Vulnerabilities exploitable today
376,337in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,713
New KEV · 24H0
Exploit Today ≥ 701,646
Distribution · last window
- Critical2,382
- High8,758
- Medium6,800
- Low733
Filters
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2024-12458—29.4%
——9——CVE-2026-156179.1 CRI29.4%
——9Logto performs principal lookup without normalizing email and identifier strings, enabling principal collision and unauthorized account access via case- or Unicode-different identities.53dCVE-2015-5851—29.4%
——9——CVE-2026-3830—29.4%
——9——CVE-2019-25522—29.4%
——9——CVE-2026-9702—29.4%
——9——CVE-2025-691966.5 MED29.4%
——9FastMCP is the standard framework for building MCP applications. Prior to version 2.14.2, the server does not properly respect the resource parameter submitted by the client in the authorization and token request. Instead of issuing the token explicitly for the MCP server, the token is issued for the base_url passed to the OAuthProxy during initialization. This issue has been patched 2.14.2.65dCVE-2019-17349—29.4%
——9——CVE-2024-28004—29.4%
——9——CVE-2024-49765—29.4%
——9——CVE-2024-39737—29.4%
——9——CVE-2023-6198—29.4%
——9——CVE-2025-10024—29.4%
——9——CVE-2025-9966—29.4%
——9——CVE-2026-622136.5 MED29.4%
——9OpenClaw versions before 2026.5.27 contain a token leakage vulnerability in MS Teams outbound requests that allows lower-trust callers to expose Bot Framework tokens. Attackers can access configured input paths to retrieve credentials that should remain within the trusted boundary.59dCVE-2019-20580—29.4%
——9——CVE-2023-40605—29.4%
——9——CVE-2025-31141—29.4%
——9——CVE-2026-470996.1 MED29.4%
——9TeleJSON prior to 6.0.0 contains a DOM-based cross-site scripting vulnerability in the parse() function that allows attackers to execute arbitrary JavaScript by delivering a crafted JSON payload containing a malicious _constructor-name_ property value. The custom reviver passes the constructor name directly to new Function() without sanitization when recreating object prototypes, enabling attackers to inject arbitrary JavaScript through vectors such as postMessage in cross-frame communication contexts to achieve script execution within the application.57dCVE-2008-5716—29.4%
——9——CVE-2024-34389—29.4%
——9——CVE-2025-8018—29.4%
——9——CVE-2024-456163.9 LOW29.4%
——9A vulnerability was found in OpenSC, OpenSC tools, PKCS#11 module, minidriver, and CTK. An attacker could use a crafted USB Device or Smart Card, which would present the system with a specially crafted response to APDUs.
The following problems were caused by insufficient control of the response APDU buffer and its length when communicating with the card.80dCVE-2026-637406.5 MED29.4%
——9SurrealDB versions before 3.1.4 fail to properly enforce SELECT permissions on array elements (field.*) for record users, leaking denied array elements instead of hiding them. Attackers with record scope access can read array elements that element-level permissions should deny by exploiting incorrect index handling during permission filtering.58dCVE-2025-0352—29.4%
——9——CVE-2018-3696—29.4%
——9——CVE-2025-385147.5 HIG29.4%
——9In the Linux kernel, the following vulnerability has been resolved:
rxrpc: Fix oops due to non-existence of prealloc backlog struct
If an AF_RXRPC service socket is opened and bound, but calls are
preallocated, then rxrpc_alloc_incoming_call() will oops because the
rxrpc_backlog struct doesn't get allocated until the first preallocation is
made.
Fix this by returning NULL from rxrpc_alloc_incoming_call() if there is no
backlog struct. This will cause the incoming call to be aborted.50dCVE-2018-14980—29.4%
——9——CVE-2025-5783—29.4%
——9——CVE-2017-8064—29.4%
——9——CVE-2025-63691—29.4%
——9——CVE-2024-12502—29.4%
——9——CVE-2026-57642—29.4%
——9——CVE-2026-454263.1 LOW29.4%
——9Exploitation requires the attacker to already be an authenticated Airflow worker holding a valid Log-server JWT issued for at least one Dag. Apache Airflow's Log server authorized JWT tokens against Dag IDs by applying Python's `str.lstrip()` to the requested path segment when verifying the JWT's `sub` claim. `str.lstrip()` strips any of a *set* of characters from the left (not a prefix), so a JWT issued for a Dag named e.g. `dag_a` would authorize log access to any other Dag whose name began with any subset of the characters `{d, a, g, _}` (e.g. `dag_attacker`, `aaaa_target`, `_dag_secret`). Such an authenticated worker could enumerate and read worker logs of other Dags whose names happened to share that character-class prefix, leaking task output and error traces beyond the documented per-Dag isolation boundary. Affects deployments relying on per-Dag log-access scoping (multi-team, shared-executor, shared-worker topologies). Users are advised to upgrade to `apache-airflow` 3.2.2 or later.58dCVE-2026-577528.5 HIG29.4%
——9Contributor SQL Injection in iNET Webkit 1.2.4 versions.77dCVE-2023-2622—29.4%
——9——CVE-2026-57644—29.4%
——9——CVE-2025-11986—29.4%
——9——CVE-2026-537896.5 MED29.4%
——9rsync before 3.5.0 contains an improper path handling vulnerability that allows a malicious sender to expand the scope of --delete operations beyond the intended destination subtree by sending a crafted file list that causes rsync to reclassify implied parent directory entries or treat synthetic paths as the transfer root. Attackers can exploit multiple variants including implied parent reclassification, synthetic root path construction, legacy protocol behavior below version 30, and non-directory root handling to cause the receiver to delete files outside the authorized destination directory.18dCVE-2016-3744—29.3%
——9——