Vulnerabilities exploitable today
369,271in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,695
New KEV · 24H0
Exploit Today ≥ 701,636
Distribution · last window
- Critical2,152
- High7,655
- Medium5,617
- Low537
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2022-3007—20.1%
——6——CVE-2023-533817.5 HIG20.1%
——6In the Linux kernel, the following vulnerability has been resolved:
NFSD: fix leaked reference count of nfsd4_ssc_umount_item
The reference count of nfsd4_ssc_umount_item is not decremented
on error conditions. This prevents the laundromat from unmounting
the vfsmount of the source file.
This patch decrements the reference count of nfsd4_ssc_umount_item
on error.33dCVE-2025-7552—20.1%
——6——CVE-2022-30503—20.1%
——6——CVE-2023-7289—20.1%
——6——CVE-2025-43743—20.1%
——6——CVE-2025-3794—20.1%
——6——CVE-2025-10997—20.1%
——6——CVE-2025-49733—20.1%
——6——CVE-2026-129886.4 MED20.1%
——6The WP 2FA WordPress plugin before 3.1.1.2 does not verify that the email address supplied during two-factor authentication setup belongs to the user, allowing an attacker who has obtained a user's credentials to redirect the setup verification code to an attacker-controlled email address and take over the account.54dCVE-2025-402828.8 HIG20.1%
——6In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: 6lowpan: reset link-local header on ipv6 recv path
Bluetooth 6lowpan.c netdev has header_ops, so it must set link-local
header for RX skb, otherwise things crash, eg. with AF_PACKET SOCK_RAW
Add missing skb_reset_mac_header() for uncompressed ipv6 RX path.
For the compressed one, it is done in lowpan_header_decompress().
Log: (BlueZ 6lowpan-tester Client Recv Raw - Success)
------
kernel BUG at net/core/skbuff.c:212!
Call Trace:
<IRQ>
...
packet_rcv (net/packet/af_packet.c:2152)
...
<TASK>
__local_bh_enable_ip (kernel/softirq.c:407)
netif_rx (net/core/dev.c:5648)
chan_recv_cb (net/bluetooth/6lowpan.c:294 net/bluetooth/6lowpan.c:359)
------38dCVE-2023-32501—20.1%
——6——CVE-2023-47238—20.1%
——6——CVE-2026-54306—20.1%
——6——CVE-2025-24217—20.1%
——6——CVE-2026-4957—20.1%
——6——CVE-2023-7292—20.1%
——6——CVE-2026-25932—20.1%
——6——CVE-2025-26269—20.1%
——6——CVE-2022-23546—20.1%
——6——CVE-2026-45002—20.1%
——6——CVE-2023-5633—20.1%
——6——CVE-2023-32739—20.1%
——6——CVE-2026-180497.5 HIG20.1%
——6The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not perform any capability or nonce check on one of its public endpoint actions and builds an option name from a client-supplied value without restricting it to its own options, allowing unauthenticated users to read the value of other autoloaded options whose names end in a matching suffix.11dCVE-2024-57175—20.1%
——6——CVE-2025-34066—20.1%
——6——CVE-2024-40648—20.1%
——6——CVE-2024-13666—20.1%
——6——CVE-2021-33367—20.1%
——6——CVE-2026-644448.1 HIG20.1%
——6In the Linux kernel, the following vulnerability has been resolved:
staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop
The IE parsing loop in OnAssocRsp() advances by (pIE->length + 2) each
iteration but only guards on i < pkt_len. When a malicious AP sends an
AssocResponse whose last IE has only one byte remaining in the frame
(the element_id byte lands at pkt_len-1), the loop reads pIE->length
from pframe[pkt_len], which is one byte past the allocated receive buffer.
Additionally, even when the header bytes are in bounds, pIE->length
itself can extend the data window beyond pkt_len, silently passing a
truncated IE to the handler functions.
Add two guards at the top of the loop body:
1. Break if fewer than sizeof(*pIE) bytes remain (can't read header).
2. Break if the IE's declared data extends past pkt_len.3dCVE-2026-610458.6 HIG20.1%
——6Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebCenter Sites accessible data as well as unauthorized update, insert or delete access to some of Oracle WebCenter Sites accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle WebCenter Sites. CVSS 3.1 Base Score 8.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L).17dCVE-2026-637524.3 MED20.1%
——6SurrealDB before 3.1.0 contains an authorization bypass vulnerability in the RELATE statement that allows authenticated users with CREATE permission to overwrite existing edge records without UPDATE permission. Attackers can issue a RELATE statement with a SET id clause pointing to an existing edge id, causing the storage layer to silently overwrite the target record instead of rejecting the operation.46dCVE-2022-43254—20.1%
——6——CVE-2024-6883—20.1%
——6——CVE-2026-152367.5 HIG20.1%
——6The Gallery for Google Photos WordPress plugin before 1.2.1 does not properly restrict access to the stored third-party OAuth credentials of the connected account, exposing the persistent access and refresh tokens to unauthenticated users and allowing long-term compromise of the linked account.11dCVE-2026-39869—20.1%
——6——CVE-2025-10996—20.1%
——6——CVE-2021-1454—20.1%
——6——CVE-2022-34669—20.1%
——6——CVE-2022-4895—20.1%
——6——