Vulnerabilities exploitable today
372,403in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,705
New KEV · 24H0
Exploit Today ≥ 701,644
Distribution · last window
- Critical2,280
- High8,398
- Medium6,461
- Low636
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2024-50265—23.5%
——7——CVE-2023-45628—23.5%
——7——CVE-2024-23505—23.5%
——7——CVE-2025-53712—23.5%
——7——CVE-2023-38665—23.5%
——7——CVE-2026-368197.5 HIG23.5%
——7Shenzhen Tenda Technology Co., Ltd Tenda W20E v15.11.0.6 was discovered to contain a buffer overflow in the bindMACAddr parameter of the fromSetDhcpRules function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request.50dCVE-2023-49963—23.5%
——7——CVE-2023-51485—23.5%
——7——CVE-2023-46144—23.5%
——7——CVE-2024-23502—23.5%
——7——CVE-2022-30237—23.5%
——7——CVE-2021-29646—23.5%
——7——CVE-2026-368067.5 HIG23.5%
——7Shenzhen Tenda Technology Co., Ltd Tenda W15E v15.11.0.10 was discovered to contain a buffer overflow in the webAuthUserPwd parameter of the formModifyWebAuthUser function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request.50dCVE-2026-9058—23.5%
——7For untrusted certificates that contain the "Authority Information Access - caIssuers URI" extension, Szafir SDK will automatically download the parent CA certificate from the specified URL and will import it to its trust store as a "nonqualified" certificate. In such a case, Szafir SDK returns a success status code of 0 ("Positively verified") upon successful cryptographic verification and a certificate status of "nonqualified".
For other types of untrusted certificates, Szafir SDK returns a success status code of 0 ("Positively verified") upon successful cryptographic verification and a certificate status of "nondetermined".
This may lead integrating applications to incorrectly treat the digital signature as valid despite an untrusted certificate chain. This flaw enables authentication bypass and user impersonation:
(1) in use-cases other than qualified certificate authentication, or
(2) if the qualified certificate authentication use-case is not correctly implemented by the integrating application.
This issue was fixed in version 1.8.463.2.50dCVE-2026-368087.5 HIG23.5%
——7Shenzhen Tenda Technology Co., Ltd Tenda W15E v15.11.0.10 was discovered to contain a buffer overflow in the webAuthUserInfo parameter of the formAddWebAuthUser function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request.50dCVE-2026-331507.8 HIG23.5%
——7libfuse is the reference implementation of the Linux FUSE. From version 3.18.0 to before version 3.18.2, a use-after-free vulnerability in the io_uring subsystem of libfuse allows a local attacker to crash FUSE filesystem processes and potentially execute arbitrary code. When io_uring thread creation fails due to resource exhaustion (e.g., cgroup pids.max), fuse_uring_start() frees the ring pool structure but stores the dangling pointer in the session state, leading to a use-after-free when the session shuts down. The trigger is reliable in containerized environments where cgroup pids.max limits naturally constrain thread creation. This issue has been patched in version 3.18.2.59dCVE-2024-4262—23.5%
——7——CVE-2023-51669—23.5%
——7——CVE-2026-368007.5 HIG23.5%
——7Shenzhen Tenda Technology Co., Ltd Tenda G0 v15.11.0.5 was discovered to contain a buffer overflow in the IPMacBindIndex parameter of the formIPMacBindDel function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request.50dCVE-2025-12777—23.5%
——7——CVE-2023-51577—23.5%
——7——CVE-2020-5962—23.5%
——7——CVE-2026-368187.5 HIG23.5%
——7Shenzhen Tenda Technology Co., Ltd Tenda W20E v15.11.0.6 was discovered to contain a buffer overflow in the wewifiWhiteUserInfo parameter of the formAddWewifiWhiteUser function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request.50dCVE-2024-24931—23.5%
——7——CVE-2026-368227.5 HIG23.5%
——7Shenzhen Tenda Technology Co., Ltd Tenda W20E v15.11.0.6 was discovered to contain a buffer overflow in the macAddr parameter of the formDelStaState function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request.50dCVE-2026-568586.1 MED23.5%
——7Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS.8dCVE-2024-24713—23.5%
——7——CVE-2026-53531—23.5%
——7RaTeX is a KaTeX-compatible math rendering engine written in Rust. Prior to version 0.1.11, RaTeX’s recursive-descent parser recurses one (or more) native stack frame per nesting level at `{`, `\left`, `\sqrt{`, `^{`, etc, with no maximum depth limit. A short, ~10 KB input of nested groups overflows the 8 MB main-thread stack and aborts the process. With `panic = "abort"` (`Cargo.toml:48`), and because a Rust stack overflow is always a fatal `SIGABRT` regardless of panic strategy this is an unrecoverable, whole-process denial of service reachable from a single untrusted LaTeX string. Version 0.1.11 fixes the issue.2dCVE-2024-30250—23.5%
——7——CVE-2023-22812—23.5%
——7——CVE-2025-13409—23.5%
——7——CVE-2026-368137.5 HIG23.5%
——7Shenzhen Tenda Technology Co., Ltd Tenda W15E v15.11.0.10 was discovered to contain a buffer overflow in the picCropName parameter of the formCropAndSetWewifiPic function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request.50dCVE-2023-45608—23.5%
——7——CVE-2026-368057.5 HIG23.5%
——7Shenzhen Tenda Technology Co., Ltd Tenda G0 v15.11.0.5 was discovered to contain multiple buffer overflows in the Saveqqlist function via the qqStr and markStr parameters. These vulnerabilities allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request.53dCVE-2025-53713—23.5%
——7——CVE-2023-52191—23.5%
——7——CVE-2026-368077.5 HIG23.5%
——7Shenzhen Tenda Technology Co., Ltd Tenda W15E v15.11.0.10 was discovered to contain a buffer overflow in the webAuthUserPwd parameter of the formAddWebAuthUser function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request.50dCVE-2025-54295—23.5%
——7——CVE-2022-3567—23.5%
——7——CVE-2023-45059—23.5%
——7——