Vulnerabilities exploitable today
369,346in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,695
New KEV · 24H0
Exploit Today ≥ 701,636
Distribution · last window
- Critical2,104
- High7,540
- Medium5,575
- Low539
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2025-653976.8 MED20.7%
——6An insecure authentication mechanism in the safe_exec.sh startup script of Blurams Flare Camera version 24.1114.151.929 and earlier allows an attacker with physical access to the device to execute arbitrary commands with root privileges, if file /opt/images/public_key.der is not present in the file system. The vulnerability can be triggered by providing a maliciously crafted auth.ini file on the device's SD card.63dCVE-2026-185279.9 CRI20.7%
——6IBM Administration Runtime Expert for i 1R1M0 IBM Application Runtime Expert (ARE) for i could allow a remote attacker to gain elevated privileges, caused by ARE GUI component processing. An unauthenticated attacker can exploit this vulnerability to execute actions under another user's authenticated profile gaining elevated privileges on the IBM i system.6dCVE-2024-566317.8 HIG20.7%
——6In the Linux kernel, the following vulnerability has been resolved:
scsi: sg: Fix slab-use-after-free read in sg_release()
Fix a use-after-free bug in sg_release(), detected by syzbot with KASAN:
BUG: KASAN: slab-use-after-free in lock_release+0x151/0xa30
kernel/locking/lockdep.c:5838
__mutex_unlock_slowpath+0xe2/0x750 kernel/locking/mutex.c:912
sg_release+0x1f4/0x2e0 drivers/scsi/sg.c:407
In sg_release(), the function kref_put(&sfp->f_ref, sg_remove_sfp) is
called before releasing the open_rel_lock mutex. The kref_put() call may
decrement the reference count of sfp to zero, triggering its cleanup
through sg_remove_sfp(). This cleanup includes scheduling deferred work
via sg_remove_sfp_usercontext(), which ultimately frees sfp.
After kref_put(), sg_release() continues to unlock open_rel_lock and may
reference sfp or sdp. If sfp has already been freed, this results in a
slab-use-after-free error.
Move the kref_put(&sfp->f_ref, sg_remove_sfp) call after unlocking the
open_rel_lock mutex. This ensures:
- No references to sfp or sdp occur after the reference count is
decremented.
- Cleanup functions such as sg_remove_sfp() and
sg_remove_sfp_usercontext() can safely execute without impacting the
mutex handling in sg_release().
The fix has been tested and validated by syzbot. This patch closes the
bug reported at the following syzkaller link and ensures proper
sequencing of resource cleanup and mutex operations, eliminating the
risk of use-after-free errors in sg_release().55dCVE-2026-25877—20.7%
——6——CVE-2024-10287—20.7%
——6——CVE-2025-62817—20.7%
——6——CVE-2025-3904—20.7%
——6——CVE-2022-34677—20.7%
——6——CVE-2026-184334.3 MED20.7%
——6GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.4 and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to read policy configuration belonging to a namespace they were not authorized to access, due to incorrect authorization checks in a GraphQL query.19dCVE-2025-47280—20.7%
——6——CVE-2024-51929—20.7%
——6——CVE-2023-7088—20.7%
——6——CVE-2024-40673—20.7%
——6——CVE-2025-62510—20.7%
——6——CVE-2022-47092—20.7%
——6——CVE-2010-4295—20.7%
——6——CVE-2022-45068—20.7%
——6——CVE-2023-52670—20.7%
——6——CVE-2026-25631—20.7%
——6——CVE-2020-9403—20.7%
——6——CVE-2026-592147.3 HIG20.7%
——6Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, Open WebUI runs client-side Python with Pyodide in a same-origin web worker, allowing stored chat payloads that use pyodide.http.pyfetch or the js module fetch and XMLHttpRequest APIs to issue authenticated same-origin requests when a victim clicks Run, which can reach admin-only endpoints and execute server-side code through configured tools. This issue is fixed in version 0.10.0.58dCVE-2025-7890—20.7%
——6——CVE-2025-63009—20.7%
——6——CVE-2024-56244—20.7%
——6——CVE-2025-63071—20.7%
——6——CVE-2026-2507—20.7%
——6——CVE-2026-80350—20.7%
——6——CVE-2024-53970—20.7%
——6——CVE-2026-46425—20.7%
——6——CVE-2023-7045—20.7%
——6——CVE-2026-854328.2 HIG20.7%
——6MOOS core-moos through 10.4.0 fails to validate client identity in MOOSDB message processing, allowing authenticated attackers to attribute writes to other clients by supplying arbitrary source identifiers in serialized messages. Attackers can forge message origins and cancel third-party subscriptions by exploiting the disconnect between authenticated connection identity and wire-supplied source attribution.2dCVE-2023-5036—20.7%
——6——CVE-2007-2996—20.7%
——6——CVE-2025-5055—20.7%
——6——CVE-2022-26324—20.7%
——6——CVE-2026-1571—20.7%
——6——CVE-2023-38615—20.7%
——6——CVE-2026-54533—20.7%
——6——CVE-2025-67567—20.7%
——6——CVE-2020-7334—20.7%
——6——