Vulnerabilities exploitable today
378,183in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,717
New KEV · 24H1
Exploit Today ≥ 701,649
Distribution · last window
- Critical2,332
- High8,494
- Medium6,769
- Low765
Filters
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-32881—32.5%
——10——CVE-2014-5431—32.5%
——10——CVE-2011-2200—32.5%
——10——CVE-2026-733419.8 CRI32.5%
——10Unauthenticated PHP Object Injection in RegistrationMagic <= 6.0.9.7 versions.32dCVE-2015-0421—32.5%
——10——CVE-2023-31459—32.5%
——10——CVE-2017-1093—32.5%
——10——CVE-2024-32341—32.5%
——10——CVE-2024-9218—32.5%
——10——CVE-2026-27053—32.5%
——10——CVE-2025-29313—32.5%
——10——CVE-2024-9210—32.5%
——10——CVE-2024-6621—32.5%
——10——CVE-2026-789676.5 MED32.5%
——10Missing authorization in BFCache in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)21dCVE-2024-8741—32.5%
——10——CVE-2015-4053—32.5%
——10——CVE-2025-1718—32.5%
——10——CVE-2026-159727.5 HIG32.5%
——10Consul Community Edition and Consul Enterprise 1.13.0 through 2.0.2 are vulnerable to an unauthenticated denial of service through unbounded connection acceptance on the external gRPC listeners. A remote attacker may exhaust agent file descriptors, goroutines, and memory by opening many incomplete connections, potentially preventing legitimate clients from connecting. This vulnerability, CVE-2026-15972, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.24dCVE-2024-5638—32.5%
——10——CVE-2026-664437.5 HIG32.5%
——10Unauthenticated Sensitive Data Exposure in REST API Log <= 1.7.1 versions.38dCVE-2022-42399—32.5%
——10——CVE-2024-45605—32.5%
——10——CVE-2020-3423—32.5%
——10——CVE-2013-4426—32.5%
——10——CVE-2022-41151—32.5%
——10——CVE-2025-53081—32.5%
——10——CVE-2013-2546—32.5%
——10——CVE-2024-4690—32.5%
——10——CVE-2000-0752—32.5%
——10——CVE-2014-6497—32.5%
——10——CVE-2024-8712—32.5%
——10——CVE-2017-6348—32.5%
——10——CVE-2024-9384—32.5%
——10——CVE-2026-28464—32.5%
——10——CVE-2022-41150—32.5%
——10——CVE-2022-42395—32.5%
——10——CVE-2019-3742—32.5%
——10——CVE-2025-60233—32.5%
——10——CVE-2026-803467.1 HIG32.5%
——10StarRocks performs no privilege check when a legacy synchronous materialized view is dropped. Every other statement type routed through AuthorizerStmtVisitor calls into Authorizer before execution, but visitDropMaterializedViewStatement returns immediately with a comment stating the check happens in execution logic. That holds only for asynchronous materialized views: LocalMetastore.dropMaterializedView calls Authorizer.checkMaterializedViewAction inside a branch taken when the resolved table is a MaterializedView. A legacy synchronous materialized view is stored as a rollup index on an OlapTable rather than a MaterializedView, so the other branch runs, reaching AlterJobMgr.processDropMaterializedView and MaterializedViewHandler, neither of which contains any Authorizer call. The former locates the target by scanning every OlapTable in the named database for a matching rollup index, and the latter validates only table state and name conflicts. Any authenticated account can therefore drop a legacy synchronous materialized view belonging to any database, holding no grant on the view, the base table or the database, and the drop is indistinguishable from an authorized one.24dCVE-2025-66305—32.4%
——10——