Vulnerabilities exploitable today
375,890in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,710
New KEV · 24H0
Exploit Today ≥ 701,646
Distribution · last window
- Critical2,384
- High8,720
- Medium6,705
- Low725
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2024-12104—28.3%
——8——CVE-2025-220048.6 HIG28.3%
——8In the Linux kernel, the following vulnerability has been resolved:
net: atm: fix use after free in lec_send()
The ->send() operation frees skb so save the length before calling
->send() to avoid a use after free.49dCVE-2026-13495—28.3%
——8——CVE-2026-602665.9 MED28.3%
——8Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Coherence. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Coherence accessible data. CVSS 3.1 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).51dCVE-2006-4397—28.3%
——8——CVE-2024-1324—28.2%
——8——CVE-2026-330889.8 CRI28.3%
——8Movable Type provided by Six Apart Ltd. contains an SQL Injection vulnerability which may allow an attacker to execute an arbitrary SQL statement.54dCVE-2021-30903—28.3%
——8——CVE-2024-29173—28.3%
——8——CVE-2026-5371—28.3%
——8——CVE-2012-4542—28.3%
——8——CVE-2024-5004—28.3%
——8——CVE-2000-0247—28.3%
——8——CVE-2025-0311—28.3%
——8——CVE-2024-35222—28.3%
——8——CVE-2026-92196.5 MED28.3%
——8Setracker2 Android Companion App com.tgelec.setracker versions 3.1.5 and prior have a predictable registration ID derived from IMEI. The enrollment system lacks additional authentication before assignment. If an attacker is able to obtain the registration ID, they would be able to arbitrarily enroll watches belonging to other users.44dCVE-2024-56270—28.3%
——8——CVE-2010-3406—28.3%
——8——CVE-2024-6881—28.3%
——8——CVE-2025-59524—28.3%
——8——CVE-2025-23193—28.3%
——8——CVE-2024-57723—28.3%
——8——CVE-2019-10636—28.3%
——8——CVE-2026-191465.3 MED28.3%
——8Uninitialized Use in GPU in Google Chrome on Android prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)40dCVE-2026-1546—28.3%
——8——CVE-2025-66446—28.3%
——8——CVE-2013-1215—28.3%
——8——CVE-2024-45700—28.3%
——8——CVE-2025-5257—28.3%
——8——CVE-2023-1631—28.3%
——8——CVE-2026-84186—28.3%
——8Vulnerability involving incorrect access control in the Tools::getRemoteAddr() function in PrestaShop, which allows the client’s IP address to be spoofed via the X-Forwarded-For header when the application is running behind a reverse proxy, load balancer or CDN. The application incorrectly processes the IP address string and uses the address controlled by the visitor rather than the one provided by the trusted infrastructure, allowing an unauthenticated remote attacker to cause the application to interpret their connection as originating from an arbitrary IP address. This condition allows IP-based controls, such as the maintenance mode allowlist, to be bypassed, as well as enabling the forgery of security and audit logs and the evasion of third-party mechanisms that rely on the IP address, such as geolocation checks, fraud detection or request throttling.8dCVE-2006-5012—28.3%
——8——CVE-2026-896268.8 HIG28.3%
——8In the Linux kernel, the following vulnerability has been resolved:
HID: sensor: custom: Fix field sysfs group cleanup on failure
hid_sensor_custom_add_attributes() creates one sysfs group for each
custom sensor field. If sysfs_create_group() fails after some groups
have already been created, the function returns the error without
removing the previously created groups.
Add a local unwind path to remove the groups that were already created.
With enable_sensor exposed only after the field attributes are ready,
this path can free sensor_inst->fields without leaving enable_sensor
able to access pointers into that array.2dCVE-2018-6439—28.3%
——8——CVE-2026-33123—28.3%
——8——CVE-2024-47048—28.3%
——8——CVE-2024-27442—28.3%
——8——CVE-2025-6520—28.3%
——8——CVE-2026-13569—28.3%
——8——CVE-2023-46021—28.3%
——8——