Vulnerabilities exploitable today
378,377in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,717
New KEV · 24H0
Exploit Today ≥ 701,649
Distribution · last window
- Critical2,326
- High8,522
- Medium6,833
- Low770
Filters
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2024-50841—32.9%
——10——CVE-2026-9172—32.9%
——10——CVE-2025-3256—32.9%
——10——CVE-2025-26516—32.9%
——10——CVE-2018-25379—32.9%
——10——CVE-2025-31123—32.9%
——10——CVE-2018-11506—32.9%
——10——CVE-2024-51809—32.9%
——10——CVE-2025-3296—32.9%
——10——CVE-2024-34947—32.9%
——10——CVE-2024-32059—32.9%
——10——CVE-2024-32066—32.9%
——10——CVE-2024-32061—32.9%
——10——CVE-2024-32065—32.9%
——10——CVE-2025-15041—32.9%
——10——CVE-2025-3874—32.9%
——10——CVE-2026-733136.8 MED32.9%
——10XenForo before 2.3.13 contains a multi-factor authentication bypass vulnerability in the passkey TFA provider that allows an authenticated attacker to complete login as another user by submitting their own registered passkey credential during the WebAuthn assertion step. The passkey verification path performs a global credential lookup without validating that the matched credential belongs to the user whose login is pending, enabling an attacker who knows a target account's password to sign the challenge with their own passkey and bypass multi-factor authentication on both public forum and ACP login paths.8dCVE-2024-1595—32.9%
——10——CVE-2026-109548.8 HIG32.9%
——10Use after free in Actor in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)62dCVE-2024-51835—32.9%
——10——CVE-2025-9684—32.9%
——10——CVE-2022-28990—32.9%
——10——CVE-2023-38055—32.9%
——10——CVE-2024-51832—32.9%
——10——CVE-2024-51836—32.9%
——10——CVE-2024-51829—32.9%
——10——CVE-2023-47755—32.9%
——10——CVE-2024-51849—32.9%
——10——CVE-2024-12169—32.9%
——10——CVE-2026-552537.7 HIG32.9%
——10LangChain MongoDB provides integrations between MongoDB, Atlas, LangChain, and LangGraph. Prior to langgraph-checkpoint-mongodb 0.3.0 and langgraph-store-mongodb 0.4.0, MongoDBSaver.list(), MongoDBSaver.alist(), and MongoDBStore.search() incorporate filter dictionaries into MongoDB queries without recursively rejecting keys prefixed with $. An authenticated caller who controls a filter argument through HTTP query parameters, request body fields, or agent tool arguments can inject MongoDB Query Language operators such as $regex or $where. In a multi-tenant deployment that uses the filter to enforce per-user or per-tenant isolation, injected operators can bypass intended equality filtering and expose other tenants' checkpoint or store data. Filters constructed entirely from trusted server-side values have lower practical risk. This issue is fixed in langgraph-checkpoint-mongodb 0.3.0 and langgraph-store-mongodb 0.4.0.8dCVE-2026-54452—32.9%
——10safeurl is a server-side request forgery protection library. Prior to 0.2.4, the privateNetworks list in ip.go omits the IPv6 ranges 64:ff9b:1::/48, 5f00::/16, 3fff::/20, and 100:0:0:1::/64. When an application enables IPv6 with EnableIPv6(true), an attacker-controlled destination in one of these ranges is not recognized as non-public and can pass the SSRF destination check, potentially allowing access to resources hosted within the omitted ranges. IPv6 is disabled by default, and configurations that retain EnableIPv6(false) are not exposed to this bypass. This issue is fixed in version 0.2.4.6dCVE-2024-51819—32.9%
——10——CVE-2026-41877—32.9%
——10——CVE-2015-4231—32.9%
——10——CVE-2024-6601—32.9%
——10——CVE-2024-51850—32.9%
——10——CVE-2026-190097.3 HIG32.9%
——10A weakness has been identified in TinyAGI 0.0.20. This issue affects the function collectFiles of the file packages/core/src/response.ts of the component Message API Endpoint. This manipulation causes file inclusion. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.41dCVE-2024-32064—32.9%
——10——CVE-2026-106788.1 HIG32.9%
——10The MCTP-over-I2C+GPIO target binding in Zephyr (subsys/pmci/mctp/mctp_i2c_gpio_target.c) processes pseudo-register writes from an I2C bus master byte-by-byte in mctp_i2c_gpio_target_write_received() without validating the order or the receive buffer. In the affected versions the MCTP_I2C_GPIO_RX_MSG_ADDR (data) handler dereferences and writes through b->rx_pkt without checking that the receive buffer was allocated: a controller that selects the data register and writes a byte without first sending the length register (which is what allocates the buffer) causes a write of an attacker-chosen byte through a NULL/unallocated mctp_pktbuf pointer (i.e. into a small attacker-advanceable offset above address 0), producing memory corruption or a hard fault.
The same handler also performs a write-then-check bounds test, allowing a one-byte heap overflow at data[255] when more than 255 data bytes are sent.
Because the I2C target callback is invoked with raw bytes supplied by whatever device is the bus master and the binding performs no authentication, a malicious or malfunctioning controller on the bus can trigger these without any prior protocol state, leading to memory corruption and/or denial of service on the target device.
The vulnerable code was introduced when the I2C+GPIO target binding was added and shipped in Zephyr v4.3.0 and v4.4.0. The fix defers allocation to the first data byte with a NULL check, treats a missing length as a zero-sized packet rejected by libmctp, and moves the bounds check before the store.54dCVE-2026-1002—32.9%
——10——