Vulnerabilities exploitable today
378,004in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,716
New KEV · 24H0
Exploit Today ≥ 701,651
Distribution · last window
- Critical2,292
- High8,399
- Medium6,682
- Low748
Filters
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-789404.3 MED31.4%
——9Improper initialization in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)24dCVE-1999-0094—31.4%
——9——CVE-2024-21154—31.4%
——9——CVE-2024-29121—31.4%
——9——CVE-2025-22535—31.4%
——9——CVE-2023-49801—31.4%
——9——CVE-2024-27998—31.4%
——9——CVE-2026-703195.5 MED31.4%
——9Improper input validation in Microsoft Office Word allows an unauthorized attacker to disclose information locally.38dCVE-2025-0071—31.4%
——9——CVE-2025-5997—31.4%
——9——CVE-2024-53349—31.4%
——9——CVE-2026-437948.8 HIG31.4%
——9A memory corruption issue was addressed with improved memory handling. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, tvOS 27, visionOS 27, watchOS 27. Processing maliciously crafted web content may lead to memory corruption.6dCVE-2024-5442—31.4%
——9——CVE-2026-612248.0 HIG31.4%
——9Vulnerability in the Oracle Communications Converged Application Server product of Oracle Communications (component: Security). The supported version that is affected is 8.3. Difficult to exploit vulnerability allows high privileged attacker with network access via TLS to compromise Oracle Communications Converged Application Server. While the vulnerability is in Oracle Communications Converged Application Server, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Communications Converged Application Server. CVSS 3.1 Base Score 8.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H).46dCVE-2026-608926.6 MED31.4%
——9Vulnerability in the Oracle HRMS (Norway) product of Oracle E-Business Suite (component: Norway Payroll). Supported versions that are affected are 12.2.8-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle HRMS (Norway). Successful attacks of this vulnerability can result in takeover of Oracle HRMS (Norway). CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H).56dCVE-2026-163889.8 CRI31.4%
——9Sandbox escape in the DOM: Networking component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.59dCVE-2024-20937—31.4%
——9——CVE-2026-828329.6 CRI31.4%
——9IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of input during web page generation.2dCVE-2024-41519—31.4%
——9——CVE-2022-43708—31.4%
——9——CVE-2025-13343—31.4%
——9——CVE-2024-11891—31.4%
——9——CVE-2022-33229—31.4%
——9——CVE-2026-607908.0 HIG31.4%
——9Vulnerability in the Oracle Sales Offline product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Sales Offline. While the vulnerability is in Oracle Sales Offline, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Sales Offline. CVSS 3.1 Base Score 8.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H).56dCVE-2024-29124—31.4%
——9——CVE-2026-703155.5 MED31.4%
——9Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.38dCVE-2023-22856—31.4%
——9——CVE-2024-29116—31.4%
——9——CVE-2019-0123—31.4%
——9——CVE-2026-469238.0 HIG31.4%
——9Vulnerability in the Oracle Public Sector Financials (International) product of Oracle E-Business Suite (component: Authorization). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Public Sector Financials (International). While the vulnerability is in Oracle Public Sector Financials (International), attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Public Sector Financials (International). CVSS 3.1 Base Score 8.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H).46dCVE-2024-12841—31.4%
——9——CVE-2013-2195—31.4%
——9——CVE-2013-5163—31.4%
——9——CVE-2025-54111—31.4%
——9——CVE-2024-4663—31.4%
——9——CVE-2026-324709.8 CRI31.4%
——9Unauthenticated PHP Object Injection in FundEngine <= 1.7.9 versions.32dCVE-2026-423917.5 HIG31.4%
——9An unauthenticated attacker can send an IMAP ID command with a very large number of parameters before logging in, which causes memory and CPU usage to grow disproportionately. The login process can be terminated by the out-of-memory handling, which also terminates all other connections handled by the same process. This can cause degradation or denial of service for IMAP logins. Limit the number of connections handled by a single imap-login process. This has a performance impact though. Update to non-vulnerable version. No publicly available exploits are known.18dCVE-2026-25032—31.4%
——9——CVE-2025-53802—31.4%
——9——CVE-2024-54171—31.4%
——9——