Vulnerabilities exploitable today
372,967in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,705
New KEV · 24H0
Exploit Today ≥ 701,644
Distribution · last window
- Critical2,230
- High8,239
- Medium6,225
- Low613
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-44315—24.1%
——7——CVE-2024-7598—24.1%
——7——CVE-2024-24716—24.1%
——7——CVE-2026-40093—24.1%
——7——CVE-2023-6288—24.1%
——7——CVE-2026-478909.8 CRI24.1%
——7Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE) with view fragments.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.1910dCVE-2026-16937.5 HIG24.1%
——7The OAuth grant type Resource Owner Password Credentials (ROPC) flow is still used by the werbservices used by the WebVue, WebScheduler, TouchVue and Snapvue features of PcVue in version 12.0.0 through 16.3.3 included despite being deprecated. It might allow a remote attacker to steal user credentials.65dCVE-2024-13864—24.1%
——7——CVE-2026-37538—24.1%
——7——CVE-2024-13153—24.1%
——7——CVE-2023-37330—24.1%
——7——CVE-2026-35229—24.1%
——7——CVE-2024-21984—24.1%
——7——CVE-2025-40648—24.1%
——7——CVE-2026-792188.3 HIG24.1%
——7Incorrect authorization in Sandbox in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)16dCVE-2014-1948—24.1%
——7——CVE-2025-45512—24.1%
——7——CVE-2024-32119—24.1%
——7——CVE-2022-32747—24.1%
——7——CVE-2023-6194—24.1%
——7——CVE-2023-29145—24.1%
——7——CVE-2020-25043—24.1%
——7——CVE-2025-49918—24.1%
——7——CVE-2025-7100—24.1%
——7——CVE-2019-15368—24.1%
——7——CVE-2025-24727—24.1%
——7——CVE-2025-14157—24.1%
——7——CVE-2024-8818—24.1%
——7——CVE-2026-5330—24.1%
——7——CVE-2024-5571—24.1%
——7——CVE-2025-66402—24.1%
——7——CVE-2025-46605—24.1%
——7——CVE-2026-42485—24.1%
——7——CVE-2026-53530—24.1%
——7RaTeX is a KaTeX-compatible math rendering engine written in Rust. Prior to version 0.1.11, the public parser entrypoint `ratex_parser::parse(&str)` panics on the 9-byte input `\verbéxé` (i.e. `\verb` followed by the non-ASCII delimiter `é`). When handling a `\verb` command, the parser slices the verbatim argument with byte indices (`arg[1..arg.len() - 1]`); if the delimiter character is multibyte UTF-8, index `1` lands inside that character and Rust panics with *“byte index 1 is not a char boundary”*. Because RaTeX’s release profile sets `panic = "abort"` (`Cargo.toml:48`), the panic aborts the entire process — not just the current request/thread — making this a hard denial of service for any service that renders untrusted LaTeX. Version 0.1.11 fixes the issue.3dCVE-2026-354135.3 MED24.1%
——7Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.16.1, when GRAPHQL_INTROSPECTION=false is configured, Directus correctly blocks standard GraphQL introspection queries (__schema, __type). However, the server_specs_graphql resolver on the /graphql/system endpoint returns an equivalent SDL representation of the schema and was not subject to the same restriction. This allowed the introspection control to be bypassed, exposing schema structure (collection names, field names, types, and relationships) to unauthenticated users at the public permission level, and to authenticated users at their permitted permission level. This vulnerability is fixed in 11.16.1.50dCVE-2022-41188—24.1%
——7——CVE-2023-3410—24.1%
——7——CVE-2024-4874—24.1%
——7——CVE-2025-54301—24.1%
——7——CVE-2026-684718.8 HIG24.1%
——7In the Linux kernel, the following vulnerability has been resolved:
wifi: ieee80211: validate MLE common info length
ieee80211_mle_common_size() uses the first common-info octet as the
common information length for all known MLE types. However,
ieee80211_mle_size_ok() only validates that octet for Basic, Probe
Request, and TDLS MLEs.
Reconfiguration MLEs also skipped the length octet when calculating the
minimum common size, and Priority Access MLEs skipped validation of the
advertised common information length.
Account for the Reconfiguration common-info length octet and validate
the advertised common information length for all known MLE types. Keep
unknown-type handling unchanged.
[remove now misleading comment]26d