.5%

——12In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 authenticated users could execute commands on Windows servers via CRLF injection in Pipeline Git connection settings15d