Vulnerabilities exploitable today
379,275in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,721
New KEV · 24H0
Exploit Today ≥ 701,654
Distribution · last window
- Critical2,375
- High8,541
- Medium7,075
- Low796
Filters
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2019-20077—34.9%
——10——CVE-2023-49745—34.9%
——10——CVE-2025-57055—34.9%
——10——CVE-2026-438059.8 CRI34.9%
——10A race condition was addressed with improved state handling. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, watchOS 26.6. An app may be able to cause unexpected system termination or write kernel memory.58dCVE-2025-59144—34.9%
——10debug is a JavaScript debugging utility. On 8 September 2025, the npm publishing account for debug was taken over after a phishing attack. Version 4.4.2 was published, functionally identical to the previous patch version, but with a malware payload added attempting to redirect cryptocurrency transactions to the attacker's own addresses from within browser environments. Local environments, server environments, command line applications, etc. are not affected. If the package was used in a browser context (e.g. a direct <script> inclusion, or via a bundling tool such as Babel, Rollup, Vite, Next.js, etc.) there is a chance the malware still exists and such bundles will need to be rebuilt. The malware seemingly only targets cryptocurrency transactions and wallets such as MetaMask. npm removed the offending package from the registry over the course of the day on 8 September, preventing further downloads from npm proper. On 13 September, the package owner published new patch versions to help cache-bust those using private registries who might still have the compromised version cached. Users should upgrade to the latest patch version, completely remove their node_modules directory, clean their package manager's global cache, and rebuild any browser bundles from scratch. Those operating private registries or registry mirrors should purge the offending versions from any caches. This issue has been resolved in 4.4.3.17hCVE-2026-626996.8 MED34.9%
——10Heap-based buffer overflow in Windows Universal Disk Format File System Driver (UDFS) allows an unauthorized attacker to execute code with a physical attack.39dCVE-2026-503775.5 MED34.9%
——10Out-of-bounds read in Windows Kernel allows an authorized attacker to elevate privileges locally.65dCVE-2017-4948—34.9%
——10——CVE-2023-47654—34.9%
——10——CVE-2024-8687—34.9%
——10——CVE-2026-188248.4 HIG34.9%
——10IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.20dCVE-2026-23939—34.9%
——10——CVE-2023-5467—34.9%
——10——CVE-2024-44038—34.9%
——10——CVE-2025-7773—34.9%
——10——CVE-2024-6878—34.9%
——10——CVE-2024-30278—34.9%
——10——CVE-2026-713486.8 MED34.9%
——10Heap-based buffer overflow in Windows Spaceport.sys allows an unauthorized attacker to execute code with a physical attack.9dCVE-2021-418647.8 HIG34.9%
——10prealloc_elems_and_freelist in kernel/bpf/stackmap.c in the Linux kernel before 5.14.12 allows unprivileged users to trigger an eBPF multiplication integer overflow with a resultant out-of-bounds write.50dCVE-2026-584204.4 MED34.9%
——10Local File Inclusion via file:// URI in Migration Restore29dCVE-2024-5769—34.9%
——10——CVE-2026-156807.5 HIG34.9%
——10Lorex 2K Indoor Wi-Fi Security Camera CDeviceOperator Format String Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Lorex 2K Indoor Wi-Fi Security Cameras. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the parsing of JSON requests in the sonia binary. The issue results from the lack of proper validation of a user-supplied string before using it as a format specifier. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-25884.72dCVE-2023-51067—34.9%
——10——CVE-2024-23149—34.9%
——10——CVE-2024-30534—34.9%
——10——CVE-2025-69002—34.9%
——10——CVE-2025-23974—34.9%
——10——CVE-2019-10433—34.9%
——10——CVE-2025-5597—34.9%
——10——CVE-2026-19672—34.9%
——10The tarfile module's tar and data
extraction filters created directories outside the destination for
members whose name leaves the destination and returns to it, such as ../evil/../dest/sub/file. The containment check used the resolved path, but intermediate directories were created from the name as given.
Only
empty directories are created outside the destination. Member contents
are still extracted inside it. To return to the destination the member's
name must contain the destination directory's own final component, so
extraction into a secure randomised directory is not affected.
This affects POSIX platforms only. On Windows, .. components are collapsed before the path reaches the filesystem, so the directories outside the destination are never created.27dCVE-2024-28584—34.9%
——10——CVE-2022-33213—34.9%
——10——CVE-2023-46935—34.9%
——10——CVE-2026-22588—34.9%
——10——CVE-2023-50565—34.9%
——10——CVE-2026-196589.8 CRI34.9%
——10The Give Tributes plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.3.1 via deserialization of untrusted input . This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. This vulnerability is only reachable when the "Allow Multiple Recipients" option is enabled for the donation form, as the single-recipient code path applies sanitize_textarea_field() which would neutralize the payload. Exploitation additionally requires the eCard "Custom Message" option to be disabled, which is the plugin default: when it is enabled the personalized message becomes a required field and GiveWP's give_clean() blanks serialized input during validation, causing the donation to be rejected before it is stored.2dCVE-2024-34432—34.9%
——10——CVE-2026-535188.1 HIG34.9%
——10Better Auth is an authentication and authorization library for TypeScript. From 1.6.0 until 1.6.11, the @better-auth/oauth-provider POST /oauth2/token endpoint for the authorization_code grant redeems a single-use authorization code through a non-atomic find-then-delete sequence, allowing two concurrent requests to pass the read step and mint independent access tokens, refresh tokens, and ID tokens; legacy /oauth2/token and /mcp/token paths in oidc-provider and mcp plugins share the same primitive. This issue is fixed in version 1.6.11.65dCVE-2026-400668.8 HIG34.9%
——10Anviz CX2 Lite and CX7 are vulnerable to unverified update packages that can be uploaded. The device unpacks and executes a script resulting in unauthenticated remote code execution.75dCVE-2024-48126—34.9%
——10——