Vulnerabilities exploitable today
379,275in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,721
New KEV · 24H0
Exploit Today ≥ 701,654
Distribution · last window
- Critical2,375
- High8,543
- Medium7,076
- Low796
Filters
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2017-18658—34.8%
——10——CVE-2026-88297.5 HIG34.8%
——10HTML::Entities versions before 3.84 for Perl read freed heap memory in _decode_entities.
The XS routine backing HTML::Entities::_decode_entities cached a pointer (repl) into the entity-value SV returned by hv_fetch on the entity2char hash. When the input SV was identical to a value SV in that hash, and that value contained its own key as an entity reference, a later call to grow_gap() reallocated the SV's PV buffer and freed the backing allocation that repl still pointed into. The subsequent copy loop read repl_len bytes from the freed allocation.
The read may disclose adjacent heap contents into the destination SV.64dCVE-2006-3784—34.8%
——10——CVE-2026-86688—34.8%
——10Session Fixation vulnerability in team-alembic ash_authentication allows an attacker who can plant a session identifier in a victim's browser to hold an authenticated session once that victim signs in.
AshAuthentication.Plug.Helpers.store_in_session/2 writes the authenticated subject into the existing session with Plug.Conn.put_session/3 and never calls Plug.Conn.configure_session(renew: true), so the identifier the visitor arrived with carries into their authenticated session. Every authentication event reaches this one function: the default success/4 injected by AshAuthentication.Phoenix.Controller.__using__/1, the AuthController emitted by mix ash_authentication_phoenix.install, and remember-me auto-login. AshAuthentication.Phoenix.Plug.store_in_session/2 is a defdelegate to it. Logout does not close the window either, because clear_session/2 ends with Plug.Conn.clear_session/1, which clears session contents but leaves the identifier intact, so a planted identifier survives a logout-then-login cycle.
This issue affects ash_authentication: from 0.2.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.6dCVE-2003-1067—34.8%
——10——CVE-2002-0442—34.8%
——10——CVE-2026-289664.3 MED34.8%
——10An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27. Processing a maliciously crafted file may lead to unexpected app termination.6dCVE-2021-44023—34.8%
——10——CVE-2018-2939—34.8%
——10——CVE-2024-52833—34.8%
——10——CVE-2025-52761—34.8%
——10——CVE-2001-0044—34.8%
——10——CVE-2026-627217.8 HIG34.8%
——10Insufficient granularity of access control in User-Mode Power Service (UMPS) allows an authorized attacker to elevate privileges locally.10dCVE-2026-759127.4 HIG34.8%
——10CodeWhale versions before 0.8.64 contain an argument injection vulnerability in the git_blame tool that allows attackers to read arbitrary files by injecting git options into the unvalidated rev parameter. Attackers can supply rev values like --contents=/path/to/file to exfiltrate sensitive files such as SSH keys and credentials through the tool output returned to the model.16dCVE-2025-22599—34.8%
——10——CVE-2010-3351—34.8%
——10——CVE-2025-64081—34.8%
——10——CVE-2024-29727—34.8%
——10——CVE-2026-7086—34.8%
——10——CVE-2024-30878—34.8%
——10——CVE-2017-18659—34.8%
——10——CVE-2024-29723—34.8%
——10——CVE-2024-33974—34.8%
——10——CVE-2020-35519—34.8%
——10——CVE-2024-46468—34.8%
——10——CVE-2024-3775—34.8%
——10——CVE-2024-29728—34.8%
——10——CVE-2026-41684—34.8%
——10——CVE-2023-25366—34.8%
——10——CVE-2024-51348—34.8%
——10——CVE-2025-60852—34.8%
——10——CVE-2023-49107—34.8%
——10——CVE-2026-179228.8 HIG34.8%
——10Inappropriate implementation in Enterprise in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Low)52dCVE-2026-52836—34.8%
——10OpenDDS is an open source C++ implementation of the Object Management Group (OMG) Data Distribution Service (DDS). Prior to 3.34.0, a network attacker can crash a reachable OpenDDS participant by sending a malformed RTPS UDP submessage whose crafted length or sequence-number state causes dds/DCPS/transport/rtps_udp/RtpsUdpReceiveStrategy.cpp in RtpsUdpReceiveStrategy::handle_input() to advance ACE_Message_Block::rd_ptr() beyond valid data. The parser can then call dds/DCPS/transport/rtps_udp/RtpsSampleHeader.cpp in RtpsSampleHeader::init(), which dereferences the invalid read pointer without first validating it against wr_ptr() or ensuring that a complete submessage header remains. The resulting SIGSEGV occurs in the receive thread, terminates the DDS process, and destroys the DDS entities hosted by that participant. No authentication, prior protocol state, or victim interaction is required. This issue is fixed in version 3.34.0.6dCVE-2026-543548.2 HIG34.8%
——10MapServer is a system for developing web-based GIS applications. Prior to 8.6.4, MapServer's PostGIS runtime filter translation in src/mappostgis.cpp and msPostGISLayerTranslateFilter() treats a filteritem as numeric when CONNECTIONTYPE POSTGIS and metadata such as gml_<item>_type=Integer are configured, but it does not verify that attacker-controlled CGI qstring or OGC API Features featureId input is a numeric literal. The unquoted input is concatenated into the generated PostgreSQL/PostGIS predicate, allowing an unauthenticated remote attacker with access to an affected query endpoint to bypass predicates, enumerate unintended records, perform boolean-based or time-based SQL injection, and increase database load. The issue does not by itself establish database modification capabilities. This issue is fixed in version 8.6.4.6dCVE-2024-3796—34.8%
——10——CVE-2026-504206.2 MED34.8%
——10Out-of-bounds read in Windows HTTP.sys allows an unauthorized attacker to disclose information locally.64dCVE-2025-29069—34.8%
——10——CVE-2025-12104—34.8%
——10——CVE-2000-0712—34.8%
——10——