Vulnerabilities exploitable today
377,882in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,716
New KEV · 24H0
Exploit Today ≥ 701,651
Distribution · last window
- Critical2,336
- High8,527
- Medium6,725
- Low744
Filters
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-504547.8 HIG30.9%
——9Relative path traversal in Windows User Interface Core allows an authorized attacker to elevate privileges locally.52dCVE-2025-23706—30.9%
——9——CVE-2024-38796—30.9%
——9——CVE-2025-60341—30.9%
——9——CVE-2024-50801—30.9%
——9——CVE-2026-25176—30.9%
——9——CVE-2026-25987—30.9%
——9——CVE-2026-350798.1 HIG30.9%
——9The ugw-restore method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of user-controlled input.59dCVE-2026-57619—30.9%
——9——CVE-2025-61635—30.9%
——9——CVE-2024-6614—30.9%
——9——CVE-2026-570855.5 MED30.9%
——9Out-of-bounds read in Windows Print Spooler Components allows an authorized attacker to disclose information locally.59dCVE-2023-47185—30.9%
——9——CVE-2024-39919—30.9%
——9——CVE-2024-53495—30.9%
——9——CVE-2023-39507—30.9%
——9——CVE-2025-8899—30.9%
——9——CVE-2017-3751—30.9%
——9——CVE-2018-3638—30.9%
——9——CVE-2024-1775—30.9%
——9——CVE-2025-23681—30.9%
——9——CVE-2023-4552—30.9%
——9——CVE-2026-350818.1 HIG30.9%
——9The ugw-logstop method allows a remote attacker with user privileges to terminate arbitrary processes due to insufficient validation of user-supplied input.59dCVE-2017-5683—30.9%
——9——CVE-2008-5700—30.9%
——9——CVE-2024-51462—30.9%
——9——CVE-2025-63456—30.9%
——9——CVE-2015-8109—30.9%
——9——CVE-2024-13042—30.9%
——9——CVE-2016-8816—30.9%
——9——CVE-2026-106404.2 MED30.9%
——9Zephyr's IPv6 Neighbor Discovery send paths (net_ipv6_send_na, net_ipv6_send_ns, net_ipv6_send_rs in subsys/net/ip/ipv6_nbr.c) updated the per-interface ICMP-sent statistics by calling net_pkt_iface(pkt) after net_send_data(pkt) had already returned successfully. On the success path the network stack owns and releases the packet's reference (the L2/driver send unrefs it, e.g. ethernet_send -> net_pkt_unref), so for a freshly allocated packet with refcount 1 the net_pkt slab block can be freed before the statistics line runs (synchronously when no TX queue thread is configured, or via a concurrent TX thread otherwise).
The subsequent net_pkt_iface(pkt) reads pkt->iface from the freed slab block, and with CONFIG_NET_STATISTICS_PER_INTERFACE enabled that loaded pointer is dereferenced to increment iface->stats.icmp.sent, a use-after-free (CWE-416). If the slab block was reallocated in the meantime the read/increment targets unrelated or attacker-influenced memory, yielding corrupted statistics, a fault/crash (denial of service), or potential limited memory corruption.
The vulnerable Neighbor Advertisement path is reachable by any unauthenticated on-link node simply by sending ICMPv6 Neighbor Solicitations to a Zephyr node with native IPv6 enabled (handle_ns_input -> net_ipv6_send_na).
Affected from v3.3.0 through v4.4.0; the fix uses the already-available iface argument instead of touching the sent packet. Configurations without per-interface statistics dereference only a global counter and are not affected by the memory-safety aspect.67dCVE-2023-23858—30.9%
——9——CVE-2017-3757—30.9%
——9——CVE-2024-50802—30.9%
——9——CVE-2021-23877—30.9%
——9——CVE-2022-41141—30.9%
——9——CVE-2024-5968—30.9%
——9——CVE-2025-12984—30.9%
——9——CVE-2025-13620—30.9%
——9——CVE-2025-11877—30.9%
——9——