Vulnerabilities exploitable today
372,253in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,703
New KEV · 24H0
Exploit Today ≥ 701,643
Distribution · last window
- Critical2,277
- High8,394
- Medium6,440
- Low634
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2020-6923—23.2%
——7——CVE-2023-0996—23.2%
——7——CVE-2016-8963—23.2%
——7——CVE-2012-5355—23.2%
——7——CVE-2026-395936.5 MED23.2%
——7Missing Authorization vulnerability in VillaTheme HAPPY allows Exploiting Incorrectly Configured Access Control Security Levels.
This issue affects HAPPY: from n/a through 1.0.10.50dCVE-2023-1341—23.2%
——7——CVE-2026-725348.8 HIG23.2%
——7A privilege escalation vulnerability in Authentik Security authentik through 2026.5.6 allows an attacker with a source-scoped SCIM provisioning token to gain superuser privileges by provisioning a SCIM group that matches an existing administrator group by name. The SCIM group ingest function adopts any existing group by name and replaces its membership without validating the source scope against the target group. An attacker can grant their provisioning token full IdP superuser access and lock out all existing administrators.8dCVE-2017-1596—23.2%
——7——CVE-2025-31568—23.2%
——7——CVE-2026-796765.9 MED23.2%
——7NLTK versions before 3.10.3 contain a path traversal vulnerability in corpus readers that reopen root-derived paths using built-in open() instead of nltk.pathsec.open(), allowing symlinks to escape trusted roots. Attackers who stage symlinked corpus files under a trusted data root can disclose outside-root content through normal corpus reader methods like channels(), domains(), and synonyms().11dCVE-2016-8967—23.2%
——7——CVE-2026-24399—23.2%
——7——CVE-2026-45418—23.2%
——7——CVE-2025-398667.8 HIG23.2%
——7In the Linux kernel, the following vulnerability has been resolved:
fs: writeback: fix use-after-free in __mark_inode_dirty()
An use-after-free issue occurred when __mark_inode_dirty() get the
bdi_writeback that was in the progress of switching.
CPU: 1 PID: 562 Comm: systemd-random- Not tainted 6.6.56-gb4403bd46a8e #1
......
pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : __mark_inode_dirty+0x124/0x418
lr : __mark_inode_dirty+0x118/0x418
sp : ffffffc08c9dbbc0
........
Call trace:
__mark_inode_dirty+0x124/0x418
generic_update_time+0x4c/0x60
file_modified+0xcc/0xd0
ext4_buffered_write_iter+0x58/0x124
ext4_file_write_iter+0x54/0x704
vfs_write+0x1c0/0x308
ksys_write+0x74/0x10c
__arm64_sys_write+0x1c/0x28
invoke_syscall+0x48/0x114
el0_svc_common.constprop.0+0xc0/0xe0
do_el0_svc+0x1c/0x28
el0_svc+0x40/0xe4
el0t_64_sync_handler+0x120/0x12c
el0t_64_sync+0x194/0x198
Root cause is:
systemd-random-seed kworker
----------------------------------------------------------------------
___mark_inode_dirty inode_switch_wbs_work_fn
spin_lock(&inode->i_lock);
inode_attach_wb
locked_inode_to_wb_and_lock_list
get inode->i_wb
spin_unlock(&inode->i_lock);
spin_lock(&wb->list_lock)
spin_lock(&inode->i_lock)
inode_io_list_move_locked
spin_unlock(&wb->list_lock)
spin_unlock(&inode->i_lock)
spin_lock(&old_wb->list_lock)
inode_do_switch_wbs
spin_lock(&inode->i_lock)
inode->i_wb = new_wb
spin_unlock(&inode->i_lock)
spin_unlock(&old_wb->list_lock)
wb_put_many(old_wb, nr_switched)
cgwb_release
old wb released
wb_wakeup_delayed() accesses wb,
then trigger the use-after-free
issue
Fix this race condition by holding inode spinlock until
wb_wakeup_delayed() finished.43dCVE-2026-41388—23.2%
——7——CVE-2025-12739—23.2%
——7——CVE-2021-0072—23.2%
——7——CVE-2026-25884—23.2%
——7——CVE-2024-13271—23.2%
——7——CVE-2023-1624—23.2%
——7——CVE-2024-49705—23.2%
——7——CVE-2022-49122—23.2%
——7——CVE-2026-0556—23.2%
——7——CVE-2025-28899—23.2%
——7——CVE-2026-7106—23.2%
——7——CVE-2025-7511—23.2%
——7——CVE-2025-54731—23.2%
——7——CVE-2025-66402—23.2%
——7——CVE-2023-2326—23.2%
——7——CVE-2026-668065.5 MED23.2%
——7Off-by-one error in Microsoft Office Word allows an unauthorized attacker to disclose information locally.28dCVE-2026-2800—23.2%
——7——CVE-2024-266107.8 HIG23.2%
——7In the Linux kernel, the following vulnerability has been resolved:
wifi: iwlwifi: fix a memory corruption
iwl_fw_ini_trigger_tlv::data is a pointer to a __le32, which means that
if we copy to iwl_fw_ini_trigger_tlv::data + offset while offset is in
bytes, we'll write past the buffer.38dCVE-2025-28889—23.2%
——7——CVE-2023-1343—23.2%
——7——CVE-2020-7275—23.2%
——7——CVE-2025-28928—23.2%
——7——CVE-2026-27611—23.2%
——7——CVE-2025-28880—23.2%
——7——CVE-2023-1342—23.2%
——7——CVE-2026-45396—23.2%
——7——