Vulnerabilities exploitable today
366,901in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,685
New KEV · 24H0
Exploit Today ≥ 701,629
Distribution · last window
- Critical2,296
- High9,357
- Medium5,292
- Low508
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-7083—16.5%
——5——CVE-2026-66913—16.5%
——5Lookyloo did not enforce limits on the decompressed size of uploaded capture archives and compressed HAR files.
An attacker could submit a specially crafted ZIP, gzip, or zlib-compressed capture containing data that expands to a very large size during processing. Because the application decompressed this content directly in memory without first limiting the output size, processing the malicious capture could exhaust available memory, terminate a web or worker process, or make the Lookyloo instance unavailable.
The vulnerability affects both full Lookyloo capture archive imports and API submissions containing gzip-compressed HAR data. Repeated exploitation could cause a persistent denial-of-service condition until the affected processes or instance are restarted.
The patch introduces:
* A 1 GB cumulative uncompressed-size limit for imported capture archives.
* Size-limited gzip and zlib decompression for compressed HAR files.
* Explicit detection and handling of suspected zip bombs.
* An HTTP 400 response when an oversized compressed HAR file is submitted through the API.30dCVE-2024-0454—16.5%
——5——CVE-2026-4445—16.5%
——5——CVE-2026-4460—16.5%
——5——CVE-2026-24977—16.5%
——5——CVE-2026-674394.3 MED16.5%
——5OliveTin gives safe and simple access to predefined shell commands from a web interface. Prior to 3000.17.0, the service/internal/api/api.go StartActionAndWait and StartActionByGetAndWait endpoints return full LogEntry output after execution without enforcing the logs permission, allowing a user with exec permission but logs:false to read action output. This issue is fixed in version 3000.17.0.30dCVE-2026-5148—16.5%
——5——CVE-2022-24986—16.5%
——5——CVE-2026-37540—16.5%
——5——CVE-2026-6978—16.5%
——5——CVE-2025-31697—16.5%
——5——CVE-2025-58107—16.5%
——5——CVE-2021-26326—16.5%
——5——CVE-2025-0985—16.5%
——5——CVE-2024-56260—16.5%
——5——CVE-2022-48949—16.5%
——5——CVE-2016-4443—16.5%
——5——CVE-2025-9453—16.5%
——5——CVE-2026-269613.7 LOW16.5%
——5Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Multipart::Parser extracts the boundary parameter from multipart/form-data using a greedy regular expression. When a Content-Type header contains multiple boundary parameters, Rack selects the last one rather than the first. In deployments where an upstream proxy, WAF, or intermediary interprets the first boundary parameter, this mismatch can allow an attacker to smuggle multipart content past upstream inspection and have Rack parse a different body structure than the intermediary validated. This issue has been patched in versions 2.2.23, 3.1.21, and 3.2.6.36dCVE-2026-35445—16.5%
——5Winter CMS is a content management system built on the Laravel PHP framework. In versions prior to 1.2.13, the backend did not validate the handler name submitted through the form postback _handler POST field, allowing an authenticated backend user to invoke arbitrary controller methods, including protected, private, and action-prefixed ones. While AJAX requests validate that handler names match the on[A-Z][\w+]* pattern, the postback path passed the submitted _handler value straight to the handler dispatcher with no such check, so any controller that exposes a public action or conditionally relaxes its $requiredPermissions check could be reached, bypassing the roles and permissions system. The built-in Users controller was affected because it set $requiredPermissions to null for the myaccount action, letting any authenticated backend user invoke user-management methods such as update_onDelete and update_onManualPasswordReset without holding the backend.manage_users permission. This issue is fixed in version 1.2.13.3dCVE-2025-10898—16.5%
——5——CVE-2024-46689—16.5%
——5——CVE-2024-8540—16.5%
——5——CVE-2026-27039—16.5%
——5——CVE-2026-42749—16.5%
——5——CVE-2025-10889—16.5%
——5——CVE-2025-31751—16.5%
——5——CVE-2025-20330—16.5%
——5——CVE-2025-9454—16.5%
——5——CVE-2026-25486—16.5%
——5——CVE-2026-34981—16.5%
——5——CVE-2026-74767—16.5%
——5Pandora contains a denial-of-service vulnerability in its handling of DAA (Direct Access Archive) files. When extracting the internal ISO image from a DAA archive, compressed chunks were decompressed using zlib.decompress() without enforcing a limit on the resulting uncompressed data.
An attacker able to submit a crafted DAA file containing highly compressed data could cause Pandora to decompress a relatively small input into a very large amount of data in memory. Because the decompressed chunks are accumulated to construct the internal ISO image, this could result in excessive memory consumption and potentially CPU exhaustion, causing the extraction worker to become unresponsive, terminate, or affect the availability of the Pandora service.
The patch introduces bounded decompression using decompressobj().decompress() with max_extracted_filesize, verifies the cumulative size of decompressed chunks, and raises a dedicated ZipBomb exception when the configured limit is exceeded. Pandora then aborts extraction and reports the file as too large.3dCVE-2018-7929—16.5%
——5——CVE-2026-26188—16.5%
——5——CVE-2025-57310—16.5%
——5——CVE-2026-469364.4 MED16.5%
——5Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).33dCVE-2025-9460—16.5%
——5——CVE-2025-10340—16.5%
——5——CVE-2024-54514—16.5%
——5——