Vulnerabilities exploitable today
365,446in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,682
New KEV · 24H0
Exploit Today ≥ 701,626
Distribution · last window
- Critical2,337
- High9,996
- Medium4,921
- Low461
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2024-54116—14.3%
——4——CVE-2023-432788.8 HIG14.4%
——4A Cross-Site Request Forgery (CSRF) in admin_manager.php of Seacms up to v12.8 allows attackers to arbitrarily add an admin account.50dCVE-2024-49961—14.4%
——4——CVE-2022-48958—14.4%
——4——CVE-2025-2861—14.4%
——4——CVE-2024-41089—14.4%
——4——CVE-2025-58251—14.4%
——4——CVE-2025-216647.8 HIG14.4%
——4In the Linux kernel, the following vulnerability has been resolved:
dm thin: make get_first_thin use rcu-safe list first function
The documentation in rculist.h explains the absence of list_empty_rcu()
and cautions programmers against relying on a list_empty() ->
list_first() sequence in RCU safe code. This is because each of these
functions performs its own READ_ONCE() of the list head. This can lead
to a situation where the list_empty() sees a valid list entry, but the
subsequent list_first() sees a different view of list head state after a
modification.
In the case of dm-thin, this author had a production box crash from a GP
fault in the process_deferred_bios path. This function saw a valid list
head in get_first_thin() but when it subsequently dereferenced that and
turned it into a thin_c, it got the inside of the struct pool, since the
list was now empty and referring to itself. The kernel on which this
occurred printed both a warning about a refcount_t being saturated, and
a UBSAN error for an out-of-bounds cpuid access in the queued spinlock,
prior to the fault itself. When the resulting kdump was examined, it
was possible to see another thread patiently waiting in thin_dtr's
synchronize_rcu.
The thin_dtr call managed to pull the thin_c out of the active thins
list (and have it be the last entry in the active_thins list) at just
the wrong moment which lead to this crash.
Fortunately, the fix here is straight forward. Switch get_first_thin()
function to use list_first_or_null_rcu() which performs just a single
READ_ONCE() and returns NULL if the list is already empty.
This was run against the devicemapper test suite's thin-provisioning
suites for delete and suspend and no regressions were observed.28dCVE-2020-10746—14.4%
——4——CVE-2026-186366.8 MED14.4%
——4The Velociraptor gRPC API has a VFSGetBuffer endpoint which allows reading files from the datastore. To prevent users from reading sensitive files or accessing other orgs, the requested path is prefix checked against a list of denied prefixes. This prefix check can be bypassed allowing a user to access usually denied files. If the user has read permission in the ROOT org, this allows access to other orgs, in which the user may not have permission.16dCVE-2024-45468—14.4%
——4——CVE-2021-22781—14.4%
——4——CVE-2024-50000—14.4%
——4——CVE-2024-5569—14.4%
——4——CVE-2025-30304—14.4%
——4——CVE-2025-53343—14.4%
——4——CVE-2024-53878—14.4%
——4——CVE-2021-33715—14.4%
——4——CVE-2026-139844.3 MED14.4%
——4Incorrect security UI in TabStrip in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)56dCVE-2025-49052—14.4%
——4——CVE-2024-53131—14.4%
——4——CVE-2024-50093—14.4%
——4——CVE-2025-59551—14.4%
——4——CVE-2026-6863—14.4%
——4——CVE-2025-9720—14.4%
——4——CVE-2024-13071—14.4%
——4——CVE-2026-414558.5 HIG14.4%
——4WeKan before 8.35 contains a server-side request forgery vulnerability in webhook integration URL handling where the URL scheme field accepts any string without protocol restriction or destination validation. Attackers who can create or modify integrations can set webhook URLs to internal network addresses, causing the server to issue HTTP POST requests to attacker-controlled internal targets with full board event payloads, and can additionally exploit response handling to overwrite arbitrary comment text without authorization checks.44dCVE-2023-52803—14.4%
——4——CVE-2025-58594—14.4%
——4——CVE-2025-58817—14.4%
——4——CVE-2024-50121—14.4%
——4——CVE-2025-61583—14.4%
——4——CVE-2025-58664—14.4%
——4——CVE-2025-58622—14.4%
——4——CVE-2025-63043—14.4%
——4——CVE-2026-3553—14.4%
——4——CVE-2022-48994—14.4%
——4——CVE-2022-49011—14.4%
——4——CVE-2026-22741—14.4%
——4——CVE-2022-49020—14.4%
——4——