Vulnerabilities exploitable today
377,882in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,716
New KEV · 24H0
Exploit Today ≥ 701,651
Distribution · last window
- Critical2,336
- High8,527
- Medium6,725
- Low744
Filters
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-444449.1 CRI30.9%
——9Lumiverse is a full-featured AI chat application. Prior to 0.9.7, the Spindle extension build pipeline calls bun install without the --ignore-scripts flag before running the static backend safety scan (assertSafeBackendBundle). A malicious extension that ships a package.json with a preinstall, postinstall, or prepare lifecycle script achieves host-level code execution the moment an admin presses Install before any dist file is inspected. This vulnerability is fixed in 0.9.7.59dCVE-2026-55553—30.9%
——9——CVE-2013-1853—30.9%
——9——CVE-2020-4642—30.9%
——9——CVE-2026-192247.2 HIG30.9%
——9The Hummingbird Performance WordPress plugin before 3.21.2 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network.11dCVE-2023-1449—30.9%
——9——CVE-2026-431149.4 CRI30.9%
——9In the Linux kernel, the following vulnerability has been resolved:
netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry
New test case fails unexpectedly when avx2 matching functions are used.
The test first loads a ranomly generated pipapo set
with 'ipv4 . port' key, i.e. nft -f foo.
This works. Then, it reloads the set after a flush:
(echo flush set t s; cat foo) | nft -f -
This is expected to work, because its the same set after all and it was
already loaded once.
But with avx2, this fails: nft reports a clashing element.
The reported clash is of following form:
We successfully re-inserted
a . b
c . d
Then we try to insert a . d
avx2 finds the already existing a . d, which (due to 'flush set') is marked
as invalid in the new generation. It skips the element and moves to next.
Due to incorrect masking, the skip-step finds the next matching
element *only considering the first field*,
i.e. we return the already reinserted "a . b", even though the
last field is different and the entry should not have been matched.
No such error is reported for the generic c implementation (no avx2) or when
the last field has to use the 'nft_pipapo_avx2_lookup_slow' fallback.
Bisection points to
7711f4bb4b36 ("netfilter: nft_set_pipapo: fix range overlap detection")
but that fix merely uncovers this bug.
Before this commit, the wrong element is returned, but erronously
reported as a full, identical duplicate.
The root-cause is too early return in the avx2 match functions.
When we process the last field, we should continue to process data
until the entire input size has been consumed to make sure no stale
bits remain in the map.3dCVE-2020-1988—30.9%
——9——CVE-2022-241397.8 HIG30.9%
——9In IOBit Advanced System Care (AscService.exe) 15, an attacker with SEImpersonatePrivilege can create a named pipe with the same name as one of ASCService's named pipes. ASCService first tries to connect before trying to create the named pipes, because of that during login the service will try to connect to the attacker which will lead to either escalation of privileges (through token manipulation and ImpersonateNamedPipeClient() ) from ADMIN -> SYSTEM or from Local ADMIN-> Domain ADMIN depending on the user and named pipe that is used.73dCVE-2023-38002—30.9%
——9——CVE-2014-3800—30.9%
——9——CVE-2016-10906—30.9%
——9——CVE-2025-6309—30.9%
——9——CVE-2016-1851—30.9%
——9——CVE-2023-27704—30.9%
——9——CVE-2026-367784.9 MED30.9%
——9Shenzhen Tenda Technology Co., Ltd Tenda O3 Wireless Router v1.0.0.5(4180) was discovered to contain a stack overflow in the username parameter of the R7WebsSecurityHandler function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request.59dCVE-2015-4178—30.9%
——9——CVE-2024-10836—30.9%
——9——CVE-2025-6319—30.9%
——9——CVE-2023-52183—30.9%
——9——CVE-2025-63457—30.9%
——9——CVE-2026-437096.5 MED30.9%
——9A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing maliciously crafted web content may lead to an unexpected process crash.54dCVE-2026-27635—30.9%
——9——CVE-2026-21878—30.9%
——9——CVE-2026-52700—30.9%
——9——CVE-2024-3609—30.9%
——9——CVE-2024-54454—30.9%
——9——CVE-2026-52697—30.9%
——9——CVE-2024-33849—30.9%
——9——CVE-2012-6536—30.9%
——9——CVE-2025-63149—30.9%
——9——CVE-2026-354505.3 MED30.9%
——9WWBN AVideo is an open source video platform. In versions 26.0 and prior, the plugin/API/check.ffmpeg.json.php endpoint probes the FFmpeg remote server configuration and returns connectivity status without any authentication. All sibling FFmpeg management endpoints (kill.ffmpeg.json.php, list.ffmpeg.json.php, ffmpeg.php) require User::isAdmin().57dCVE-2011-5321—30.9%
——9——CVE-2023-1010—30.9%
——9——CVE-2025-39533—30.9%
——9——CVE-2013-3230—30.9%
——9——CVE-2005-1129—30.9%
——9——CVE-2015-1334—30.9%
——9——CVE-2024-47092—30.9%
——9——CVE-2023-38043—30.9%
——9——