Vulnerabilities exploitable today
369,638in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,695
New KEV · 24H0
Exploit Today ≥ 701,638
Distribution · last window
- Critical2,121
- High7,610
- Medium5,709
- Low559
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2023-32263—21.4%
——6——CVE-2024-28579—21.4%
——6——CVE-2026-26079—21.4%
——6——CVE-2026-47244—21.4%
——6——CVE-2024-39384—21.4%
——6——CVE-2026-25937—21.4%
——6——CVE-2026-31993—21.4%
——6——CVE-2024-38953—21.4%
——6——CVE-2025-46011—21.4%
——6——CVE-2025-1502—21.4%
——6——CVE-2026-77710—21.4%
——6A vulnerability in misp-stix could allow a crafted STIX document to influence security-sensitive MISP attribute metadata during import.
The STIX import logic automatically selected between the internal MISP parser and the external STIX parser based on metadata contained in the STIX document itself. For STIX2, the presence of MISP-specific tool labels could cause a document to be classified as originating from MISP; similarly, STIX1 relied on the document title. These classification indicators are fully controlled by the STIX producer and therefore cannot constitute a trusted indication of the document's origin. The accompanying fix explicitly notes that the parser choice was previously based solely on labels or header titles that any producer could write, and introduces an explicit classification parameter allowing callers to override this detection.
When STIX2 content was handled as an internal MISP export, attributes contained in an x-misp-object were converted by copying the complete x_misp_attributes dictionary and passing it directly to misp_object.add_attribute(). Consequently, a crafted STIX bundle could supply fields that were not part of the expected STIX-to-MISP round-trip format, including security-sensitive properties such as distribution, sharing_group_id, tags, or other MISP attribute fields.
An attacker able to provide a STIX document for import could therefore spoof the markers used to identify MISP-generated content and inject additional attribute properties. This could alter the distribution, sharing restrictions, classification, or semantic metadata of imported attributes, potentially causing information to be shared contrary to the importing organization's policy or influencing downstream processing and automation based on attacker-controlled tags or metadata.
The vulnerability results from dynamically assigning externally supplied object properties without restricting them to an expected set of attributes, matching CWE-915. MITRE specifically describes this weakness as accepting externally influenced fields without controlling which object attributes may be modified and recommends an allow-list, which is the approach implemented by the patch. The parser-selection issue additionally corresponds to CWE-807, because an untrusted value was used to make a security-relevant trust/classification decision.
The attack is also consistent with CAPEC-153 (Input Data Manipulation), in which an attacker controls the structure or flags of supplied data so that the target selects a different processing path or interprets the content differently than intended.18dCVE-2025-6477—21.4%
——6——CVE-2014-7435—21.4%
——6——CVE-2025-8783—21.4%
——6——CVE-2025-26367—21.4%
——6——CVE-2025-47049—21.4%
——6——CVE-2014-7317—21.4%
——6——CVE-2024-12644—21.4%
——6——CVE-2026-10831—21.4%
——6——CVE-2026-58638.8 HIG21.4%
——6Inappropriate implementation in V8 in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)46dCVE-2014-6855—21.4%
——6——CVE-2026-856625.3 MED21.4%
——6Marqo 2.26.0 contains a server-side request forgery vulnerability in the add_documents endpoint that allows unauthenticated attackers to trigger requests to arbitrary URLs by supplying malicious media field values. Attackers can exploit download_image_from_url and fetch_content_sample functions which lack destination filtering and host validation to access internal services and cloud metadata endpoints.4dCVE-2023-36749—21.4%
——6——CVE-2025-27602—21.4%
——6——CVE-2025-55223—21.4%
——6——CVE-2022-48802—21.4%
——6——CVE-2023-40022—21.4%
——6——CVE-2014-7315—21.4%
——6——CVE-2024-39174—21.4%
——6——CVE-2014-7660—21.4%
——6——CVE-2026-29611—21.4%
——6——CVE-2026-179698.8 HIG21.4%
——6Inappropriate implementation in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Low)39dCVE-2026-76155—21.4%
——6Use of default credentials in Datiphy Data Management Center from v8.3.0 through v8.5.1 allows a remote attacker to gain administrative access to the management platform by logging in with default administrator credentials.18dCVE-2026-1466—21.4%
——6——CVE-2014-7331—21.4%
——6——CVE-2025-54913—21.4%
——6——CVE-2020-25737—21.4%
——6——CVE-2014-7348—21.4%
——6——CVE-2026-48025—21.4%
——6nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.7, internal/pki/resolver.go:36-64 constructs a CAManager with the plaintext ed25519.PrivateKey after unwrapping via the master key; internal/pki/ca.go:13-16 stores it. Callers at internal/api/enroll.go:116, internal/api/updates.go:297, and internal/api/mobile_bundle.go:40 use the manager for one Sign() and drop the reference on function return — but the underlying slice contents are not wiped before release. The keystore package's contract (internal/keystore/keystore.go doc: "Callers MUST zeroise the returned plaintext DEK as soon as it is no longer needed") is not met by the CAManager consumer. Decrypted CA private keys persist in process heap until Go's GC scavenges the underlying slice — minutes to hours under load, indefinitely on idle servers. This issue has been patched in version 0.3.7.40dCVE-2024-30118—21.4%
——6——