Vulnerabilities exploitable today
378,377in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,717
New KEV · 24H0
Exploit Today ≥ 701,649
Distribution · last window
- Critical2,326
- High8,522
- Medium6,833
- Low770
Filters
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2024-48654—32.9%
——10——CVE-2016-7437—32.9%
——10——CVE-2015-1170—32.9%
——10——CVE-2024-43120—32.9%
——10——CVE-2023-39314—32.9%
——10——CVE-2024-25156—32.9%
——10——CVE-2025-50263—32.9%
——10——CVE-2025-8914—32.9%
——10——CVE-2026-21625—32.9%
——10——CVE-2023-6082—32.9%
——10——CVE-2025-22610—32.9%
——10——CVE-2010-4175—32.9%
——10——CVE-2026-47577.2 HIG32.9%
——10A VAPIX API parameter had improper input validation which could allow code execution and potentially lead to a privilege escalation. This flaw can only be exploited after authenticating with an administrator-privileged service account.19dCVE-2025-1169—32.9%
——10——CVE-2025-53791—32.9%
——10——CVE-2026-876099.6 CRI32.9%
——10Use after free in Sharing in Google Chrome on on iOS prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: Medium)13dCVE-2025-50258—32.9%
——10——CVE-2026-161418.1 HIG32.9%
——10OpenBMC's IPMI implementation, phosphor-net-ipmid, contains a logic flaw in which an unauthenticated client can force the RAKP Message 1 handler to return before it overwrites the authentication object's constructor defaults. The IPMI service then accepts a RAKP Message 3 whose HMAC is computed with the constant 20-byte 'userKey' initialized from the string '0penBmc' and an often-predictable 'bmcRandomNum'. Several downstream vendors implement phosphor-net-ipmid as their IPMI stack, such as NVIDIA and H3C.4dCVE-2024-12738—32.9%
——10——CVE-2026-348767.5 HIG32.9%
——10An issue was discovered in Mbed TLS 3.x before 3.6.6. An out-of-bounds read vulnerability in mbedtls_ccm_finish() in library/ccm.c allows attackers to obtain adjacent CCM context data via invocation of the multipart CCM API with an oversized tag_len parameter. This is caused by missing validation of the tag_len parameter against the size of the internal 16-byte authentication buffer. The issue affects the public multipart CCM API in Mbed TLS 3.x, where mbedtls_ccm_finish() can be invoked directly by applications. In Mbed TLS 4.x versions prior to the fix, the same missing validation exists in the internal implementation; however, the function is not exposed as part of the public API. Exploitation requires application-level invocation of the multipart CCM API.60dCVE-2026-20098—32.9%
——10——CVE-2020-10844—32.9%
——10——CVE-2024-12871—32.9%
——10——CVE-2024-10875—32.9%
——10——CVE-2008-4945—32.9%
——10——CVE-2008-4947—32.9%
——10——CVE-2014-4325—32.9%
——10——CVE-2026-44322—32.9%
——10——CVE-2026-790649.6 CRI32.9%
——10Use after free in Network in Google Chrome on on Mac prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: Medium)27dCVE-2008-5148—32.9%
——10——CVE-2026-875049.6 CRI32.9%
——10Use after free in Core in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: Medium)13dCVE-2023-33359—32.9%
——10——CVE-2024-21517—32.9%
——10——CVE-2014-4275—32.9%
——10——CVE-2018-10195—32.9%
——10——CVE-2021-40043—32.9%
——10——CVE-2025-62016—32.9%
——10——CVE-2015-0238—32.9%
——10——CVE-2023-25148—32.9%
——10——CVE-2025-1082—32.9%
——10——