Vulnerabilities exploitable today
377,896in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,716
New KEV · 24H0
Exploit Today ≥ 701,651
Distribution · last window
- Critical2,337
- High8,543
- Medium6,730
- Low747
Filters
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2024-11936—31.2%
——9——CVE-2024-12129—31.2%
——9——CVE-2017-14556—31.2%
——9——CVE-2007-4686—31.2%
——9——CVE-2017-14300—31.2%
——9——CVE-2017-10746—31.2%
——9——CVE-2026-599317.7 HIG31.2%
——9PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5, the WEBSERVICE() domain whitelist can be bypassed via an HTTP redirect (SSRF). In Calculation/Web/Service.php, the webService() method validates a URL's host against the whitelist set via Spreadsheet::setDomainWhiteList(), then fetches content with file_get_contents($url, false, $ctx); because PHP's HTTP stream wrapper follows 301/302 redirects automatically (up to 20 hops) and the redirect target is never re-validated, an attacker who can trigger a redirect from a whitelisted domain can reach arbitrary URLs, including internal addresses. An attacker able to upload XLSX files to an application that uses setDomainWhiteList() and getCalculatedValue() can achieve a full-read SSRF, returning up to 32,767 bytes of the response body as a cell's calculated value, which enables exfiltration of cloud metadata (AWS/GCP/Azure credentials via http://169.254.169.254/), access to internal-only services, and internal port scanning (the port is not validated). This issue has been fixed in versions 5.8.1, 3.10.7, 2.4.7, 2.1.18, and 1.30.6.51dCVE-2017-14298—31.2%
——9——CVE-2017-14559—31.2%
——9——CVE-2026-681197.5 HIG31.2%
——9In the Linux kernel, the following vulnerability has been resolved:
tcp: initialize standalone TCP-AO response padding
tcp_v4_send_ack() and tcp_v6_send_response() construct standalone TCP
responses with TCP-AO options. The option length carries the actual MAC
length, but the TCP header length includes the option rounded up to a
four-byte boundary.
tcp_ao_hash_hdr() writes the MAC only. Thus, when the MAC length is not
four-byte aligned, the one to three bytes after the MAC are left
uninitialized and may be transmitted. For the normal TCP-AO hashing
mode, those bytes also have to be initialized before computing the MAC.
Initialize only the alignment padding in the TCP-AO branches, before
hashing the header. Use TCPOPT_NOP, as in the normal TCP-AO output path.
This avoids adding work to non-AO TCP responses while preserving a valid
authenticated header.34dCVE-2017-14272—31.2%
——9——CVE-2017-10747—31.2%
——9——CVE-2017-14542—31.2%
——9——CVE-2025-25195—31.2%
——9——CVE-2017-14292—31.2%
——9——CVE-2024-35114—31.2%
——9——CVE-2024-13947—31.2%
——9——CVE-2025-6073—31.2%
——9——CVE-2017-14579—31.2%
——9——CVE-2023-5961—31.2%
——9——CVE-2017-14557—31.2%
——9——CVE-2017-14299—31.2%
——9——CVE-2024-35134—31.2%
——9——CVE-2025-9551—31.2%
——9——CVE-2024-52973—31.2%
——9——CVE-2025-45661—31.2%
——9——CVE-2024-22547—31.2%
——9——CVE-2023-1575—31.2%
——9——CVE-2024-27332—31.2%
——9——CVE-2025-23053—31.2%
——9——CVE-2026-48837—31.2%
——9——CVE-2024-49602—31.2%
——9——CVE-2023-46925—31.2%
——9——CVE-2017-14553—31.2%
——9——CVE-2017-14296—31.2%
——9——CVE-2017-14538—31.2%
——9——CVE-2025-23054—31.2%
——9——CVE-2017-14290—31.2%
——9——CVE-2023-38047—31.2%
——9——CVE-2026-746659.1 CRI31.2%
——9In the Linux kernel, the following vulnerability has been resolved:
net: fix skb length accounting after generic XDP frag adjustment
Generic XDP exposes non-linear skb fragments through an xdp_buff. If an
XDP program adjusts the fragment area, bpf_prog_run_generic_xdp() copies
xdp_frags_size back to skb->data_len but leaves skb->len containing the
old fragment contribution.
After a fragment shrink, this makes skb_headlen() larger than the actual
linear area. In the reproduced UDP receive path, __skb_datagram_iter()
copied 1024 bytes past the actual linear tail to userspace, starting at
struct skb_shared_info. The copied bytes included the affected skb's
nr_frags, xdp_frags_size and a kernel pointer from
skb_shinfo(skb)->frags[0]. Real packet data was displaced by the same
amount and truncated at the end.
Subtract the old data_len before replacing it and add the new data_len
afterwards, keeping skb->len and skb->data_len synchronized.
A 60000-byte UDP datagram on a veth pair with MTU 64000 was shortened by
1024 bytes from its fragment area. Before the fix, all 10 runs produced
corrupted payloads. After the fix, all 10 runs matched the expected
payload exactly.26d