CVE Watch378,377 in full archive

Vulnerabilities exploitable today

378,377in current view

Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.

In KEV catalog1,717

New KEV · 24H0

Exploit Today ≥ 701,649

Distribution · last window

Critical
2,329
High
8,527
Medium
6,840
Low
772

Filters

Window

Severity

Flags

Vulnerabilities254,041–254,080 · 378,377

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-557439.6 CRI

32.7%

——10The shell tool command allowlist in the SecurityPolicy of OpenHuman desktop agent through 0.54.0 (default Supervised security policy) can be bypassed to execute arbitrary OS commands with the privileges of the desktop user.43d CVE-2023-5460—

32.7%

——10——CVE-2026-24857—

——10——CVE-2026-855069.8 CRI

32.7%

——10ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in _get_dell_system_info_idrac_info in ipmi-oem/ipmi-oem-dell.c (idrac-info subcommand to dell get-system-info).13d CVE-2026-726766.5 MED

32.7%

——10Improper Control of Generation of Code ('Code Injection') (CWE-94) in Fleet Server can lead to the execution of attacker-supplied script content via Code Injection (CAPEC-242). Kibana accepted an identifier for an output configuration without restricting it to safe characters. That identifier is later placed into a server-side script that Fleet Server builds as part of routine agent policy processing, so script syntax embedded in the identifier became part of the script that was executed rather than being treated as data.18d CVE-2020-5384—

32.7%

——10——CVE-2024-10940—

——10——CVE-2025-66560—

32.7%

——10——CVE-2024-37630—

32.7%

——10——CVE-2026-474198.3 HIG

32.7%

——10PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an* Insecure Direct Object Reference. The agent CRUD endpoints (`GET / PATCH / DELETE /workspaces/{workspace_id}/agents/{agent_id}`) gate access on `require_workspace_member(workspace_id)` only, then resolve `agent_id` through `AgentService.get(agent_id)` which is a primary-key lookup with no workspace constraint. A user who is a member of any workspace `W1` can read, modify, or delete agents that belong to a different workspace `W2` by guessing or harvesting an agent UUID and calling `…/workspaces/W1/agents/<W2-agent-id>`. PraisonAI Platform version 0.1.4 patches the issue.62d CVE-2019-16638—

32.7%

——10——CVE-2026-39462—

32.7%

——10——CVE-2026-57397.3 HIG

32.7%

——10A security flaw has been discovered in PowerJob 5.1.0/5.1.1/5.1.2. The affected element is the function GroovyEvaluator.evaluate of the file /openApi/addWorkflowNode of the component OpenAPI Endpoint. The manipulation of the argument nodeParams results in code injection. The attack can be executed remotely. The project was informed of the problem early through an issue report but has not responded yet.60d CVE-2018-5239—

32.7%

——10——CVE-2026-864377.2 HIG

32.7%

——10Lara Dashboard before 1.3.2 authorizes the POST /admin/settings/core-upgrades/upload endpoint with only the settings.edit permission, allowing non-Superadmin administrators to upload and extract arbitrary zip archives over the live application source code. Attackers can upload a malicious archive containing modified application files such as routes/web.php with embedded system commands, which execute as the web server user with access to environment secrets and database credentials.14d CVE-2026-855049.8 CRI

32.7%

——10FreeIPMI before 1.6.19 has a stack-based buffer overflow in _ipmi_sel_oem_fujitsu_get_sel_entry_long_text in libfreeipmi/sel/ipmi-sel-string-fujitsu-irmc-common.c via malformed Fujitsu SEL long-text responses.14d CVE-2026-855099.8 CRI

32.7%

——10FreeIPMI before 1.6.19 has a stack-based buffer overflow in _read_fru_data in libfreeipmi/fru/ipmi-fru.c when a BMC returns more bytes than requested.14d CVE-2018-6201—

32.7%

——10——CVE-2023-38513—

32.7%

——10——CVE-2025-1722—

32.7%

——10——CVE-2025-54968—

32.7%

——10——CVE-2018-6203—

32.7%

——10——CVE-2026-866657.3 HIG

32.7%

——10A vulnerability was identified in aircheng-org iWebShop-5 up to 5.15. This issue affects the function Update::index of the file controllers/update.php. The manipulation leads to missing authorization. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.14d CVE-2017-15112—

32.7%

——10——CVE-2025-9774—

32.7%

——10——CVE-2026-515389.1 CRI

32.7%

——10EIPStackGroup OpENer 2.3.0 (commit 76b95cf) suffers from an Incorrect Access Control vulnerability in its handling of encapsulation sessions. When the server processes critical encapsulation commands, it verifies whether the provided session_handle exists in the global session list, but it fails to verify whether that handle belongs to the specific TCP connection issuing the request. Because there is no strong binding between a session handle and its originating socket, any attacker on the network can use a valid session handle created by another legitimate client to bypass access controls.42d CVE-2025-2354—

32.7%

——10——CVE-2025-69215—

32.7%

——10——CVE-2008-2148—

32.7%

——10——CVE-2026-474158.3 HIG

32.7%

——10PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Insecure Direct Object Reference. The issue CRUD endpoints (`GET / PATCH / DELETE /workspaces/{workspace_id}/issues/{issue_id}`) gate access on `require_workspace_member(workspace_id)` only, then resolve `issue_id` through `IssueService.get(issue_id)` which is a primary-key lookup with no workspace constraint. A user who is a member of any workspace `W1` can read, modify, or delete issues that belong to a different workspace `W2`. PraisonAI Platform version 0.1.4 patches the issue.63d CVE-2013-3237—

32.7%

——10——CVE-2026-333827.5 HIG

32.7%

——10Several Grafana API endpoints, some of them unauthenticated, do not limit the size of the request body before processing it. An attacker can send very large payloads that force excessive memory allocation, potentially exhausting memory and causing a denial of service.71d CVE-2018-17977—

32.7%

——10——CVE-2026-28394—

32.7%

——10——CVE-2023-6359—

32.7%

——10——CVE-2024-26310—

32.7%

——10——