Vulnerabilities exploitable today
369,346in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,695
New KEV · 24H0
Exploit Today ≥ 701,636
Distribution · last window
- Critical2,099
- High7,531
- Medium5,575
- Low539
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2023-51750—20.8%
——6——CVE-2008-5145—20.8%
——6——CVE-2026-45331—20.8%
——6——CVE-2023-24461—20.8%
——6——CVE-2025-0170—20.8%
——6——CVE-2011-3204—20.8%
——6——CVE-2025-55648—20.8%
——6——CVE-2026-860917.1 HIG20.8%
——6ntopng before 6.7.260717 fails to check user privileges in the pools bulk-delete endpoint, allowing authenticated non-administrators to delete all host pools and member bindings. Attackers can issue POST requests to the delete pools endpoint to irreversibly destroy every host pool, removing traffic policy bindings and visibility restrictions that may bypass security policies.2dCVE-2025-30438—20.8%
——6——CVE-2022-40768—20.8%
——6——CVE-2022-30713—20.8%
——6——CVE-2017-5699—20.8%
——6——CVE-2026-546668.3 HIG20.8%
——6swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, src/schema-routes/schema-routes.ts passes OpenAPI path keys through parseRouteName to templates/default/procedure-call.ejs and templates/modular/procedure-call.ejs without escaping JavaScript template literal interpolation, allowing an attacker-controlled path containing ${...} to execute when the generated method is called. This issue is fixed in version 13.12.2.38dCVE-2023-35946—20.8%
——6——CVE-2014-2884—20.8%
——6——CVE-2023-30564—20.8%
——6——CVE-2026-654947.1 HIG20.8%
——6Subscriber SQL Injection in Dokan Pro <= 5.0.2 versions.46dCVE-2023-31759—20.8%
——6——CVE-2024-44717—20.8%
——6——CVE-2011-2533—20.8%
——6——CVE-2021-26335—20.8%
——6——CVE-2021-33604—20.8%
——6——CVE-2022-22301—20.8%
——6——CVE-2023-47243—20.8%
——6——CVE-2025-41087—20.8%
——6——CVE-2021-38990—20.8%
——6——CVE-2023-27609—20.8%
——6——CVE-2026-51730—20.8%
——6Incorrect access control in the delWiFiAclRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove Wi-Fi ACL rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi.7dCVE-2024-46452—20.8%
——6——CVE-2024-42195—20.8%
——6——CVE-2025-10084—20.8%
——6——CVE-2026-517239.1 CRI20.8%
——6Incorrect access control in the UploadCustomModule function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to install a custom CGI module via sending a crafted POST request to /cgi-bin/cstecgi.cgi.5dCVE-2026-27614—20.8%
——6——CVE-2026-673497.5 HIG20.8%
——6OpenCost before 1.121.0 fails to authenticate the GET /helmValues endpoint, exposing base64-decoded HELM_VALUES environment variable containing cloud provider credentials. Additionally, adminAuthMiddleware fails open when ADMIN_TOKEN is unset, allowing unauthenticated attackers to modify GCP service account keys via POST /serviceKey to redirect billing calls.37dCVE-2025-52785—20.8%
——6——CVE-2002-0294—20.8%
——6——CVE-2026-101693.7 LOW20.8%
——6A vulnerability was detected in OUSL-GROUP-BrinaryBrains School Student Management System up to 1e70e5ad1125b86dca4ee086eb6bb121f17708b6. Affected by this vulnerability is the function ajax_forgot_password of the file application/controllers/Login.php of the component Forgot Password Endpoint. The manipulation of the argument email results in weak password recovery. The attack can be launched remotely. This attack is characterized by high complexity. The exploitation appears to be difficult. The exploit is now public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.47dCVE-2025-12821—20.8%
——6——CVE-2024-477457.8 HIG20.8%
——6In the Linux kernel, the following vulnerability has been resolved:
mm: call the security_mmap_file() LSM hook in remap_file_pages()
The remap_file_pages syscall handler calls do_mmap() directly, which
doesn't contain the LSM security check. And if the process has called
personality(READ_IMPLIES_EXEC) before and remap_file_pages() is called for
RW pages, this will actually result in remapping the pages to RWX,
bypassing a W^X policy enforced by SELinux.
So we should check prot by security_mmap_file LSM hook in the
remap_file_pages syscall handler before do_mmap() is called. Otherwise, it
potentially permits an attacker to bypass a W^X policy enforced by
SELinux.
The bypass is similar to CVE-2016-10044, which bypass the same thing via
AIO and can be found in [1].
The PoC:
$ cat > test.c
int main(void) {
size_t pagesz = sysconf(_SC_PAGE_SIZE);
int mfd = syscall(SYS_memfd_create, "test", 0);
const char *buf = mmap(NULL, 4 * pagesz, PROT_READ | PROT_WRITE,
MAP_SHARED, mfd, 0);
unsigned int old = syscall(SYS_personality, 0xffffffff);
syscall(SYS_personality, READ_IMPLIES_EXEC | old);
syscall(SYS_remap_file_pages, buf, pagesz, 0, 2, 0);
syscall(SYS_personality, old);
// show the RWX page exists even if W^X policy is enforced
int fd = open("/proc/self/maps", O_RDONLY);
unsigned char buf2[1024];
while (1) {
int ret = read(fd, buf2, 1024);
if (ret <= 0) break;
write(1, buf2, ret);
}
close(fd);
}
$ gcc test.c -o test
$ ./test | grep rwx
7f1836c34000-7f1836c35000 rwxs 00002000 00:01 2050 /memfd:test (deleted)
[PM: subject line tweaks]34dCVE-2022-30710—20.8%
——6——