Vulnerabilities exploitable today
374,209in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,710
New KEV · 24H0
Exploit Today ≥ 701,645
Distribution · last window
- Critical2,226
- High7,951
- Medium6,438
- Low714
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2025-12466—27.0%
——8——CVE-2023-24010—27.0%
——8——CVE-2023-23504—27.0%
——8——CVE-2024-33694—27.0%
——8——CVE-2024-0126—27.0%
——8——CVE-2025-14227—27.0%
——8——CVE-2025-4889—27.0%
——8——CVE-2024-32591—27.0%
——8——CVE-2024-5650—27.0%
——8——CVE-2008-5378—27.0%
——8——CVE-2021-470178.8 HIG27.0%
——8In the Linux kernel, the following vulnerability has been resolved:
ath10k: Fix a use after free in ath10k_htc_send_bundle
In ath10k_htc_send_bundle, the bundle_skb could be freed by
dev_kfree_skb_any(bundle_skb). But the bundle_skb is used later
by bundle_skb->len.
As skb_len = bundle_skb->len, my patch replaces bundle_skb->len to
skb_len after the bundle_skb was freed.43dCVE-2020-7317—27.0%
——8——CVE-2017-12340—27.0%
——8——CVE-2026-30777—27.0%
——8——CVE-2008-5371—27.0%
——8——CVE-2023-3453—27.0%
——8——CVE-2023-24011—27.0%
——8——CVE-2010-4001—27.0%
——8——CVE-2022-33064—27.0%
——8——CVE-2008-5376—27.0%
——8——CVE-2025-4692—27.0%
——8——CVE-2026-2106—27.0%
——8——CVE-2025-69387—27.0%
——8——CVE-2021-3930—27.0%
——8——CVE-2023-6068—27.0%
——8——CVE-2025-2575—27.0%
——8——CVE-2026-452956.5 MED27.0%
——8FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.219, the open tracking endpoint `GET /thread/read/{conversation_id}/{thread_id}` allows unauthenticated attackers to enumerate valid conversation and thread IDs, and modify thread state (`opened_at` timestamp) without any authentication. Version 1.8.219 patches the issue.56dCVE-2022-47373—27.0%
——8——CVE-2024-33692—27.0%
——8——CVE-2013-1502—27.0%
——8——CVE-2024-43211—27.0%
——8——CVE-2026-2107—27.0%
——8——CVE-2014-1444—27.0%
——8——CVE-2023-40704—27.0%
——8——CVE-2024-29819—27.0%
——8——CVE-2024-56178—27.0%
——8——CVE-2025-15346—27.0%
——8——CVE-2024-33695—27.0%
——8——CVE-2026-558807.1 HIG27.0%
——8OpenReplay is a self-hosted session replay suite. In 1.27.0 and earlier, three dashboard and note mutation functions ran their SQL without the ownership predicate that their sibling read and edit functions use: notes.delete filtered only on note id and project id, while dashboards.update_widget and dashboards.remove_widget filtered only on dashboard id and widget id, allowing any authenticated member to delete another user's private session notes and remove or rewrite widgets on another user's private dashboards.64dCVE-2025-4890—27.0%
——8——