Vulnerabilities exploitable today
365,633in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,682
New KEV · 24H0
Exploit Today ≥ 701,626
Distribution · last window
- Critical2,365
- High10,107
- Medium5,006
- Low469
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2024-46325—14.8%
——4——CVE-2025-24261—14.8%
——4——CVE-2025-15583—14.8%
——4——CVE-2025-62122—14.8%
——4——CVE-2026-543866.1 MED14.8%
——4marimo before 0.23.9 contains a reflected cross-site scripting vulnerability in the notebook page that allows unauthenticated attackers to inject arbitrary JavaScript by exploiting improper escaping of single quotes in the file query parameter reflected into an inline JavaScript string literal. Attackers can craft a malicious link with a payload beginning with __new__ to bypass the 404 check and inject JavaScript into the page, which executes without Content-Security-Policy restrictions in the origin of a victim's marimo server.44dCVE-2026-25060—14.8%
——4——CVE-2024-43871—14.8%
——4——CVE-2026-477415.9 MED14.8%
——4Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, CreateOrderFromCartAction::execute previously created the Order row before checking and incrementing the discount's total_use counter. Under concurrent checkout pressure (Black Friday, flash sale, viral coupon), the global usage_limit was silently exceeded: orders were committed with the discount fully applied to price_amount while the counter blocked at usage_limit. The merchant had no signal that an over-redemption had occurred. This vulnerability is fixed in 2.8.0.37dCVE-2025-7942—14.8%
——4——CVE-2022-0354—14.8%
——4——CVE-2025-8079—14.8%
——4——CVE-2024-7018—14.8%
——4——CVE-2026-40825—14.8%
——4——CVE-2024-35965—14.8%
——4——CVE-2025-3867—14.8%
——4——CVE-2026-5253—14.8%
——4——CVE-2026-7924—14.8%
——4——CVE-2025-25944—14.8%
——4——CVE-2026-65986—14.8%
——4CVAT is an open source interactive video and image annotation tool for computer vision. Versions 2.5.0 through 2.66.0 contain a XSS vulnerability that can be accessed through annotation guide assets. When CVAT serves the files attached to an annotation guide, it labels them with a media type ( Content-Type ) that the attacker can influence, so instead of treating an uploaded file as plain data, the victim's browser can be told to treat it as an HTML page and run any JavaScript inside it. This issue has been fixed in version 2.67.0.22dCVE-2025-22641—14.8%
——4——CVE-2023-0520—14.8%
——4——CVE-2025-23189—14.8%
——4——CVE-2025-49491—14.8%
——4——CVE-2026-40824—14.8%
——4——CVE-2021-472408.4 HIG14.8%
——4In the Linux kernel, the following vulnerability has been resolved:
net: qrtr: fix OOB Read in qrtr_endpoint_post
Syzbot reported slab-out-of-bounds Read in
qrtr_endpoint_post. The problem was in wrong
_size_ type:
if (len != ALIGN(size, 4) + hdrlen)
goto err;
If size from qrtr_hdr is 4294967293 (0xfffffffd), the result of
ALIGN(size, 4) will be 0. In case of len == hdrlen and size == 4294967293
in header this check won't fail and
skb_put_data(skb, data + hdrlen, size);
will read out of bound from data, which is hdrlen allocated block.23dCVE-2023-34350—14.8%
——4——CVE-2026-40823—14.8%
——4——CVE-2025-69364—14.8%
——4——CVE-2025-44906—14.8%
——4——CVE-2025-40977—14.8%
——4——CVE-2026-45054—14.8%
——4——CVE-2025-7408—14.8%
——4——CVE-2026-33303—14.8%
——4——CVE-2024-44960—14.8%
——4——CVE-2021-26340—14.8%
——4——CVE-2026-7982—14.8%
——4——CVE-2025-13249—14.8%
——4——CVE-2023-23535—14.8%
——4——CVE-2026-124914.8 MED14.8%
——4A flaw was found in vLLM, an open-source library for large language model inference. This vulnerability arises from improper handling of image metadata, specifically EXIF orientation and PNG transparency (tRNS) data, during image processing. When images are converted to RGB, transparency information may be implicitly discarded or remapped, leading to unexpected rendering of transparent pixels and distortion of input content. This can result in the model misinterpreting image content, potentially affecting the integrity of processed data.51dCVE-2025-40976—14.8%
——4——