Vulnerabilities exploitable today
369,233in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,695
New KEV · 24H0
Exploit Today ≥ 701,636
Distribution · last window
- Critical2,152
- High7,669
- Medium5,612
- Low537
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2025-68433—19.9%
——6——CVE-2025-3458—19.9%
——6——CVE-2025-22692—19.9%
——6——CVE-2024-43986—19.9%
——6——CVE-2025-9940—19.9%
——6——CVE-2025-2892—19.9%
——6——CVE-2025-23448—19.9%
——6——CVE-2025-22565—19.9%
——6——CVE-2026-4284—19.9%
——6——CVE-2025-8994—19.9%
——6——CVE-2025-3457—19.9%
——6——CVE-2026-55854—19.9%
——6——CVE-2026-545927.5 HIG19.9%
——6Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.3, Oj::Doc#each_child, when invoked recursively over a deeply nested JSON document, overflows a fixed-size stack buffer and aborts the process, leading to DoS. In a two-step chain in ext/oj/fast.c, doc_each_child increments doc->where past the where_path[MAX_STACK = 100] array with no bounds check and never restores it (the doc->where-- is missing), so calling each_child recursively from inside the yield block drives doc->where beyond the array. On the next entry the function copies the path into the 800-byte stack-local buffer save_path[MAX_STACK] using wlen = doc->where - doc->where_path, so when the previous recursive call left doc->where past where_path[100] the wlen exceeds MAX_STACK and the memcpy overflows save_path on the C stack; because the Oj::Doc parser imposes no JSON nesting-depth limit (relying on a C-stack pressure check), deeply nested attacker input reaches this path. This issue has been fixed in version 3.17.3.66dCVE-2026-613567.8 HIG19.9%
——6Missing authentication for critical function in Windows Remote Desktop Services allows an authorized attacker to elevate privileges locally.20dCVE-2026-133618.8 HIG19.9%
——6IBM Informix oninit sq_sgkprepare RCE via unchecked SQL Interface length field.18dCVE-2025-22796—19.9%
——6——CVE-2023-533338.2 HIG19.9%
——6In the Linux kernel, the following vulnerability has been resolved:
netfilter: conntrack: dccp: copy entire header to stack buffer, not just basic one
Eric Dumazet says:
nf_conntrack_dccp_packet() has an unique:
dh = skb_header_pointer(skb, dataoff, sizeof(_dh), &_dh);
And nothing more is 'pulled' from the packet, depending on the content.
dh->dccph_doff, and/or dh->dccph_x ...)
So dccp_ack_seq() is happily reading stuff past the _dh buffer.
BUG: KASAN: stack-out-of-bounds in nf_conntrack_dccp_packet+0x1134/0x11c0
Read of size 4 at addr ffff000128f66e0c by task syz-executor.2/29371
[..]
Fix this by increasing the stack buffer to also include room for
the extra sequence numbers and all the known dccp packet type headers,
then pull again after the initial validation of the basic header.
While at it, mark packets invalid that lack 48bit sequence bit but
where RFC says the type MUST use them.
Compile tested only.
v2: first skb_header_pointer() now needs to adjust the size to
only pull the generic header. (Eric)
Heads-up: I intend to remove dccp conntrack support later this year.33dCVE-2025-5239—19.9%
——6——CVE-2024-24769—19.9%
——6——CVE-2026-30854—19.9%
——6——CVE-2022-48219—19.9%
——6——CVE-2024-43780—19.9%
——6——CVE-2024-47826—19.9%
——6——CVE-2025-1922—19.9%
——6——CVE-2022-48220—19.9%
——6——CVE-2022-3895—19.9%
——6——CVE-2025-9234—19.9%
——6——CVE-2022-48627—19.9%
——6——CVE-2025-52880—19.9%
——6——CVE-2022-29549—19.9%
——6——CVE-2026-20746—19.9%
——6Virtual attribute handling in Ping Identity PingDirectory in affected versions allows only authorized users to exhaust java memory heap when recent login history is enabled and copying virtual attributes that reference ds-privilege-name values.8dCVE-2025-49725—19.9%
——6——CVE-2026-73220—19.9%
——6CVAT is an open source interactive video and image annotation tool for computer vision. From 2.68.0 until 2.70.0, the audio-task annotation guide renderer in cvat-ui/src/audio/components/annotation-page/audio-workspace/top-bar/audio-right-group.tsx passes attacker-controlled guide Markdown to MDEditor without the rehype-sanitize plugin. A user who can create or edit an annotation guide can store malicious JavaScript that executes when another user opens the guide. The script can issue arbitrary CVAT requests with the victim user's privileges. This issue is fixed in version 2.70.0.16dCVE-2025-10096—19.9%
——6——CVE-2025-68432—19.9%
——6——CVE-2025-8962—19.9%
——6——CVE-2025-27420—19.9%
——6——CVE-2025-9845—19.9%
——6——CVE-2024-3827—19.9%
——6——CVE-2025-23443—19.9%
——6——