Vulnerabilities exploitable today
372,926in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,705
New KEV · 24H0
Exploit Today ≥ 701,644
Distribution · last window
- Critical2,236
- High8,261
- Medium6,234
- Low615
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-463038.2 HIG23.8%
——7In the Linux kernel, the following vulnerability has been resolved:
isofs: validate Rock Ridge CE continuation extent against volume size
rock_continue() reads rs->cont_extent verbatim from the Rock Ridge CE
record and passes it to sb_bread() without checking that the block
number is within the mounted ISO 9660 volume. commit e595447e177b
("[PATCH] rock.c: handle corrupted directories") added cont_offset
and cont_size rejection for the CE continuation but did not validate
the extent block number itself. commit f54e18f1b831 ("isofs: Fix
infinite looping over CE entries") later capped the CE chain length
at RR_MAX_CE_ENTRIES = 32 but again left the block number unchecked.
With a crafted ISO mounted via udisks2 (desktop optical auto-mount)
or via CAP_SYS_ADMIN mount, rs->cont_extent can therefore point at
an out-of-range block or at blocks belonging to an adjacent
filesystem on the same block device. sb_bread() on an out-of-range
block returns NULL cleanly via the block layer EIO path, so there
is no memory-safety violation. For in-range reads of adjacent-
filesystem data, the CE buffer is parsed as Rock Ridge records and
only the text of SL sub-records reaches userspace through
readlink(), which makes the info-leak channel narrow and difficult
to exploit; still, rejecting the malformed CE outright matches the
rejection shape already present in the same function for
cont_offset and cont_size.
Add an ISOFS_SB(sb)->s_nzones bounds check to rock_continue() next
to the existing offset/size rejection, printing the same
corrupted-directory-entry notice.4dCVE-2026-49080—23.8%
——7——CVE-2023-41860—23.8%
——7——CVE-2024-6023—23.8%
——7——CVE-2025-64512—23.8%
——7——CVE-2023-32512—23.8%
——7——CVE-2025-712557.5 HIG23.8%
——7In Modem IMS, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed.53dCVE-2023-45002—23.8%
——7——CVE-2026-199923.1 LOW23.8%
——7A flaw has been found in Orange View Limited DualSafe Password Manager & Digital Vault Extension up to 1.4.35 on Chrome. Affected is an unknown function of the component postMessage-based Bridge. Executing a manipulation can lead to information disclosure. The attack can be launched remotely. A high complexity level is associated with this attack. The exploitability is told to be difficult. The exploit has been published and may be used. The vendor was contacted early about this disclosure.23dCVE-2025-28953—23.8%
——7——CVE-2023-34033—23.8%
——7——CVE-2023-43763—23.8%
——7——CVE-2026-50886—23.8%
——7——CVE-2024-10893—23.8%
——7——CVE-2023-34031—23.8%
——7——CVE-2024-20369—23.8%
——7——CVE-2023-34181—23.8%
——7——CVE-2026-792886.5 MED23.8%
——7Improper input validation in Autofill in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: High)16dCVE-2025-5463—23.8%
——7——CVE-2024-27989—23.8%
——7——CVE-2025-7937—23.8%
——7——CVE-2024-6022—23.8%
——7——CVE-2024-42464—23.8%
——7——CVE-2004-2634—23.8%
——7——CVE-2023-22353—23.8%
——7——CVE-2025-1835—23.8%
——7——CVE-2025-9959—23.8%
——7——CVE-2023-28897—23.8%
——7——CVE-2024-8378—23.8%
——7——CVE-2024-3983—23.8%
——7——CVE-2025-5956—23.8%
——7——CVE-2023-29580—23.8%
——7——CVE-2026-790728.1 HIG23.8%
——7Improper state validation in Performance in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: High)11dCVE-2025-60291—23.8%
——7——CVE-2025-64123—23.8%
——7——CVE-2023-48094—23.8%
——7——CVE-2023-22350—23.8%
——7——CVE-2025-6198—23.8%
——7——CVE-2024-40783—23.8%
——7——CVE-2022-32656—23.8%
——7——