Vulnerabilities exploitable today
376,337in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,713
New KEV · 24H0
Exploit Today ≥ 701,646
Distribution · last window
- Critical2,383
- High8,771
- Medium6,812
- Low735
Filters
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2024-39178—29.0%
——9——CVE-2020-5830—29.0%
——9——CVE-2016-2941—29.0%
——9——CVE-2015-7418—29.0%
——9——CVE-2026-639168.8 HIG29.0%
——9In the Linux kernel, the following vulnerability has been resolved:
HID: wacom: Fix OOB write in wacom_hid_set_device_mode()
wacom_hid_set_device_mode() currently assumes that the HID_DG_INPUTMODE
usage is always located in the first field (field[0]) of the feature report.
However, a device can specify HID_DG_INPUTMODE in a different field.
If HID_DG_INPUTMODE is in a field other than the first one and the first
field has a report_count smaller than the usage_index of HID_DG_INPUTMODE,
this leads to an out-of-bounds write to r->field[0]->value.
Fix this by storing the field index of HID_DG_INPUTMODE in 'struct
hid_data' during feature mapping. In wacom_hid_set_device_mode(), use
this stored field index to access the correct field and add bounds
checks to ensure both the field index and the value index are within
valid ranges before writing.52dCVE-2026-896787.5 HIG29.0%
——9In the Linux kernel, the following vulnerability has been resolved:
nfsd: fix partial-write detection in nfsd_direct_write
nfsd_direct_write() walks a list of write segments and, after each
vfs_iocb_iter_write(), tries to detect a short write so the loop can
stop before placing the next segment at a wrong file offset:
host_err = vfs_iocb_iter_write(file, kiocb, &segments[i].iter);
if (host_err < 0)
return host_err;
*cnt += host_err;
if (host_err < segments[i].iter.count)
break; /* partial write */
vfs_iocb_iter_write() runs the iter through ->write_iter(), which
advances the iter by the number of bytes written. By the time the
check runs, segments[i].iter.count is the residual, not the original
request length:
before write_iter: iter.count == original_len
after write_iter: iter.count == original_len - host_err
The condition then reduces to host_err < original_len - host_err, so
the break fires only when less than half of the segment was written.
Any short write completing between 50% and 99% of the segment slips
through; the loop advances to the next segment with kiocb->ki_pos
only bumped by the short amount, writing the next segment's payload
at the wrong offset and over-reporting *cnt to the NFS client.
Snapshot the segment's byte count before the write and compare
host_err against that snapshot so any short write breaks the loop.5dCVE-2017-12268—29.0%
——9——CVE-2018-10716—29.0%
——9——CVE-2024-31091—29.0%
——9——CVE-2025-30217—29.0%
——9——CVE-2002-0234—29.0%
——9——CVE-2024-31409—29.0%
——9——CVE-2024-31103—29.0%
——9——CVE-2025-24674—29.0%
——9——CVE-2023-33019—29.0%
——9——CVE-2010-4167—29.0%
——9——CVE-2019-3744—29.0%
——9——CVE-2012-0948—29.0%
——9——CVE-1999-1303—29.0%
——9——CVE-2025-49727—29.0%
——9——CVE-2025-27312—29.0%
——9——CVE-2012-6701—29.0%
——9——CVE-2024-56526—29.0%
——9——CVE-2026-20643—29.0%
——9——CVE-2024-5878—29.0%
——9——CVE-2024-13076—29.0%
——9——CVE-2026-42686—29.0%
——9——CVE-2021-22004—29.0%
——9——CVE-2015-1142—29.0%
——9——CVE-2026-170485.5 MED29.0%
——9A flaw was found in the Keycloak Admin REST API, which is used to manage security realms and clients. The issue occurs when the system processes requests for rotated client secrets that are stored in a secure vault. Due to improper boundary enforcement, a delegated administrator with view-only permissions can retrieve the actual resolved secret instead of the vault placeholder, leading to the exposure of sensitive credentials.30dCVE-2026-499774.3 MED29.0%
——9tarteaucitron.js is a compliant and accessible cookie banner. Prior to 1.33.0, tarteaucitron.cookie.purge() is called on any element with the purgeBtn class and does not check whether the element is a legitimate tarteaucitron button or whether the cookie corresponds to a service handled by tarteaucitron. If an attacker can write HTML with data attributes, an element with data-cookie can silently delete a non-HttpOnly cookie with a known name when clicked by a user. This issue is fixed in version 1.33.0.56dCVE-2013-3076—29.0%
——9——CVE-2016-7619—29.0%
——9——CVE-2025-62007—29.0%
——9——CVE-2000-1012—29.0%
——9——CVE-2004-2473—29.0%
——9——CVE-2012-6541—29.0%
——9——CVE-1999-1304—29.0%
——9——CVE-2014-1639—29.0%
——9——CVE-2000-1013—29.0%
——9——