Vulnerabilities exploitable today
372,403in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,705
New KEV · 24H0
Exploit Today ≥ 701,644
Distribution · last window
- Critical2,230
- High8,254
- Medium6,232
- Low617
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-657877.8 HIG23.7%
——7Heap-based buffer overflow in Desktop Window Manager allows an authorized attacker to elevate privileges locally.26dCVE-2025-5476—23.7%
——7——CVE-2026-782138.7 HIG23.7%
——7Heptabase developed by Hepta Platforms, Inc. has a Stored Cross-Site Scripting vulnerability. Authenticated remote attackers can inject persistent malicious content into specific pages, causing arbitrary JavaScript code to execute when other users click the crafted content.18dCVE-2016-8012—23.7%
——7——CVE-2026-3455—23.7%
——7——CVE-2025-46652—23.7%
——7——CVE-2026-613577.8 HIG23.7%
——7Use after free in Application Information Services allows an authorized attacker to elevate privileges locally.29dCVE-2025-33242—23.7%
——7——CVE-2025-382099.8 CRI23.7%
——7In the Linux kernel, the following vulnerability has been resolved:
nvme-tcp: remove tag set when second admin queue config fails
Commit 104d0e2f6222 ("nvme-fabrics: reset admin connection for secure
concatenation") modified nvme_tcp_setup_ctrl() to call
nvme_tcp_configure_admin_queue() twice. The first call prepares for
DH-CHAP negotitation, and the second call is required for secure
concatenation. However, this change triggered BUG KASAN slab-use-after-
free in blk_mq_queue_tag_busy_iter(). This BUG can be recreated by
repeating the blktests test case nvme/063 a few times [1].
When the BUG happens, nvme_tcp_create_ctrl() fails in the call chain
below:
nvme_tcp_create_ctrl()
nvme_tcp_alloc_ctrl() new=true ... Alloc nvme_tcp_ctrl and admin_tag_set
nvme_tcp_setup_ctrl() new=true
nvme_tcp_configure_admin_queue() new=true ... Succeed
nvme_alloc_admin_tag_set() ... Alloc the tag set for admin_tag_set
nvme_stop_keep_alive()
nvme_tcp_teardown_admin_queue() remove=false
nvme_tcp_configure_admin_queue() new=false
nvme_tcp_alloc_admin_queue() ... Fail, but do not call nvme_remove_admin_tag_set()
nvme_uninit_ctrl()
nvme_put_ctrl() ... Free up the nvme_tcp_ctrl and admin_tag_set
The first call of nvme_tcp_configure_admin_queue() succeeds with
new=true argument. The second call fails with new=false argument. This
second call does not call nvme_remove_admin_tag_set() on failure, due to
the new=false argument. Then the admin tag set is not removed. However,
nvme_tcp_create_ctrl() assumes that nvme_tcp_setup_ctrl() would call
nvme_remove_admin_tag_set(). Then it frees up struct nvme_tcp_ctrl which
has admin_tag_set field. Later on, the timeout handler accesses the
admin_tag_set field and causes the BUG KASAN slab-use-after-free.
To not leave the admin tag set, call nvme_remove_admin_tag_set() when
the second nvme_tcp_configure_admin_queue() call fails. Do not return
from nvme_tcp_setup_ctrl() on failure. Instead, jump to "destroy_admin"
go-to label to call nvme_tcp_teardown_admin_queue() which calls
nvme_remove_admin_tag_set().44dCVE-2010-0428—23.7%
——7——CVE-2026-835015.5 MED23.7%
——7Out-of-bounds read in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to disclose information locally.1dCVE-2026-627327.8 HIG23.7%
——7Heap-based buffer overflow in Windows Telephony Service allows an authorized attacker to elevate privileges locally.24dCVE-2020-1984—23.7%
——7——CVE-2026-41310—23.7%
——7——CVE-2026-703447.8 HIG23.7%
——7Stack-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.26dCVE-2025-2165—23.7%
——7——CVE-2026-528402.7 LOW23.7%
——7Easy!Appointments is a self hosted appointment scheduler. In versions prior to 1.6.0, `Caldav::connect_to_server` at `application/controllers/Caldav.php:60` hands the request's `caldav_url` to a Guzzle `REPORT` call without scheme or host validation. A logged-in backend user (admin, provider, or secretary) reaches loopback, RFC1918, and link-local hosts on the deployment's network. The Guzzle exception path returns the upstream status code plus ~120 bytes of response body in the JSON `message` field (`Caldav.php:74-78`), so the SSRF is semi-blind. Version 1.6.0 contains a patch.58dCVE-2026-817728.8 HIG23.7%
——7Unauthenticated PHP Object Injection in Ninja Forms - Layout & Styles <= 3.0.31 versions.8dCVE-2024-56234—23.7%
——7——CVE-2026-619377.8 HIG23.7%
——7Integer overflow or wraparound in Windows HTTP.sys allows an authorized attacker to elevate privileges locally.26dCVE-2026-61640—23.7%
——7Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.6, Admin-configured OIDC token_url and user_info_url in includes/oidc/handle_oidc_callback.php:18-49 are used directly in curl_init() with zero SSRF filtering. Unlike logo/webhook URLs which have validate_webhook_url_for_ssrf(), OIDC URLs bypass all protections. Admin sets URL to http://169.254.169.254/latest/meta-data/ for cloud metadata access or internal network pivoting. This issue has been patched in version 4.9.6.3dCVE-2026-627517.8 HIG23.7%
——7Integer overflow or wraparound in Windows Projected File System allows an authorized attacker to elevate privileges locally.29dCVE-2024-53811—23.7%
——7——CVE-2023-38682—23.7%
——7——CVE-2026-627227.8 HIG23.7%
——7Heap-based buffer overflow in Windows Brokering File System allows an authorized attacker to elevate privileges locally.25dCVE-2026-874355.3 MED23.7%
——7Information leak in ControlledFrame in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)2dCVE-2017-6256—23.7%
——7——CVE-2024-10472—23.7%
——7——CVE-2026-685848.6 HIG23.7%
——7SiYuan versions before v3.7.3 contain an authentication bypass vulnerability in publish mode where content-returning endpoints getHeadingChildrenDOM, getHeading*Transaction, and getBacklinkDoc perform no password check despite protecting the primary getDoc endpoint. Anonymous attackers can retrieve full content of password-protected documents by obtaining internal block IDs from reader-accessible endpoints and calling unprotected content endpoints to bypass the password gate.16dCVE-2026-703467.8 HIG23.7%
——7Stack-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.26dCVE-2025-62477—23.7%
——7——CVE-2026-76598—23.7%
——7Joomla Extension - fabrikar.com - Unauthenticated arbitrary directory listing via onAjax_getFolders in Fabrik < 4.7.2 - The onAjax_getFolders method of the elements model allows arbitrary directory listings.18dCVE-2026-619327.8 HIG23.7%
——7Access of resource using incompatible type ('type confusion') in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.26dCVE-2026-627077.8 HIG23.7%
——7Use after free in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally.26dCVE-2026-627687.8 HIG23.7%
——7Stack-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.25dCVE-2026-613537.8 HIG23.7%
——7Heap-based buffer overflow in Windows Telephony Service allows an authorized attacker to elevate privileges locally.26dCVE-2022-42798—23.7%
——7——CVE-2011-1144—23.7%
——7——CVE-2025-3751—23.7%
——7——CVE-2026-584756.1 MED23.7%
——7Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject arbitrary JavaScript by supplying malicious script payloads within program names submitted via HTTP requests. Attackers can exploit the lack of output encoding on rendered program names to execute arbitrary JavaScript in the browsers of any users viewing the affected page, with exploitation facilitated by the absence of a required passphrase or the default passphrase 'opendoor'.58d