Vulnerabilities exploitable today
366,910in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,685
New KEV · 24H0
Exploit Today ≥ 701,629
Distribution · last window
- Critical2,295
- High9,352
- Medium5,308
- Low510
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2024-57922—16.8%
——5——CVE-2025-22719—16.8%
——5——CVE-2025-22320—16.8%
——5——CVE-2025-24608—16.8%
——5——CVE-2026-24804—16.8%
——5——CVE-2026-44700—16.8%
——5——CVE-2025-10080—16.8%
——5——CVE-2026-63365.3 MED16.8%
——5GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.6 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an unauthorized user to view project import source information due to a missing authorization check.27dCVE-2025-23733—16.8%
——5——CVE-2018-9365—16.8%
——5——CVE-2024-468127.8 HIG16.8%
——5In the Linux kernel, the following vulnerability has been resolved:
drm/amd/display: Skip inactive planes within ModeSupportAndSystemConfiguration
[Why]
Coverity reports Memory - illegal accesses.
[How]
Skip inactive planes.26dCVE-2025-55661—16.8%
——5——CVE-2025-20760—16.8%
——5——CVE-2024-36437—16.8%
——5——CVE-2026-640108.8 HIG16.8%
——5In the Linux kernel, the following vulnerability has been resolved:
nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc()
A race condition exists in the NFC LLCP connection state machine where
the connection acceptance packet (CC) can be processed concurrently with
socket release. This can lead to a use-after-free of the socket object.
When nfc_llcp_recv_cc() moves the socket from the connecting_sockets
list to the sockets list, it does so without holding the socket lock.
If llcp_sock_release() is executing concurrently, it might have already
unlinked the socket and dropped its references, which can result in
nfc_llcp_recv_cc() linking a freed socket into the live list.
Fix this by holding lock_sock() during the state transition and list
movement in nfc_llcp_recv_cc(). After acquiring the lock, check if
the socket is still hashed to ensure it hasn't already been unlinked
and marked for destruction by the release path. This aligns the locking
pattern with recv_hdlc() and recv_disc().31dCVE-2026-6504—16.8%
——5——CVE-2026-640968.8 HIG16.8%
——5In the Linux kernel, the following vulnerability has been resolved:
batman-adv: mcast: fix use-after-free in orig_node RCU release
batadv_mcast_purge_orig() removes entries from RCU-protected hlists but
does not wait for an RCU grace period before returning. Concurrent RCU
readers may still accesses references to those entries at the point of
removal. RCU-protected readers trying to operate on entries like
orig->mcast_want_all_ipv6_node will then access already freed memory.
Fix this by moving batadv_mcast_purge_orig() to batadv_orig_node_release(),
just before the call_rcu() invocation. This ensures RCU readers that were
active at purge time have drained before the orig_node memory is reclaimed.19dCVE-2026-23476—16.8%
——5——CVE-2025-59278—16.8%
——5——CVE-2025-68882—16.8%
——5——CVE-2025-24635—16.8%
——5——CVE-2023-50345—16.8%
——5——CVE-2025-22358—16.8%
——5——CVE-2025-23725—16.8%
——5——CVE-2026-33882—16.8%
——5——CVE-2025-22326—16.8%
——5——CVE-2025-59275—16.8%
——5——CVE-2026-313938.1 HIG16.8%
——5In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access
l2cap_information_rsp() checks that cmd_len covers the fixed
l2cap_info_rsp header (type + result, 4 bytes) but then reads
rsp->data without verifying that the payload is present:
- L2CAP_IT_FEAT_MASK calls get_unaligned_le32(rsp->data), which reads
4 bytes past the header (needs cmd_len >= 8).
- L2CAP_IT_FIXED_CHAN reads rsp->data[0], 1 byte past the header
(needs cmd_len >= 5).
A truncated L2CAP_INFO_RSP with result == L2CAP_IR_SUCCESS triggers an
out-of-bounds read of adjacent skb data.
Guard each data access with the required payload length check. If the
payload is too short, skip the read and let the state machine complete
with safe defaults (feat_mask and remote_fixed_chan remain zero from
kzalloc), so the info timer cleanup and l2cap_conn_start() still run
and the connection is not stalled.36dCVE-2025-55652—16.8%
——5——CVE-2024-7864—16.8%
——5——CVE-2023-52368—16.8%
——5——CVE-2025-23730—16.8%
——5——CVE-2025-55660—16.8%
——5——CVE-2026-129848.2 HIG16.8%
——5Insufficiently Protected Credentials vulnerability in Zyxel Networks WAH7601 allows Retrieve Embedded Sensitive Data.
This issue affects WAH7601: through 20072026.4dCVE-2020-14105—16.8%
——5——CVE-2022-38777—16.8%
——5——CVE-2026-164199.6 CRI16.8%
——5Out of bounds read and write in ANGLE in Google Chrome on Android prior to 150.0.7871.182 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)37dCVE-2024-268087.8 HIG16.8%
——5In the Linux kernel, the following vulnerability has been resolved:
netfilter: nft_chain_filter: handle NETDEV_UNREGISTER for inet/ingress basechain
Remove netdevice from inet/ingress basechain in case NETDEV_UNREGISTER
event is reported, otherwise a stale reference to netdevice remains in
the hook list.26dCVE-2024-56634—16.8%
——5——CVE-2025-23544—16.8%
——5——