Vulnerabilities exploitable today
374,209in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,710
New KEV · 24H0
Exploit Today ≥ 701,646
Distribution · last window
- Critical2,209
- High7,829
- Medium6,383
- Low706
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2024-30519—28.1%
——8——CVE-2016-11055—28.1%
——8——CVE-2026-790073.1 LOW28.1%
——8Uninitialized resource in GPU in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)16dCVE-2025-69146—28.1%
——8——CVE-2026-790766.5 MED28.1%
——8Improper input validation in Sync in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via crafted network traffic. (Chromium security severity: Medium)16dCVE-2024-10363—28.1%
——8——CVE-2026-806388.8 HIG28.1%
——8In the Linux kernel, the following vulnerability has been resolved:
ocfs2: fix out-of-bounds write in ocfs2_remove_refcount_extent
[BUG]
Unlinking a refcounted file whose refcount tree has leaf blocks
triggers a fortify panic due to an out-of-bounds write.
[CAUSE]
When the last leaf block is removed from a refcount tree,
ocfs2_remove_refcount_extent() converts the root back to leaf mode
with a bulk memset on &rb->rf_records. rf_records sits in an anonymous
union with rf_list. rf_list.l_tree_depth aliases rf_records.rl_count,
and is 0 for a single-level tree. With rl_count equal to 0, the memset
writes past the 16-byte declared size of rf_records, which the fortify
checker catches.
[FIX]
Replace the bulk memset on &rb->rf_records with a correctly-bounded
memset on rl_recs[] alone, after setting rl_count to the correct value.18dCVE-2008-5111—28.1%
——8——CVE-2026-789863.1 LOW28.1%
——8Uninitialized resource in GPU in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)16dCVE-2025-69171—28.1%
——8——CVE-2025-32694—28.1%
——8——CVE-2004-0851—28.1%
——8——CVE-2025-69158—28.1%
——8——CVE-2023-438967.8 HIG28.1%
——8A buffer overflow in Macrium Reflect 8.1.7544 and below allows attackers to escalate privileges or execute arbitrary code.70dCVE-2026-162033.5 LOW28.1%
——8A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0. Affected by this issue is some unknown functionality of the file /forCYS.php. Such manipulation of the argument course leads to cross site scripting. The attack may be performed from remote. The exploit is publicly available and might be used.58dCVE-2017-5722—28.1%
——8——CVE-2026-791766.5 MED28.1%
——8UI misrepresentation in Extensions in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted Chrome extension. (Chromium security severity: Medium)20dCVE-2026-896018.8 HIG28.1%
——8In the Linux kernel, the following vulnerability has been resolved:
ext2: Fix lost inode updates for IS_SYNC inodes
ext2_setsize() and ext2_xattr_set2() had a construct like:
if (IS_SYNC(inode)) {
sync_inode_metadata(inode, 1);
} else {
mark_inode_dirty(inode);
}
which leads to lost inode updates for IS_SYNC inodes because
sync_inode_metadata() does anything only if the inode is already dirty
and hence inode updates may be simply lost. Fix the problem by
unconditionally marking the inode dirty and *then* call
sync_inode_metadata().3dCVE-2024-12345—28.1%
——8——CVE-2025-69115—28.1%
——8——CVE-2025-30169—28.1%
——8——CVE-2022-40363—28.1%
——8——CVE-2024-41781—28.1%
——8——CVE-2025-30173—28.1%
——8——CVE-2025-69144—28.1%
——8——CVE-2024-57033—28.1%
——8——CVE-2025-69118—28.1%
——8——CVE-2022-23037—28.1%
——8——CVE-2024-7891—28.1%
——8——CVE-2025-69123—28.1%
——8——CVE-2025-15582—28.1%
——8——CVE-2024-30186—28.1%
——8——CVE-2025-53414—28.1%
——8——CVE-2023-46668—28.1%
——8——CVE-2023-23528—28.1%
——8——CVE-2023-25748—28.1%
——8——CVE-2025-1493—28.1%
——8——CVE-2023-1487—28.1%
——8——CVE-2026-161563.5 LOW28.1%
——8A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0. This affects an unknown part of the file /forexam.php. The manipulation of the argument day results in cross site scripting. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.57dCVE-2025-69141—28.1%
——8——