Vulnerabilities exploitable today
378,183in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,717
New KEV · 24H1
Exploit Today ≥ 701,649
Distribution · last window
- Critical2,332
- High8,494
- Medium6,769
- Low765
Filters
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2020-27192—32.3%
——10——CVE-2022-35092—32.3%
——10——CVE-2020-7316—32.3%
——10——CVE-2026-241888.2 HIG32.3%
——10NVIDIA TensorRT contains a vulnerability where an attacker could cause an out-of-bounds write. A successful exploit of this vulnerability might lead to data tampering.60dCVE-2026-165446.5 MED32.3%
——10A flaw was found in AWX. The websocket event consumer performs RBAC authorization checks only for event groups that are mapped in the consumer_access() function (job_events, workflow_events, ad_hoc_command_events). Three event groups - inventory_update_events, project_update_events, and system_job_events — are not mapped, causing the authorization check to be skipped. Any authenticated user can subscribe to these unmapped websocket event groups for any object ID and receive real-time stdout output from jobs belonging to organizations they have no access to. This is an incomplete remediation of CVE-2020-10698.61dCVE-2026-24953—32.3%
——10——CVE-2006-2542—32.3%
——10——CVE-2024-50827—32.3%
——10——CVE-2026-49205—32.3%
——10——CVE-2024-6804—32.3%
——10——CVE-2025-7149—32.3%
——10——CVE-2021-4385—32.3%
——10——CVE-2021-26988—32.3%
——10——CVE-2021-4408—32.3%
——10——CVE-2025-13690—32.3%
——10——CVE-2022-46905—32.3%
——10——CVE-2020-10589—32.3%
——10——CVE-2008-7316—32.3%
——10——CVE-2019-25298—32.3%
——10——CVE-2024-29181—32.3%
——10——CVE-2024-270587.8 HIG32.3%
——10In the Linux kernel, the following vulnerability has been resolved:
tmpfs: fix race on handling dquot rbtree
A syzkaller reproducer found a race while attempting to remove dquot
information from the rb tree.
Fetching the rb_tree root node must also be protected by the
dqopt->dqio_sem, otherwise, giving the right timing, shmem_release_dquot()
will trigger a warning because it couldn't find a node in the tree, when
the real reason was the root node changing before the search starts:
Thread 1 Thread 2
- shmem_release_dquot() - shmem_{acquire,release}_dquot()
- fetch ROOT - Fetch ROOT
- acquire dqio_sem
- wait dqio_sem
- do something, triger a tree rebalance
- release dqio_sem
- acquire dqio_sem
- start searching for the node, but
from the wrong location, missing
the node, and triggering a warning.48dCVE-2026-64852—32.3%
——10Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.8, the Grav API plugin intercepts the apiKeyGenerate and apiKeyRevoke admin tasks in user/plugins/api/api.php and authorizes the caller with only admin.login. A basic panel user can select another account from the route, create a persistent ApiKeyManager credential bound to that target, and inherit the target's API permissions, including api.super or administrative write access when present. This issue is fixed in version 1.0.8.12dCVE-2019-8801—32.3%
——10——CVE-2019-15349—32.3%
——10——CVE-2017-9958—32.3%
——10——CVE-2025-24928—32.3%
——10——CVE-2022-29780—32.3%
——10——CVE-2022-42071—32.3%
——10——CVE-2026-1551—32.3%
——10——CVE-2026-727235.3 MED32.3%
——10Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, SiteSerializer.anonymous_default_navigation_menu_tags serializes tags from SiteSetting.default_navigation_menu_tags without applying DiscourseTagging.filter_visible for the anonymous viewer. An unauthenticated user can retrieve restricted tag names and descriptions through /site.json when those tags are limited by inaccessible categories, category tag groups, or tag-group permissions. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.13dCVE-2024-54287—32.3%
——10——CVE-2024-50830—32.3%
——10——CVE-2019-10210—32.3%
——10——CVE-2002-0259—32.3%
——10——CVE-2025-10175—32.3%
——10——CVE-2024-54246—32.3%
——10——CVE-2014-8923—32.3%
——10——CVE-2020-36750—32.3%
——10——CVE-2020-12356—32.3%
——10——CVE-2022-29779—32.3%
——10——