Vulnerabilities exploitable today
367,851in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,687
New KEV · 24H0
Exploit Today ≥ 701,629
Distribution · last window
- Critical2,393
- High9,631
- Medium5,587
- Low548
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-485787.9 HIG18.6%
——6Improper access control in Windows Secure Boot allows an authorized attacker to elevate privileges locally.41dCVE-2024-48704—18.6%
——6——CVE-2026-48843—18.6%
——6——CVE-2024-36788—18.6%
——6——CVE-2023-44204—18.6%
——6——CVE-2025-48095—18.6%
——6——CVE-2024-11789—18.6%
——6——CVE-2025-29690—18.6%
——6——CVE-2024-47420—18.6%
——6——CVE-2024-47444—18.6%
——6——CVE-2024-23231—18.6%
——6——CVE-2025-8740—18.6%
——6——CVE-2024-21974—18.6%
——6——CVE-2026-23847—18.6%
——6——CVE-2023-28072—18.6%
——6——CVE-2024-37348—18.6%
——6——CVE-2026-792308.8 HIG18.6%
——6Improper input validation in ANGLE in Google Chrome on on Mac prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)1dCVE-2020-124004.7 MED18.6%
——6When converting coordinates from projective to affine, the modular inversion was not performed in constant time, resulting in a possible timing-based side channel attack. This vulnerability affects Firefox < 80 and Firefox for Android < 80.14dCVE-2025-6920—18.6%
——6——CVE-2024-47419—18.6%
——6——CVE-2026-9792—18.6%
——6——CVE-2026-35219—18.6%
——6Budibase is an open-source low-code platform. Prior to 3.41.3, automation steps in packages/server/src/automations/steps/outgoingWebhook.ts, packages/server/src/automations/steps/zapier.ts, packages/server/src/automations/steps/n8n.ts, packages/server/src/automations/steps/slack.ts, and packages/server/src/automations/steps/discord.ts use node-fetch on user-provided URLs without the BLACKLIST_IPS enforcement used by the REST integration, allowing an authenticated user to make server-side requests to cloud metadata and internal services. This issue is fixed in version 3.41.3.15dCVE-2026-3214—18.6%
——6——CVE-2024-47445—18.6%
——6——CVE-2026-217175.9 MED18.6%
——6A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash collisions trivially predictable. By crafting a request that causes many such collisions in V8's internal string table, an attacker can significantly degrade performance of the Node.js process.
The most common trigger is any endpoint that calls `JSON.parse()` on attacker-controlled input, as JSON parsing automatically internalizes short strings into the affected hash table.
This vulnerability affects **20.x, 22.x, 24.x, and 25.x**.14dCVE-2024-21975—18.6%
——6——CVE-2020-27925—18.6%
——6——CVE-2024-11799—18.6%
——6——CVE-2023-37220—18.6%
——6——CVE-2026-550644.3 MED18.6%
——6Vikunja is an open-source self-hosted task management platform. From 2.3.0 until 2.4.0, a user with Write but not Admin permission on a shared child project can detach it from its parent hierarchy by submitting parent_project_id equal to 0 to POST /api/v1/projects/{project}. The Project.CanUpdate authorization check in pkg/models/project_permissions.go and UpdateProject logic in pkg/models/project.go only gate nonzero parent values, while UpdateProject always persists parent_project_id, so the explicit zero value bypasses the Admin requirement introduced for CVE-2026-35595. Detachment severs the recursive permission-inheritance chain and can disrupt the owner’s hierarchy and inherited collaborator access. This issue is fixed in version 2.4.0.4dCVE-2024-10847—18.6%
——6——CVE-2024-41872—18.6%
——6——CVE-2024-37347—18.6%
——6——CVE-2024-41029—18.6%
——6——CVE-2024-40743—18.6%
——6——CVE-2025-46537—18.6%
——6——CVE-2024-41870—18.6%
——6——CVE-2020-7583—18.6%
——6——CVE-2024-37344—18.6%
——6——CVE-2024-53738—18.6%
——6——