Vulnerabilities exploitable today
367,851in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,687
New KEV · 24H0
Exploit Today ≥ 701,629
Distribution · last window
- Critical2,393
- High9,631
- Medium5,587
- Low548
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2025-66633—18.6%
——6——CVE-2025-66617—18.6%
——6——CVE-2026-82722—18.6%
——6Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash_admin lets any client that can reach the admin LiveView exhaust the BEAM atom table and crash the entire node.
Two LiveView event handlers interned atoms from unvalidated client input: AshAdmin.PageLive's set_actor built modules from the resource/domain payload with Module.concat/1, and AshAdmin.Components.Resource.Show's calculate converted every submitted form key with String.to_atom/1. Atoms are never garbage collected and the table is capped, so flooding either event with random names mints a new atom per request until the VM aborts, taking down every application on the node. The fix resolves the submitted resource/domain against the known shown resources and maps calculation keys to declared arguments, so no client-supplied string is interned.
This issue affects ash_admin: from 0.1.0 before 1.3.1.8hCVE-2024-6412—18.6%
——6——CVE-2025-53570—18.6%
——6——CVE-2025-2020—18.6%
——6——CVE-2025-41116—18.6%
——6——CVE-2024-54451—18.6%
——6——CVE-2023-45147—18.6%
——6——CVE-2025-66000—18.6%
——6——CVE-2024-13246—18.6%
——6——CVE-2024-11787—18.6%
——6——CVE-2026-32299—18.6%
——6——CVE-2009-2387—18.6%
——6——CVE-2026-23796—18.6%
——6——CVE-2018-25319—18.6%
——6——CVE-2025-6212—18.6%
——6——CVE-2025-66026—18.6%
——6——CVE-2024-11792—18.6%
——6——CVE-2022-503509.8 CRI18.6%
——6In the Linux kernel, the following vulnerability has been resolved:
scsi: target: iscsi: Fix a race condition between login_work and the login thread
In case a malicious initiator sends some random data immediately after a
login PDU; the iscsi_target_sk_data_ready() callback will schedule the
login_work and, at the same time, the negotiation may end without clearing
the LOGIN_FLAGS_INITIAL_PDU flag (because no additional PDU exchanges are
required to complete the login).
The login has been completed but the login_work function will find the
LOGIN_FLAGS_INITIAL_PDU flag set and will never stop from rescheduling
itself; at this point, if the initiator drops the connection, the
iscsit_conn structure will be freed, login_work will dereference a released
socket structure and the kernel crashes.
BUG: kernel NULL pointer dereference, address: 0000000000000230
PF: supervisor write access in kernel mode
PF: error_code(0x0002) - not-present page
Workqueue: events iscsi_target_do_login_rx [iscsi_target_mod]
RIP: 0010:_raw_read_lock_bh+0x15/0x30
Call trace:
iscsi_target_do_login_rx+0x75/0x3f0 [iscsi_target_mod]
process_one_work+0x1e8/0x3c0
Fix this bug by forcing login_work to stop after the login has been
completed and the socket callbacks have been restored.
Add a comment to clearify the return values of iscsi_target_do_login()29dCVE-2021-27616—18.6%
——6——CVE-2025-7902—18.6%
——6——CVE-2024-1760—18.6%
——6——CVE-2026-739146.5 MED18.6%
——6Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions that are affected are 4.0.0-4.4.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Helidon accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Helidon. CVSS 3.1 Base Score 6.5 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L).4dCVE-2025-49912—18.6%
——6——CVE-2025-30463—18.6%
——6——CVE-2026-0678—18.6%
——6——CVE-2026-39936—18.6%
——6Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Score Extension allows Cross-Site Scripting (XSS). The issue has been remediated on the `master` branch, and in the release branches for MediaWiki versions 1.43, 1.44, and 1.45.42dCVE-2024-11791—18.6%
——6——CVE-2025-54196—18.6%
——6——CVE-2025-46440—18.6%
——6——CVE-2026-535246.5 MED18.6%
——6WeeChat (Wee Enhanced Environment for Chat) is a free chat client. In versions 4.3.0 through 4.9.0, the WeeChat relay module's WebSocket permessage-deflate decompression function relay_websocket_inflate() has no upper bound on output size. An authenticated relay user can send a small compressed WebSocket frame (~100 bytes) that decompresses to gigabytes, exhausting all server memory and crashing the entire WeeChat process. The api protocol enables permessage-deflate and requires authentication before WebSocket upgrade. Version 4.9.1 patches the issue.8dCVE-2021-30668—18.6%
——6——CVE-2023-45799—18.6%
——6——CVE-2026-41016—18.6%
——6——CVE-2023-23119—18.6%
——6——CVE-2026-7393—18.6%
——6——CVE-2026-2900—18.6%
——6——CVE-2024-47420—18.6%
——6——CVE-2023-44204—18.6%
——6——