Vulnerabilities exploitable today
374,073in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,710
New KEV · 24H0
Exploit Today ≥ 701,645
Distribution · last window
- Critical2,342
- High8,460
- Medium6,416
- Low712
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2024-43213—25.4%
——8——CVE-2026-109319.6 CRI25.4%
——8Use after free in FileSystem in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)55dCVE-2025-47055—25.4%
——8——CVE-2026-40873—25.4%
——8——CVE-2026-109729.6 CRI25.4%
——8Use after free in Ozone in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)55dCVE-2010-0118—25.4%
——8——CVE-2025-24270—25.4%
——8——CVE-2025-26438—25.4%
——8——CVE-2025-53572—25.4%
——8——CVE-2024-20475—25.4%
——8——CVE-2026-673007.5 HIG25.4%
——8FreeRDP before 3.29.0 contains client-side heap use-after-free vulnerabilities in the async update message proxy for RAIL WINDOW_STATE_ORDER and NOTIFY_ICON_STATE_ORDER when AsyncUpdate is enabled. When a malicious or compromised RDP server sends crafted update orders, the message proxy shallow-copies structures containing nested parser-owned pointers (e.g., titleInfo.string, windowRects, visibilityRects, icon buffers). The parser frees those nested buffers after the callback returns, so the queued async message later dispatches stale pointers, potentially causing memory corruption or a client crash.15dCVE-2017-12332—25.4%
——8——CVE-2026-711216.5 MED25.4%
——8Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Hyperion Financial Management accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Hyperion Financial Management. CVSS 3.1 Base Score 6.5 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L).22dCVE-2025-14973—25.4%
——8——CVE-2026-110099.6 CRI25.4%
——8Use after free in USB in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)55dCVE-2023-23525—25.4%
——8——CVE-2025-36598—25.4%
——8——CVE-2025-46983—25.4%
——8——CVE-2026-726046.5 MED25.4%
——8A path traversal vulnerability in Intelliants Subrion CMS through 4.2.1 allows authenticated administrators to delete arbitrary files on the server via the admin panel file deletion endpoint. The endpoint passes a user-supplied file path directly to unlink() without sanitization or path canonicalization. An authenticated administrator can delete sensitive system files outside the web root, potentially causing server instability or facilitating further attacks.18dCVE-2025-53243—25.4%
——8——CVE-2026-95477.4 HIG25.4%
——8When a libcurl-based application performs transfers via `SCP://` or `SFTP://`
and utilizes the `CURLOPT_SSH_KEYFUNCTION` callback, it may silently accept an
untrusted server. This vulnerability occurs when a server presents a host key
type that does not match the specific key type already recorded for that host
in the `known_hosts` file. Instead of rejecting the mismatch, the callback
mechanism fails to properly enforce the restriction, allowing the connection
to succeed without warning and risking a potential man-in-the-middle attack.7hCVE-2026-0492—25.4%
——8——CVE-2023-52271—25.4%
——8——CVE-2026-109888.8 HIG25.4%
——8Use after free in Views in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)55dCVE-2026-39109—25.4%
——8——CVE-2023-20221—25.4%
——8——CVE-2026-539838.6 HIG25.4%
——8Ground Station prior to 0.6.0 contains an unauthenticated blind server-side request forgery vulnerability in the orbital-source configuration path that allows any unauthenticated Socket.IO client to cause the ground-station process to issue outbound HTTP requests to attacker-chosen destinations. Attackers can connect to the Socket.IO server on port 7000 without credentials due to disabled authentication enforcement and a wildcard CORS policy, then submit a data_submission event with submit-orbital-sources action to persist an attacker-supplied URL in the database, then trigger an orbital sync via the equally unauthenticated background_task:start event. The URL is stored with no scheme allowlist, no host validation, and no rejection of loopback, RFC1918, or link-local (cloud instance metadata at 169.254.169.254) addresses, and is passed directly to requests.get in _fetch_http_3le and _fetch_http_omm in backend/tlesync/source_adapters.py. HTTP status codes and error messages from the outbound request are emitted in the orbital_sync_state Socket.IO event to all connected clients, providing a serviceable oracle for interpreting internal-service and cloud-metadata responses even though the raw response body is not directly leaked. Because the malicious source persists in the database across restarts and re-fires every 24 hours on the scheduled sync cycle, the primitive gives durable long-term SSRF without the attacker needing to remain connected.39dCVE-2023-1249—25.4%
——8——CVE-2026-54204—25.4%
——8Tobit Laboratories AG TeamDavid's Webbox 's search functionality accepts a “pathnameroot”
parameter, which can be set to network locations using UNC paths (e.g.,
“\\Server\Share”). The server processes these paths without validation,
resulting in outbound connection attempts to attacker-controlled SMB
servers. This enables unauthenticated attackers to trigger the server to
authenticate to arbitrary SMB endpoints, potentially exposing NTLM
authentication information (such as NTLM hashes). If outbound
connections to port 445 (SMB) are permitted, attackers can use this to
conduct SMB relay or credential theft attacks. Exploitation of the
“pathnameroot” parameter is possible without authentication.This issue affects TeamDavid before Rollout 528.
Starting with Rollout 528 (June 30, 2026), the affected functionality is disabled by default and the vulnerabilities are therefore no longer exposed through this functionality.8dCVE-2026-17106—25.4%
——8The tar extraction routines in moby/go-archive (Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers) do not confine filesystem operations to the destination directory. The extractor decides where each archive entry lands using lexical string checks and then performs the filesystem operation on a path that is resolved by the OS, so links introduced by the archive can be followed out of the destination directory. An attacker who controls the contents of an archive can create or overwrite files at arbitrary paths writable by the extracting process.18dCVE-2024-51859—25.4%
——8——CVE-2022-41136—25.4%
——8——CVE-2026-33769—25.4%
——8——CVE-2026-628047.8 HIG25.4%
——8External control of file name or path in Microsoft Office Word allows an unauthorized attacker to execute code locally.7dCVE-2024-51885—25.4%
——8——CVE-2026-26936—25.4%
——8——CVE-2024-51860—25.4%
——8——CVE-2026-15985—25.4%
——8——CVE-2024-2304—25.4%
——8——CVE-2024-57605—25.4%
——8——