Vulnerabilities exploitable today
374,209in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,710
New KEV · 24H0
Exploit Today ≥ 701,645
Distribution · last window
- Critical2,224
- High7,940
- Medium6,435
- Low714
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2024-36472—27.5%
——8——CVE-2005-3279—27.5%
——8——CVE-2022-1109—27.5%
——8——CVE-2022-48358—27.5%
——8——CVE-2000-0055—27.5%
——8——CVE-2020-4606—27.5%
——8——CVE-2026-681249.6 CRI27.5%
——8In the Linux kernel, the following vulnerability has been resolved:
mctp: serial: handle zero-length frames to prevent rx buffer overflow
The MCTP serial receive state machine reads a frame length byte in
mctp_serial_push_header() case 2 and validates it upper-bound-only:
if (c > MCTP_SERIAL_FRAME_MTU) {
dev->rxstate = STATE_ERR;
} else {
dev->rxlen = c;
dev->rxpos = 0;
dev->rxstate = STATE_DATA;
...
}
A length of zero passes this check, so rxlen is set to 0 and the state
machine advances to STATE_DATA. In mctp_serial_push() STATE_DATA, the
incoming byte is stored and rxpos incremented before the terminator is
dev->rxbuf[dev->rxpos] = c;
dev->rxpos++;
dev->rxstate = STATE_DATA;
if (dev->rxpos == dev->rxlen) {
dev->rxpos = 0;
dev->rxstate = STATE_TRAILER;
}
With rxlen == 0 the "rxpos == rxlen" terminator can never fire (rxpos is
already 1 on the first data byte), so subsequent bytes are written past
the end of the fixed 74-byte rxbuf, which is the last member of the
netdev private area. Every following data byte is an attacker-controlled
1-byte out-of-bounds heap write, and the overflow continues until a
frame (0x7e) or escape byte resets the parser -- effectively unbounded.
Reaching this requires CAP_NET_ADMIN to attach the N_MCTP line
discipline and bring the resulting mctpserialN netdev up, after which
the bytes arrive via the tty receive path.
Route a zero-length frame straight to STATE_TRAILER instead of
STATE_DATA. The trailer/framing bytes are still consumed, and the frame
resolves to a zero-length skb that the MCTP core rejects; the parser
never enters STATE_DATA with rxlen == 0, so the out-of-bounds write can
no longer occur.
KASAN, on a frame of 0x7e 0x01 0x00 followed by data bytes (before this
change):
UBSAN: array-index-out-of-bounds in drivers/net/mctp/mctp-serial.c:370
index 74 is out of range for type 'u8 [74]'
BUG: KASAN: slab-out-of-bounds in mctp_serial_tty_receive_buf
Write of size 1 at addr ... by task kworker/u16:0
mctp_serial_tty_receive_buf
tty_ldisc_receive_buf
flush_to_ldisc
Allocated by task 152:
alloc_netdev_mqs
mctp_serial_open
v2: route zero-length frames to STATE_TRAILER instead of STATE_ERR so
the trailer/framing bytes are still consumed (Jeremy Kerr).
Found by 0sec automated security-research tooling (https://0sec.ai).28dCVE-2024-4788—27.5%
——8——CVE-2025-2821—27.5%
——8——CVE-1999-1296—27.5%
——8——CVE-2021-38828—27.5%
——8——CVE-1999-0413—27.5%
——8——CVE-2025-15004—27.5%
——8——CVE-2024-52525—27.5%
——8——CVE-2024-8040—27.5%
——8——CVE-2026-626749.0 CRI27.5%
——8Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, PUT /sessions/{session_id}/agent checks LEVEL_EDIT permission for a session but does not reject a bound shared or template agent whose agent.session_id is None. An authenticated user with edit access to a session can replace that shared agent bundle through omnigent/server/routes/sessions.py, add a stdio MCP server, and cause later sessions that use the shared agent to launch an attacker-controlled command through omnigent/tools/mcp.py. The command executes with the Omnigent runner process permissions and can expose files, credentials, workspace data, internal services, and runner availability. This issue is fixed in version 0.3.0.22dCVE-2023-38042—27.5%
——8——CVE-2024-11844—27.5%
——8——CVE-2007-0004—27.5%
——8——CVE-2023-23891—27.5%
——8——CVE-2024-4873—27.5%
——8——CVE-2026-136946.5 MED27.5%
——8The Bit Form WordPress plugin before 3.1.0 does not properly validate its workflow-trigger token once the associated transient has expired, allowing unauthenticated attackers to re-trigger a form's configured workflow actions such as notification emails and integrations.57dCVE-2024-32711—27.5%
——8——CVE-2024-0893—27.5%
——8——CVE-2010-4438—27.5%
——8——CVE-2015-3212—27.5%
——8——CVE-2024-39678—27.5%
——8——CVE-2025-41347—27.5%
——8——CVE-2016-9749—27.5%
——8——CVE-2006-1589—27.5%
——8——CVE-2007-4685—27.5%
——8——CVE-2014-0447—27.5%
——8——CVE-2011-3196—27.5%
——8——CVE-2024-583636.3 MED27.5%
——8SurrealDB before 1.5.4 fails to properly validate authentication when a scope user switches databases using the USE clause or use method. Attackers with an authenticated session can impersonate an unrelated user in a different database if a user record with an identical identifier exists, allowing unauthorized actions if permissions rely solely on the $auth parameter.35dCVE-2026-0777—27.5%
——8——CVE-2006-4232—27.5%
——8——CVE-2000-0579—27.5%
——8——CVE-2024-9891—27.5%
——8——CVE-2026-4898—27.5%
——8——CVE-2020-36625—27.5%
——8——