Vulnerabilities exploitable today
366,836in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,685
New KEV · 24H0
Exploit Today ≥ 701,629
Distribution · last window
- Critical2,374
- High9,657
- Medium5,454
- Low526
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2025-10197—15.9%
——5——CVE-2021-25657—15.9%
——5——CVE-2023-6029—15.9%
——5——CVE-2023-23516—15.9%
——5——CVE-2022-34471—15.9%
——5——CVE-2023-25411—15.9%
——5——CVE-2024-53101—15.9%
——5——CVE-2024-9066—15.9%
——5——CVE-2019-15338—15.9%
——5——CVE-2021-3042—15.9%
——5——CVE-2025-9203—15.9%
——5——CVE-2024-50048—15.9%
——5——CVE-2019-15387—15.9%
——5——CVE-2019-15336—15.9%
——5——CVE-2022-41294—15.9%
——5——CVE-2024-47385—15.9%
——5——CVE-2026-726727.7 HIG15.9%
——5The Elastic Security capability that suggests existing field values while a user authors endpoint policy artifacts queries Elastic Defend event data with Kibana's internal Elasticsearch account instead of the account of the requesting user. Only Kibana feature privileges are verified, and the caller's Elasticsearch index privileges are not. An authenticated user who holds Elastic Security feature privileges but no read access to the Elastic Defend event indices can therefore retrieve field values from that data, including process command line arguments, which commonly contain tokens, credentials, connection strings, and other sensitive operational detail from protected hosts.22hCVE-2019-15337—15.9%
——5——CVE-2026-42585—15.9%
——5——CVE-2026-478755.6 MED15.9%
——5Applications that deserialize execution contexts with Jackson2ExecutionContextStringSerializer are vulnerable to a deserialization attack if they use an untrusted data source for the job repository. The JobParameterDeserializer does not properly enforce the trusted-types allowlist, allowing an attacker to craft malicious input that can lead to arbitrary code execution, including known Jackson RCE gadgets.
Spring Batch 6.0.0 - 6.0.4
Spring Batch 5.2.0 - 5.2.618hCVE-2019-15332—15.9%
——5——CVE-2024-22892—15.9%
——5——CVE-2026-35062—15.9%
——5——CVE-2024-47390—15.9%
——5——CVE-2025-15369—15.9%
——5——CVE-2025-8007—15.9%
——5——CVE-2026-6611—15.9%
——5——CVE-2024-39560—15.9%
——5——CVE-2022-489817.8 HIG15.9%
——5In the Linux kernel, the following vulnerability has been resolved:
drm/shmem-helper: Remove errant put in error path
drm_gem_shmem_mmap() doesn't own this reference, resulting in the GEM
object getting prematurely freed leading to a later use-after-free.25dCVE-2019-15333—15.9%
——5——CVE-2023-38396—15.9%
——5——CVE-2024-269097.0 HIG15.9%
——5In the Linux kernel, the following vulnerability has been resolved:
soc: qcom: pmic_glink_altmode: fix drm bridge use-after-free
A recent DRM series purporting to simplify support for "transparent
bridges" and handling of probe deferrals ironically exposed a
use-after-free issue on pmic_glink_altmode probe deferral.
This has manifested itself as the display subsystem occasionally failing
to initialise and NULL-pointer dereferences during boot of machines like
the Lenovo ThinkPad X13s.
Specifically, the dp-hpd bridge is currently registered before all
resources have been acquired which means that it can also be
deregistered on probe deferrals.
In the meantime there is a race window where the new aux bridge driver
(or PHY driver previously) may have looked up the dp-hpd bridge and
stored a (non-reference-counted) pointer to the bridge which is about to
be deallocated.
When the display controller is later initialised, this triggers a
use-after-free when attaching the bridges:
dp -> aux -> dp-hpd (freed)
which may, for example, result in the freed bridge failing to attach:
[drm:drm_bridge_attach [drm]] *ERROR* failed to attach bridge /soc@0/phy@88eb000 to encoder TMDS-31: -16
or a NULL-pointer dereference:
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
...
Call trace:
drm_bridge_attach+0x70/0x1a8 [drm]
drm_aux_bridge_attach+0x24/0x38 [aux_bridge]
drm_bridge_attach+0x80/0x1a8 [drm]
dp_bridge_init+0xa8/0x15c [msm]
msm_dp_modeset_init+0x28/0xc4 [msm]
The DRM bridge implementation is clearly fragile and implicitly built on
the assumption that bridges may never go away. In this case, the fix is
to move the bridge registration in the pmic_glink_altmode driver to
after all resources have been looked up.
Incidentally, with the new dp-hpd bridge implementation, which registers
child devices, this is also a requirement due to a long-standing issue
in driver core that can otherwise lead to a probe deferral loop (see
commit fbc35b45f9f6 ("Add documentation on meaning of -EPROBE_DEFER")).
[DB: slightly fixed commit message by adding the word 'commit']25dCVE-2019-15334—15.9%
——5——CVE-2022-21494—15.9%
——5——CVE-2023-5718—15.9%
——5——CVE-2021-3041—15.9%
——5——CVE-2025-6221—15.9%
——5——CVE-2026-625075.3 MED15.9%
——5Vulnerability in the Oracle Time and Labor product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Time and Labor. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Time and Labor accessible data. CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N).32dCVE-2024-47632—15.9%
——5——CVE-2022-490257.8 HIG15.9%
——5In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e: Fix use-after-free when reverting termination table
When having multiple dests with termination tables and second one
or afterwards fails the driver reverts usage of term tables but
doesn't reset the assignment in attr->dests[num_vport_dests].termtbl
which case a use-after-free when releasing the rule.
Fix by resetting the assignment of termtbl to null.25d