Vulnerabilities exploitable today
376,337in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,713
New KEV · 24H0
Exploit Today ≥ 701,646
Distribution · last window
- Critical2,321
- High8,289
- Medium6,568
- Low706
Filters
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2023-38536—30.3%
——9——CVE-2026-32216—30.3%
——9——CVE-2022-4249—30.3%
——9——CVE-2024-0233—30.3%
——9——CVE-2025-62517—30.3%
——9——CVE-2023-46246—30.3%
——9——CVE-2018-6247—30.3%
——9——CVE-2015-1602—30.3%
——9——CVE-2023-2109—30.3%
——9——CVE-2024-20930—30.3%
——9——CVE-2020-2024—30.3%
——9——CVE-2026-876398.3 HIG30.3%
——9Use after free in WebPackaging in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)9dCVE-2026-412368.8 HIG30.3%
——9Froxlor is open source server administration software. Version 2.3.6 contains a symlink-following flaw in the root-owned SSH key synchronization path used for customer FTP users. The provisioning code appends public keys to `~/.ssh/authorized_keys` under a customer-controlled home directory without verifying that the target path is not a symbolic link. If an attacker controls a shell-enabled customer account and can modify files inside the assigned home directory, the attacker can replace `~/.ssh/authorized_keys` with a symlink to `/root/.ssh/authorized_keys`. When Froxlor's privileged cron task later synchronizes SSH keys, it appends the attacker-supplied key into root's authorized key file, resulting in root SSH access. Version 2.3.7 contains a patch.58dCVE-2025-40655—30.3%
——9——CVE-2005-4728—30.3%
——9——CVE-2025-10390—30.3%
——9——CVE-2017-10003—30.3%
——9——CVE-2017-8258—30.3%
——9——CVE-2023-31280—30.3%
——9——CVE-2014-2889—30.3%
——9——CVE-2022-26322—30.3%
——9——CVE-2022-42407—30.3%
——9——CVE-1999-1400—30.3%
——9——CVE-2024-6075—30.3%
——9——CVE-2024-22408—30.3%
——9——CVE-2024-5743—30.3%
——9——CVE-2025-40656—30.3%
——9——CVE-2018-19046—30.3%
——9——CVE-2024-45964—30.3%
——9——CVE-2019-13535—30.3%
——9——CVE-2026-861737.5 HIG30.3%
——9MindsDB through 26.1.0 contains a server-side request forgery vulnerability in the web crawler handler that allows unauthenticated attackers to fetch arbitrary URLs by supplying caller-controlled URLs to CrawlerTable.list. Attackers can bypass the allowlist control by exploiting the default empty configuration and access internal services and cloud metadata endpoints without authentication.10dCVE-2024-53826—30.3%
——9——CVE-2002-1722—30.3%
——9——CVE-2003-0846—30.3%
——9——CVE-2026-684319.1 CRI30.3%
——9In the Linux kernel, the following vulnerability has been resolved:
ksmbd: validate minimum PDU size for transform requests
The receive path applies the minimum SMB2 PDU size check only when
ProtocolId is SMB2_PROTO_NUMBER. A packet carrying
SMB2_TRANSFORM_PROTO_NUM bypasses the check even when the negotiated
dialect does not provide transform handling.
On an SMB 2.1 connection, a short transform packet therefore reaches
init_smb2_rsp_hdr(), which interprets the request as a full SMB2 header
and reads beyond the request allocation. The copied fields can then be
returned to the unauthenticated client.
Compression transforms are converted to ordinary SMB2 messages before
protocol validation. After that conversion, validate ordinary SMB2
requests against SMB2_MIN_SUPPORTED_PDU_SIZE and require encryption
transform requests to contain both a transform header and an SMB2
header. This rejects truncated requests before work allocation.26dCVE-2024-12159—30.3%
——9——CVE-2026-664417.5 HIG30.3%
——9Unauthenticated Broken Access Control in MultiVendorX <= 5.0.10 versions.35dCVE-2025-32390—30.3%
——9——CVE-2024-34815—30.3%
——9——CVE-2026-711128.1 HIG30.3%
——9Vulnerability in the PeopleSoft Enterprise FIN Common Objects product of Oracle PeopleSoft (component: Security). The supported version that is affected is 9.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise FIN Common Objects. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise FIN Common Objects. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).14d