Vulnerabilities exploitable today
369,447in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,695
New KEV · 24H0
Exploit Today ≥ 701,638
Distribution · last window
- Critical2,103
- High7,552
- Medium5,627
- Low543
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2024-477237.8 HIG21.0%
——6In the Linux kernel, the following vulnerability has been resolved:
jfs: fix out-of-bounds in dbNextAG() and diAlloc()
In dbNextAG() , there is no check for the case where bmp->db_numag is
greater or same than MAXAG due to a polluted image, which causes an
out-of-bounds. Therefore, a bounds check should be added in dbMount().
And in dbNextAG(), a check for the case where agpref is greater than
bmp->db_numag should be added, so an out-of-bounds exception should be
prevented.
Additionally, a check for the case where agno is greater or same than
MAXAG should be added in diAlloc() to prevent out-of-bounds.34dCVE-2010-2389—21.0%
——6——CVE-2025-40730—21.0%
——6——CVE-2026-39594—21.0%
——6——CVE-2025-62654—21.0%
——6——CVE-2015-2720—21.0%
——6——CVE-2024-52417—21.0%
——6——CVE-2024-36348—21.0%
——6——CVE-2026-623485.4 MED21.0%
——6TDengine is a time-series database optimized for Internet of Things devices. Prior to 3.4.1.15, TDengine Enterprise allowed an authenticated low-privilege SQL user to run KILL SSMIGRATE <id> against an active shared-storage migration because mndProcessKillSsMigrateReq called mndKillSsMigrate while the intended MND_OPER_SSMIGRATE_DB privilege check was commented out. This issue is fixed in version 3.4.1.15.53dCVE-2025-62653—21.0%
——6——CVE-2026-100855.4 MED21.0%
——6Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to restrict the group_constrained channel flag to public and private channels that support group synchronization, which allows an ordinary group or direct message member to remove all participants from the conversation via the channel patch API.. Mattermost Advisory ID: MMSA-2026-0068855dCVE-2025-8997—21.0%
——6——CVE-2025-1488—21.0%
——6——CVE-2026-109996.5 MED21.0%
——6Integer overflow in ANGLE in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)47dCVE-2025-28885—21.0%
——6——CVE-2025-32683—21.0%
——6——CVE-2026-605777.1 HIG21.0%
——6Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite (component: Core). The supported version that is affected is V16. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Enterprise Command Center Framework. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Enterprise Command Center Framework accessible data as well as unauthorized update, insert or delete access to some of Oracle Enterprise Command Center Framework accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N).39dCVE-2026-25735—21.0%
——6——CVE-2016-4496—21.0%
——6——CVE-2025-30925—21.0%
——6——CVE-2026-707367.1 HIG21.0%
——6Vulnerability in the Oracle Hyperion Profitability and Cost Management product of Oracle Hyperion (component: Deployment). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Profitability and Cost Management. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hyperion Profitability and Cost Management accessible data as well as unauthorized update, insert or delete access to some of Oracle Hyperion Profitability and Cost Management accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N).11dCVE-2025-30898—21.0%
——6——CVE-2024-21881—21.0%
——6——CVE-2024-46976—21.0%
——6——CVE-2026-25734—21.0%
——6——CVE-2026-122715.4 MED21.0%
——6The Tutor LMS WordPress plugin before 3.9.13 does not verify ownership of the targeted quiz attempt before writing to it, allowing authenticated users with subscriber-level access and above to modify and force-complete other students' quiz attempts, overwriting their recorded marks and pass/fail result.56dCVE-2026-1671—21.0%
——6——CVE-2026-187868.8 HIG21.0%
——6The CheckView WordPress plugin before 2.3.2 does not restrict its REST API authentication filter to its own routes and unconditionally discards the authentication error raised for any request whose URI merely contains a CheckView WordPress plugin before 2.3.2-specific string, making it possible for unauthenticated attackers to bypass the REST nonce check and perform any REST action available to a logged-in administrator, such as creating a new administrator account, via a crafted link an administrator is tricked into opening.12dCVE-2023-42005—21.0%
——6——CVE-2025-32318—21.0%
——6——CVE-2024-13665—21.0%
——6——CVE-2024-52418—21.0%
——6——CVE-2026-262273.7 LOW21.0%
——6VideoLAN VLC for Android prior to version 3.7.0 contains an authentication bypass in the Remote Access Server feature due to missing or insufficient rate limiting on one-time password (OTP) verification. The Remote Access Server uses a 4-digit OTP and does not enforce effective throttling or lockout within the OTP validity window, allowing an attacker with network reachability to the server to repeatedly attempt OTP verification until a valid user_session cookie is issued. Successful exploitation results in unauthorized access to the Remote Access interface, limited to media files explicitly shared by the VLC for Android user.55dCVE-2025-60247—21.0%
——6——CVE-2024-28574—21.0%
——6——CVE-2024-32925—21.0%
——6——CVE-2026-25736—21.0%
——6——CVE-2025-31819—21.0%
——6——CVE-2026-47209—21.0%
——6——CVE-2025-22606—21.0%
——6——