Vulnerabilities exploitable today
369,308in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,695
New KEV · 24H0
Exploit Today ≥ 701,636
Distribution · last window
- Critical2,137
- High7,613
- Medium5,627
- Low542
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2023-52495—20.4%
——6——CVE-2025-28015—20.4%
——6——CVE-2020-37191—20.4%
——6——CVE-2023-525855.5 MED20.4%
——6In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: Fix possible NULL dereference in amdgpu_ras_query_error_status_helper()
Return invalid error code -EINVAL for invalid block id.
Fixes the below:
drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c:1183 amdgpu_ras_query_error_status_helper() error: we previously assumed 'info' could be null (see line 1176)22dCVE-2025-9151—20.4%
——6——CVE-2020-3151—20.4%
——6——CVE-2026-5159—20.4%
——6——CVE-2024-40408—20.4%
——6——CVE-2024-53756—20.4%
——6——CVE-2024-270507.8 HIG20.4%
——6In the Linux kernel, the following vulnerability has been resolved:
libbpf: Use OPTS_SET() macro in bpf_xdp_query()
When the feature_flags and xdp_zc_max_segs fields were added to the libbpf
bpf_xdp_query_opts, the code writing them did not use the OPTS_SET() macro.
This causes libbpf to write to those fields unconditionally, which means
that programs compiled against an older version of libbpf (with a smaller
size of the bpf_xdp_query_opts struct) will have its stack corrupted by
libbpf writing out of bounds.
The patch adding the feature_flags field has an early bail out if the
feature_flags field is not part of the opts struct (via the OPTS_HAS)
macro, but the patch adding xdp_zc_max_segs does not. For consistency, this
fix just changes the assignments to both fields to use the OPTS_SET()
macro.33dCVE-2020-37178—20.4%
——6——CVE-2025-15450—20.4%
——6——CVE-2026-31773—20.4%
——6——CVE-2019-25339—20.4%
——6——CVE-2026-585206.1 MED20.4%
——6URL redirection to untrusted site ('open redirect') vulnerability in The Wikimedia Foundation Mediawiki - UrlShortener Extension allows Cross-Site Flashing.
This issue affects Mediawiki - UrlShortener Extension: from * before 1.43.9, 1.44.6, 1.45.4.59dCVE-2025-21120—20.4%
——6——CVE-2025-11926—20.4%
——6——CVE-2024-53767—20.4%
——6——CVE-2026-20904—20.4%
——6——CVE-2026-666708.1 HIG20.4%
——6Unauthenticated Local File Inclusion in Måne <= 1.7 versions.13dCVE-2024-267637.1 HIG20.4%
——6In the Linux kernel, the following vulnerability has been resolved:
dm-crypt: don't modify the data when using authenticated encryption
It was said that authenticated encryption could produce invalid tag when
the data that is being encrypted is modified [1]. So, fix this problem by
copying the data into the clone bio first and then encrypt them inside the
clone bio.
This may reduce performance, but it is needed to prevent the user from
corrupting the device by writing data with O_DIRECT and modifying them at
the same time.
[1] https://lore.kernel.org/all/20240207004723.GA35324@sol.localdomain/T/33dCVE-2025-5260—20.4%
——6——CVE-2026-5090—20.4%
——6——CVE-2025-2536—20.4%
——6——CVE-2024-53760—20.4%
——6——CVE-2024-34691—20.4%
——6——CVE-2025-47419—20.4%
——6——CVE-2025-54105—20.4%
——6——CVE-2025-67856—20.4%
——6——CVE-2019-14763—20.4%
——6——CVE-2026-24562—20.4%
——6——CVE-2017-7560—20.4%
——6——CVE-2025-13531—20.4%
——6——CVE-2020-3948—20.4%
——6——CVE-2025-43557—20.4%
——6——CVE-2024-54248—20.4%
——6——CVE-2025-58668—20.4%
——6——CVE-2025-13497—20.4%
——6——CVE-2026-202788.8 HIG20.4%
——6As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening releases that address multiple internally discovered vulnerabilities.
The vulnerabilities tracked by CVE-2026-20278 are related to improper neutralization issues that are grouped under the Common Weakness Enumeration (CWE) CWE-707.3dCVE-2021-34722—20.4%
——6——