Vulnerabilities exploitable today
374,209in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,710
New KEV · 24H0
Exploit Today ≥ 701,646
Distribution · last window
- Critical2,221
- High7,891
- Medium6,409
- Low710
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-585008.2 HIG27.9%
——8MCP Appium is an MCP server that provides AI assistants with tools to automate mobile app testing on Android and iOS. In versions prior to 1.85.10, the createLocatorGeneratorUI function interpolates attacker-controlled element attributes — text, content-desc, resource-id, and locator selector values — directly into an HTML template literal without any HTML or JavaScript context escaping. An attacker who controls the UI of the app under test can inject arbitrary HTML and JavaScript into the MCP UI resource returned by the generate_locators tool. When a victim's MCP client renders this resource, the injected script executes and can invoke arbitrary MCP tools via window.parent.postMessage, leading to unauthorized MCP tool execution such as taking screenshots, reading page source, or any other registered capability. This issue has been fixed in version 1.85.10.21dCVE-2026-32870—27.9%
——8——CVE-2022-21554—27.9%
——8——CVE-2026-41141—27.9%
——8——CVE-2024-44234—27.9%
——8——CVE-2026-42926—27.9%
——8——CVE-2024-12325—27.9%
——8——CVE-2026-45402—27.9%
——8——CVE-2023-31170—27.9%
——8——CVE-2026-534607.5 HIG27.9%
——8ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-50 and 7.1.2-25, a missing check for maximum memory request in AcquireAlignedMemory could trigger an out-of-Memory condition. This issue has been patched in versions 6.9.13-50 and 7.1.2-25.55dCVE-2020-0527—27.9%
——8——CVE-2024-56343—27.9%
——8——CVE-2026-714887.5 HIG27.9%
——8league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 0.6.0 until 2.9.0, specially crafted Markdown lines can cause the parser to have quadratic time complexity when converting, because several parsing paths repeatedly rescan growing portions of a line to translate between character positions and byte positions, and the Autolink extension can also copy and validate the remaining line at every URL-like prefix, allowing an attacker who can submit Markdown for conversion to consume disproportionate CPU time with a comparatively small request. This issue is fixed in 2.9.0.6dCVE-2008-1483—27.9%
——8——CVE-2020-0572—27.9%
——8——CVE-2012-4102—27.9%
——8——CVE-2008-0162—27.9%
——8——CVE-2016-9703—27.9%
——8——CVE-2021-43760—27.9%
——8——CVE-2026-501637.1 HIG27.9%
——8oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, ensureLinkPath in content/file/utils.go:262-275 validates a hardlink target relative to the extract base but returns the unresolved target, causing os.Link("victim.secret", "<extract_base>/payload.tar.gz/evil_cwd_link") to resolve header.Linkname against the process current working directory for a Typeflag=TypeLink entry such as Name=payload.tar.gz/evil_cwd_link and Linkname="victim.secret" with io.deis.oras.content.unpack: "true", which can expose or tamper with files such as .env, .git/config, .aws/credentials, and ~/.ssh/config. This issue is fixed in version 2.6.2.55dCVE-2024-26242—27.9%
——8——CVE-2007-0393—27.9%
——8——CVE-2021-28950—27.9%
——8——CVE-2024-37991—27.9%
——8——CVE-2026-29112—27.9%
——8——CVE-2023-41073—27.9%
——8——CVE-2023-45552—27.9%
——8——CVE-2008-2378—27.9%
——8——CVE-2026-744357.5 HIG27.9%
——8In the Linux kernel, the following vulnerability has been resolved:
rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc
rxrpc_recvmsg_data() calls rxrpc_verify_data() whenever the
rxrpc_call.rx_dec_buffer is unallocated and assumes that upon
successful return that rx_dec_buffer must be allocated.
However, rxrpc_verify_data() does not request an allocation if
the rxrpc_skb_priv.len is zero.
In addition, failure to allocate rx_dec_buffer will result in a
call to skb_copy_bits() with a NULL destination which can
trigger a NULL pointer dereference.
To prevent these issues rxrpc_verify_data() is modified to
always attempt to allocate the rxrpc_call.rx_dec_buffer if it
is NULL.
This issue was identified with assistance of a private
sashiko instance.30dCVE-2025-46959—27.9%
——8——CVE-2019-11102—27.9%
——8——CVE-2025-15312—27.9%
——8——CVE-2024-44232—27.9%
——8——CVE-1999-1443—27.9%
——8——CVE-2012-4110—27.9%
——8——CVE-2022-21212—27.9%
——8——CVE-2026-447533.7 LOW27.9%
——8SAP HANA Database (user self service tools) allows an unauthenticated user to send specially crafted requests that produce distinguishable responses, enabling enumeration of valid user accounts and email addresses. Successful exploitation could allow the attacker to enumerate valid user accounts, resulting in low impact on confidentiality, with no impact on integrity and availability of the application.64dCVE-2023-322499.1 CRI27.9%
——8In the Linux kernel, the following vulnerability has been resolved:
ksmbd: not allow guest user on multichannel
This patch return STATUS_NOT_SUPPORTED if binding session is guest.32dCVE-2025-43285—27.9%
——8——CVE-2024-7367—27.9%
——8——