Vulnerabilities exploitable today
374,209in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,710
New KEV · 24H0
Exploit Today ≥ 701,646
Distribution · last window
- Critical2,224
- High7,923
- Medium6,427
- Low714
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2025-2403—27.7%
——8——CVE-2026-721218.8 HIG27.7%
——8In the Linux kernel, the following vulnerability has been resolved:
can: bcm: add locking when updating filter and timer values
KCSAN detected a simultaneous access to timer values that can be
overwritten in bcm_rx_setup() when updating timer and filter content
while bcm_rx_handler(), bcm_rx_timeout_handler() or bcm_rx_thr_handler()
run concurrently on incoming CAN traffic.
Protect the timer (ival1/ival2/kt_ival1/kt_ival2/kt_lastmsg) and filter
(nframes/flags/frames/last_frames) updates in bcm_rx_setup() with a new
per-op bcm_rx_update_lock, taken with the matching scope in the RX
handlers. memcpy_from_msg() is staged into a temporary buffer before the
lock is taken, since it can sleep and must not run under a spinlock.
hrtimer_cancel() is always called without bcm_rx_update_lock held, since
bcm_rx_timeout_handler()/bcm_rx_thr_handler() take the same lock and a
running callback would otherwise deadlock against the canceller.
Also close a related race: bcm_rx_setup() cleared the RTR flag in the
stored reply frame's can_id as a separate, unprotected step after the
frame content was already installed, so a concurrent bcm_rx_handler()
could transmit a stale reply with CAN_RTR_FLAG still set. Fold that
normalization into the initial frame preparation instead (on the staged
buffer for updates, directly on op->frames pre-registration for new
ops), so the installed frame is always atomically self-consistent.
bcm_rx_handler()'s RX_RTR_FRAME check now takes a lock-protected
snapshot of op->flags before deciding whether to call bcm_can_tx(),
but does not hold the lock across that call.
Also take a lock-protected snapshot of the currframe in bcm_can_tx()
to avoid partly overwrites by content updates in bcm_tx_setup().
Finally check if a TX_RESET_MULTI_IDX/SETTIMER might have reset
op->currframe between the two locked sections in bcm_can_tx().
Omit calling hrtimer_forward() with zero interval in bcm_rx_thr_handler().
kt_ival2 may have been concurrently cleared by bcm_rx_setup() before it
cancels this timer, so check kt_ival2 inside the bcm_rx_update_lock.28dCVE-2026-688085.5 MED27.7%
——8Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.34dCVE-2026-5018—27.7%
——8——CVE-2026-97407.5 HIG27.7%
——8A vulnerability in MongoDB Server's BSON validation logic allows an unauthenticated user to crash the mongod process by sending a specially crafted message. The BSON validator's handling of certain nested binary data structures permits uncontrolled mutual recursion between validation functions, where each re-entry resets internal depth tracking.55dCVE-2026-613877.5 HIG27.7%
——8In Eclipse Milo versions 1.0.0 through 1.1.4, monitored-item quota accounting is not exception-safe: if item creation fails with an unchecked error, the server-global reservation is not restored. Deeply nested PubSub ExtensionObjects in a `CreateMonitoredItems` event filter can trigger a `StackOverflowError` during decoding, allowing an unauthenticated remote client to exhaust a finite global monitored-item quota and prevent all clients from creating new monitored items until restart. Existing monitored items and other server functions remain unaffected.42dCVE-2023-3044—27.7%
——8——CVE-2024-11767—27.7%
——8——CVE-2020-3839—27.7%
——8——CVE-2026-649175.5 MED27.7%
——8Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information locally.33dCVE-2024-12501—27.7%
——8——CVE-2024-11439—27.7%
——8——CVE-2026-635285.5 MED27.7%
——8Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information locally.33dCVE-2026-33508—27.7%
——8——CVE-2026-688135.5 MED27.7%
——8Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.35dCVE-2026-56306—27.7%
——8——CVE-2026-454828.4 HIG27.7%
——8Improper limitation of a pathname to a restricted directory ('path traversal') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.55dCVE-2024-55599—27.7%
——8——CVE-2024-11408—27.7%
——8——CVE-2026-581495.3 MED27.7%
——8Joomla Extension - joomdonation.com - User enumeration in Events Booking < 5.8.0 - The Joomla extension Events Booking is vulnerable to an unauthenticated user enumeration that allows to retrieve account usernames and email addresses.55dCVE-2023-23851—27.7%
——8——CVE-2024-8722—27.7%
——8——CVE-2025-11071—27.7%
——8——CVE-2025-12554—27.7%
——8——CVE-2026-648995.5 MED27.7%
——8Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.33dCVE-2023-0015—27.7%
——8——CVE-2026-696808.1 HIG27.7%
——8Origin validation error in Windows DNS allows an unauthorized attacker to perform spoofing over a network.6dCVE-2026-458308.8 HIG27.7%
——8A lack of authorization validation in version 0.4.17 or later of the ChromaDB Python project allows any authenticated users to arbitrarily read, write, update, or delete data in any tenant's collection regardless of which tenant they belong to.63dCVE-2025-12220—27.7%
——8——CVE-2026-635315.5 MED27.7%
——8Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information locally.33dCVE-2026-41422—27.7%
——8——CVE-2025-12219—27.7%
——8——CVE-2026-171238.8 HIG27.7%
——8The Royal Elementor Addons plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 1.7.1064 via the Form Builder widget's 'webhook_url' setting. The widget's render() method persists the attacker-controlled URL into the wpr_webhook_url_{widget_id} option on every render (including a Contributor previewing their own draft), and the wpr_form_builder_webhook AJAX handler — registered for both authenticated and unauthenticated callers — reads that option and dispatches the outbound request via the non-safe wp_remote_post(), with no host allowlist, no scheme restriction, and no private/loopback IP filter (the plugin's existing wpr_is_blocked_remote_host / wpr_is_private_or_local_ip helpers are not called on this path). This makes it possible for authenticated attackers, with Contributor-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.27dCVE-2026-48166—27.7%
——8——CVE-2024-32583—27.7%
——8——CVE-2026-449555.3 MED27.7%
——8Pronetiqs IntraVUE versions 3.2.1a14 and prior have an exposure of sensitive system information to an unauthorized control sphere vulnerability which could allow for asset discovery by unauthenticated users.51dCVE-2020-12012—27.7%
——8——CVE-2024-45407—27.7%
——8——CVE-2024-11784—27.7%
——8——CVE-2025-67643—27.7%
——8——