Vulnerabilities exploitable today
367,165in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,685
New KEV · 24H0
Exploit Today ≥ 701,629
Distribution · last window
- Critical2,263
- High9,269
- Medium5,274
- Low508
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-559905.9 MED17.1%
——5In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, when the 'dnscrypt:' clause lists more 'dnscrypt-provider-cert:' files than there are matching 'dnscrypt-secret-key:' files, Unbound fills only the matched prefix and leaves the tail slots at the '0xdb' fill that libsodium's allocator writes into every allocation. Unbound would then iterate over the number of cert files, not the actual slots, so it walks into a slot with garbage data filled with '0xdb' bytes. Any unauthenticated client that sends one UDP datagram of ≥ 68 bytes whose first 8 bytes are '0xdb' to 'dnscrypt-port' will use that garbage entry which leads to a garbage dereference killing the server. This is a silent faulty configuration that goes unnoticed until triggered with the right client query. Unbound needs to be compiled with DNSCrypt support ('--enable-dnscrypt').38dCVE-2025-1560—17.1%
——5——CVE-2025-46259—17.1%
——5——CVE-2025-46718—17.1%
——5——CVE-2025-47487—17.1%
——5——CVE-2026-637257.2 HIG17.1%
——5sysPass's FileBackupService::doBackupFiles() in lib/SP/Services/Backup/FileBackupService.php around line 388 builds a tar shell command by string-concatenating the backup directory path $this->path directly into the command line ('tar czf ' . $backupFileApp . ' ' . BASE_PATH . ' --exclude \"' . $this->path . '\" 2>&1') and passes the result to PHP's exec() with no application of escapeshellarg() and no validation of the path against a safe character set. The $this->path value is read from the sysPass configuration, which is persisted in the database and writable through the admin settings API and the admin UI. An administrator (or an attacker who has obtained an admin API token or admin session) can therefore store a backup path containing shell metacharacters and trigger a backup operation to execute arbitrary OS commands as the web server process user (typically www-data or apache). Because sysPass is a password manager whose sole purpose is to hold credentials for other systems, code execution as the web-server user permits reading sysPass's master password and encryption key from memory or configuration files, decrypting every stored credential in the database, exporting the entire password vault, pivoting to internal systems using the disclosed credentials, and installing persistent backdoors on the password-manager host.24dCVE-2024-1814—17.1%
——5——CVE-2026-3819—17.1%
——5——CVE-2025-6660—17.1%
——5——CVE-2025-44593—17.1%
——5——CVE-2026-78103—17.1%
——5WatchGuard Dimension provides a client-side lock/unlock UI control for management changes. The server-side configuration endpoint does not enforce this lock/unlock workflow state, allowing an authenticated administrator to submit configuration changes directly to the endpoint without first completing the UI unlock step. This allows an authenticated read-write administrator session to bypass the intended editing workflow and overwrite configuration changes being made by another concurrent administrator session.3dCVE-2024-5141—17.1%
——5——CVE-2021-36915—17.1%
——5——CVE-2026-42886—17.1%
——5——CVE-2025-52896—17.1%
——5——CVE-2025-62421—17.1%
——5——CVE-2025-1437—17.1%
——5——CVE-2026-689676.5 MED17.1%
——5Bendix EC80 Brake ECU is vulnerable to an out-of-bounds write, which could allow an attacker
to deliver a payload that could establish an arbitrary write primitive,
which could crash the ECU.3dCVE-2026-53437.4 HIG17.1%
——5Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal SAML SSO - Service Provider allows Privilege Escalation.
This issue affects SAML SSO - Service Provider: from 0.0.0 before 3.1.4.41dCVE-2023-6745—17.1%
——5——CVE-2020-1985—17.1%
——5——CVE-2025-1300—17.1%
——5——CVE-2025-32305—17.1%
——5——CVE-2025-13480—17.1%
——5——CVE-2006-6730—17.1%
——5——CVE-2025-47477—17.1%
——5——CVE-2026-134157.2 HIG17.1%
——5The CMP WordPress plugin before 4.1.18 does not enforce an option-name allow-list when importing settings via one of its AJAX actions, allowing users with the Editor role (when the administrator has granted the Editor role access to the CMP WordPress plugin before 4.1.18's admin-bar controls) to update arbitrary WordPress options, including options that lead to privilege escalation to Administrator.3dCVE-2026-2840—17.1%
——5——CVE-2018-11856—17.1%
——5——CVE-2024-48442—17.1%
——5——CVE-2020-13593—17.1%
——5——CVE-2024-5342—17.1%
——5——CVE-2025-0627—17.1%
——5——CVE-2025-31638—17.1%
——5——CVE-2020-7515—17.1%
——5——CVE-2025-4894—17.1%
——5——CVE-2022-34892—17.1%
——5——CVE-2026-48969—17.1%
——5——CVE-2026-564445.9 MED17.1%
——5In NLnet Labs Unbound 1.20.0 up to and including 1.25.1, when Unbound is configured with 'serve-expired: yes' and 'serve-expired-client-timeout > discard-timeout > 0' (contrary to the suggested values), the discard-timeout branch during the serve expired logic drops an aged client reply without performing the correct accounting for the number of reply addresses for the query. Other identical branches outside of serve expired perform the correct decrement. Since the counter is never decremented in such scenario, it can reach the maximum limit and new clients for duplicate in-flight queries are silently dropped resulting in degradation of resolution service. A malicious actor can exploit the vulnerability by querying the resolver for a client-controlled slow-on-demand authoritative zone that can drive the counter past the threshold. Shipped defaults for 'serve-expired-client-timeout: 1800' and 'discard-timeout: 1900' make the branch unreachable.38dCVE-2025-40801—17.1%
——5——