Vulnerabilities exploitable today
378,755in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,721
New KEV · 24H0
Exploit Today ≥ 701,652
Distribution · last window
- Critical2,413
- High8,699
- Medium6,979
- Low789
Filters
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2023-0818—34.0%
——10——CVE-2025-6325—34.0%
——10——CVE-2010-5257—34.0%
——10——CVE-2008-0049—34.0%
——10——CVE-2023-34289—34.0%
——10——CVE-2000-0356—34.0%
——10——CVE-2002-2083—34.0%
——10——CVE-2003-1528—34.0%
——10——CVE-2024-33921—34.0%
——10——CVE-2024-3939—34.0%
——10——CVE-2024-33307—34.0%
——10——CVE-2025-58719—34.0%
——10——CVE-2026-82761—34.0%
——10Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in team-alembic AshAuthentication allows an attacker holding a leaked magic link to replay its single-use token and authenticate as the target subject. A magic link configured with single_use_token?, which is the default, is meant to be redeemable exactly once, but nothing serialises the token's validity check against its consumption, so concurrent redemptions of one token all succeed and each yields a full user token.
Sign-in verifies the JWT with Jwt.verify/4 and revokes it only afterwards: AshAuthentication.Strategy.MagicLink.SignInPreparation revokes in a Query.after_action callback, and AshAuthentication.Strategy.MagicLink.SignInChange in an after_transaction hook that runs once the sign-in has already committed. AshAuthentication.TokenResource.Actions.revoke/3 writes the revocation as an upsert, so a concurrent duplicate revocation silently succeeds instead of conflicting and no request ever loses the race.
This issue affects ash_authentication: from 3.9.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.5dCVE-2025-8372—34.0%
——10——CVE-2022-31258—34.0%
——10——CVE-2000-0950—34.0%
——10——CVE-2023-48759—34.0%
——10——CVE-2024-0334—34.0%
——10——CVE-2019-19792—34.0%
——10——CVE-2024-4372—34.0%
——10——CVE-2025-6585—34.0%
——10——CVE-2023-6228—34.0%
——10——CVE-2023-35709—34.0%
——10——CVE-2022-3901—34.0%
——10——CVE-2023-34250—34.0%
——10——CVE-2025-11540—34.0%
——10——CVE-2023-38092—34.0%
——10——CVE-2023-40256—34.0%
——10——CVE-2024-4094—34.0%
——10——CVE-2025-68895—34.0%
——10——CVE-2003-1225—34.0%
——10——CVE-2026-87968.1 HIG34.0%
——10Sereal::Decoder versions before 5.005 for Perl allow heap out-of-bounds read via crafted input.
In Perl/Decoder/srl_decoder.c, srl_read_object() and srl_read_hash() process a COPY tag, a back-reference whose target byte the decoder re-decodes as a fresh tag. When that target byte matches the SHORT_BINARY pattern (an inline string whose length is encoded in the low bits of the tag), the resulting read is not bounded to precede the COPY tag's own offset and can run past the end of the input buffer. An attacker controlled COPY offset can land inside a previously decoded value rather than on a tag boundary, planting a byte that the decoder reads as a SHORT_BINARY tag and consuming up to 31 following bytes from the heap as a class name (OBJECT path) or hash key (HASH path).63dCVE-2024-32744—34.0%
——10——CVE-2025-37165—34.0%
——10——CVE-2024-1293—34.0%
——10——CVE-2026-158999.6 CRI34.0%
——10Use after free in CameraCapture in Google Chrome on Mac prior to 150.0.7871.128 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)58dCVE-2026-801819.1 CRI34.0%
——10Apache Allura's webhooks are vulnerable to Server-Side Request Forgery (SSRF).
This issue affects Apache Allura: through 1.20.0.
Users are recommended to upgrade to version 1.21.0, which fixes the issue.14dCVE-2026-28804—34.0%
——10——CVE-2026-202498.6 HIG34.0%
——10A vulnerability in the certification authentication feature of Internet Key Exchange version 2 (IKEv2) for Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause an affected device to reload unexpectedly.
This vulnerability is due to a logic error during the certificate authentication phase of the IKEv2 connection setup. An attacker could exploit this vulnerability by attempting to establish an IKEv2 VPN connection with a crafted certificate. A successful exploit could allow the attacker to cause the IKEv2 process to crash, causing a denial of service (DoS) condition.5dCVE-2023-38090—34.0%
——10——