Vulnerabilities exploitable today
371,523in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,695
New KEV · 24H0
Exploit Today ≥ 701,637
Distribution · last window
- Critical2,229
- High8,605
- Medium6,351
- Low586
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2023-3588—22.1%
——7——CVE-2026-27915—22.1%
——7——CVE-2024-8851—22.1%
——7——CVE-2026-26180—22.1%
——7——CVE-2020-25775—22.1%
——7——CVE-2024-9662—22.1%
——7——CVE-2024-9645—22.1%
——7——CVE-2025-69313—22.1%
——7——CVE-2026-790326.8 MED22.1%
——7Improper input validation in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)9dCVE-2010-4415—22.1%
——7——CVE-2023-50712—22.1%
——7——CVE-2024-10583—22.1%
——7——CVE-2026-255624.3 MED22.1%
——7WeKan versions prior to 8.19 contain an information disclosure vulnerability in the attachments publication. Attachment metadata can be returned without properly scoping results to boards and cards accessible to the requesting user, potentially exposing attachment metadata to unauthorized users.57dCVE-2026-570887.8 HIG22.1%
——7Improper access control in Extensible Storage Engine (ESENT) allows an authorized attacker to elevate privileges locally.48dCVE-2026-503117.8 HIG22.1%
——7Improper access control in Windows Server allows an authorized attacker to elevate privileges locally.49dCVE-2026-759337.3 HIG22.1%
——7Jet Admin allows an authenticated attacker to inject JavaScript via the sign-in page's scripts and styles option. Injected script is executed in the context of any visiting user's domain.19dCVE-2013-4536—22.1%
——7——CVE-2021-0586—22.1%
——7——CVE-2026-34333—22.1%
——7——CVE-2021-20870—22.1%
——7——CVE-2026-568647.5 HIG22.1%
——7A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ && go mod tidy6dCVE-2021-35465—22.1%
——7——CVE-2026-48743—22.1%
——7——CVE-2026-134586.4 MED22.1%
——7The GenerateBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Dynamic Tag Injection in HTML Attributes in all versions up to, and including, 2.3.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. A Contributor-level attacker can store the malicious payload by placing a dynamic tag such as {{post_meta key:...}} in a non-URL HTML attribute (e.g., title, aria-label, alt, or data-* attributes) of a GenerateBlocks element block, then setting the corresponding unprotected post meta key via the Custom Fields metabox to a value containing a closing quote and an injected event-handler attribute.28dCVE-2025-13387—22.1%
——7——CVE-2026-12340—22.1%
——7——CVE-2026-404097.8 HIG22.1%
——7Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability48dCVE-2026-40408—22.1%
——7——CVE-2026-762088.2 HIG22.1%
——7phpMyFAQ versions 3.1.0 through 4.1.6 contain an authentication bypass vulnerability in AuthLdap::create(). When LDAP authentication is enabled, after a successful LDAP bind the code calls User::setStatus('active') unconditionally, which overwrites the account_status column of a pre-existing local account from 'blocked' to 'active'. As a result, a user whose local phpMyFAQ account has been administratively blocked can restore their account and log in by authenticating via LDAP. The state transition is not logged, so administrators cannot detect that the block was overridden. Fixed in 4.1.7.8dCVE-2026-503447.8 HIG22.1%
——7Improper authorization in Windows OLE allows an authorized attacker to elevate privileges locally.48dCVE-2025-2950—22.1%
——7——CVE-2024-52592—22.1%
——7——CVE-2024-5440—22.1%
——7——CVE-2026-550147.8 HIG22.1%
——7Improper access control in Windows Remote Help Defense allows an authorized attacker to elevate privileges locally.47dCVE-2026-26162—22.1%
——7——CVE-2026-503917.8 HIG22.1%
——7Improper privilege management in Windows Group Policy allows an authorized attacker to elevate privileges locally.49dCVE-2026-586317.8 HIG22.1%
——7Improper authorization in Windows Admin Center allows an authorized attacker to execute code locally.54dCVE-2022-38856—22.1%
——7——CVE-2022-38853—22.1%
——7——CVE-2026-106857.6 HIG22.1%
——7The Zephyr Bluetooth GATT client CCC-write response handler gatt_write_ccc_rsp() in subsys/bluetooth/host/gatt.c invoked the application's params->subscribe() callback after it had already called params->notify(conn, params, NULL, 0).
Per the public GATT API, a notify callback with NULL data is the documented signal that the subscription has terminated and the bt_gatt_subscribe_params struct may be freed or reused by the application; calling subscribe() on the struct afterwards is a use-after-free, including an indirect call through the freed params->subscribe function pointer.
The error branch is remotely (adjacent) reachable: a Zephyr device acting as a GATT client that calls bt_gatt_subscribe() can be driven into this ordering when a connected GATT server peer answers the CCC write with an ATT Error Response (the peer-supplied error code flows through att_error_rsp -> att_handle_rsp into gatt_write_ccc_rsp).
For applications that free or recycle subscription parameters in their notification-termination handler, this results in memory corruption, a crash (denial of service), or potentially attacker-influenced control flow. The fix reorders the handler so the subscribe() callback runs before the terminating notify(NULL) in both the error and unsubscribe paths.8d