Vulnerabilities exploitable today
374,073in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,710
New KEV · 24H0
Exploit Today ≥ 701,645
Distribution · last window
- Critical2,342
- High8,459
- Medium6,415
- Low712
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2024-9178—25.9%
——8——CVE-2026-505117.8 HIG25.9%
——8Improper link resolution before file access ('link following') in Microsoft PC Manager allows an authorized attacker to elevate privileges locally.54dCVE-2026-138068.1 HIG25.9%
——8Insufficient validation of untrusted input in Accessibility in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: High)75dCVE-2023-38136—25.9%
——8——CVE-2024-3632—25.9%
——8——CVE-2025-63909—25.9%
——8——CVE-2025-11127—25.9%
——8——CVE-2026-745577.5 HIG25.9%
——8In the Linux kernel, the following vulnerability has been resolved:
scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer
iscsi_scsi_cmd_rsp() copies the sense data of a SCSI Response from the
target-supplied data segment. The segment carries a 2-byte sense length
followed by the sense bytes, so it must hold 2 + senselen bytes, but the
bounds check only requires datalen >= senselen:
senselen = get_unaligned_be16(data);
if (datalen < senselen)
goto invalid_datalen;
memcpy(sc->sense_buffer, data + 2,
min_t(uint16_t, senselen, SCSI_SENSE_BUFFERSIZE));
A target that returns a SCSI Response whose datalen equals senselen
(with senselen <= SCSI_SENSE_BUFFERSIZE) makes the memcpy() from data +
2 read up to two bytes past the received data. Those bytes are stale
conn->data contents and end up in the command's sense buffer, which is
returned to userspace.
Account for the 2-byte sense length prefix in the check.27dCVE-2026-57288—25.9%
——8——CVE-2024-48059—25.9%
——8——CVE-2025-14674—25.9%
——8——CVE-2022-20009—25.9%
——8——CVE-2013-1706—25.9%
——8——CVE-2025-22220—25.9%
——8——CVE-2025-64099—25.9%
——8——CVE-2025-596996.8 MED25.9%
——8Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 (patched in 13.6.12 (LTS) and 13.9.0 (STS)), allow a physically proximate attacker to escalate privileges by booting from a USB device with a valid root filesystem. This occurs because of insecure default settings in the Legacy GRUB Bootloader.20dCVE-2017-1441—25.9%
——8——CVE-2012-0524—25.9%
——8——CVE-2026-43029—25.9%
——8——CVE-2023-47041—25.9%
——8——CVE-2026-367707.5 HIG25.9%
——8Shenzhen Tenda Technology Co., Ltd Tenda US_W3V1.0BR v1.0.0.3 was discovered to contain a stack overflow in the Go parameter of the ask_to_reboot function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.54dCVE-2025-596986.8 MED25.9%
——8Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 (patched in 13.6.12 (LTS) and 13.9.0 (STS)), might allow a physically proximate attacker to gain access to the EOL legacy bootloader.20dCVE-2011-4114—25.9%
——8——CVE-2024-0231—25.9%
——8——CVE-2018-25140—25.9%
——8——CVE-2013-4136—25.9%
——8——CVE-2025-28343—25.9%
——8——CVE-2013-1707—25.9%
——8——CVE-2026-785526.0 MED25.9%
——8The Okta Access Gateway does not apply its Lua directive restriction to the application-level custom configuration field. The field is interpolated directly into the nginx server block without inspection, resulting in execution of injected directives.5dCVE-2026-22197—25.9%
——8——CVE-2013-3403—25.9%
——8——CVE-2009-0489—25.9%
——8——CVE-2011-4159—25.9%
——8——CVE-2017-18200—25.9%
——8——CVE-2025-65836—25.9%
——8——CVE-2023-38560—25.9%
——8——CVE-2025-41030—25.9%
——8——CVE-2026-82751—25.9%
——8Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unauthenticated remote client to inflate the fee-payer's gas cost per sponsored payment by a large multiplier and to have the sponsor pay for provisioning an access key on the client's own account.
When the server sponsors Tempo payments, MPP.Methods.Tempo.FeePayerPolicy.measure/3 in lib/mpp/methods/tempo/fee_payer_policy.ex bounds the gas fields, the fee budget, the validity window and the access list of the client-signed 0x76 envelope, but does not check whether the envelope carries the optional key_authorization field. A client can attach a fully signed key authorization, provisioning a new access key with token spending limits on its own account, alongside the normal payment call. The key and each limit entry are persistent storage writes billed as intrinsic gas to the sponsor, bounded only by the gas_limit ceiling. At the reporter's default of one key with three token limits the sponsored cost rises from about 46,587 gas to about 1,808,700 gas, and the client keeps a valid access key it paid nothing for.
This issue affects mpp: from 0.2.0 before 0.16.1.7dCVE-2025-0285—25.9%
——8——CVE-2024-30210—25.9%
——8——