Vulnerabilities exploitable today
365,446in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,682
New KEV · 24H0
Exploit Today ≥ 701,626
Distribution · last window
- Critical2,322
- High9,975
- Medium4,913
- Low460
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2025-13450—14.3%
——4——CVE-2026-6236—14.3%
——4——CVE-2025-26656—14.3%
——4——CVE-2025-11216—14.3%
——4——CVE-2026-8887—14.3%
——4——CVE-2021-21536—14.3%
——4——CVE-2025-66100—14.3%
——4——CVE-2026-99607.5 HIG14.3%
——4Integer overflow in PDFium in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted font file. (Chromium security severity: High)37dCVE-2026-611035.9 MED14.3%
——4Vulnerability in the PeopleSoft Enterprise CS Campus Community product of Oracle PeopleSoft (component: Security). The supported version that is affected is 9.2.38. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the PeopleSoft Enterprise CS Campus Community executes to compromise PeopleSoft Enterprise CS Campus Community. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise CS Campus Community accessible data as well as unauthorized update, insert or delete access to some of PeopleSoft Enterprise CS Campus Community accessible data. CVSS 3.1 Base Score 5.9 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N).27dCVE-2021-21537—14.3%
——4——CVE-2026-1888—14.3%
——4——CVE-2026-654356.5 MED14.3%
——4Unauthenticated Broken Access Control in Thrive Leads Version <= 10.9.2 versions.31dCVE-2025-48291—14.3%
——4——CVE-2026-485077.1 HIG14.3%
——4Snipe-IT is an IT asset/license management system. A vulnerability in versions prior to 8.6.0 allows a non-admin user holding only the granular `users.edit` permission to lock every admin out of the instance by editing the `activated` flag (which determines whether or not a user can login) and the `ldap_import` flag, which determines whether or not the user can request a password reset. Version 8.6.0 contains a patch.6dCVE-2026-2434—14.3%
——4——CVE-2022-49888—14.3%
——4——CVE-2026-619786.5 MED14.3%
——4Unauthenticated Broken Access Control in Secure Card Gateway for ePay Paycenter (Piraeus Bank) <= 1.0.32 versions.13dCVE-2023-27285—14.3%
——4——CVE-2017-18305—14.3%
——4——CVE-2021-47549—14.3%
——4——CVE-2026-1807—14.3%
——4——CVE-2022-27874—14.3%
——4——CVE-2026-131718.2 HIG14.3%
——4The Eventin WordPress plugin before 4.1.20 does not perform an authorization check on its waiting-list registration handler, allowing unauthenticated users to create WordPress user accounts for arbitrary email addresses and inject order records.23hCVE-2026-3333—14.3%
——4——CVE-2026-1279—14.3%
——4——CVE-2024-368907.8 HIG14.3%
——4In the Linux kernel, the following vulnerability has been resolved:
mm/slab: make __free(kfree) accept error pointers
Currently, if an automatically freed allocation is an error pointer that
will lead to a crash. An example of this is in wm831x_gpio_dbg_show().
171 char *label __free(kfree) = gpiochip_dup_line_label(chip, i);
172 if (IS_ERR(label)) {
173 dev_err(wm831x->dev, "Failed to duplicate label\n");
174 continue;
175 }
The auto clean up function should check for error pointers as well,
otherwise we're going to keep hitting issues like this.23dCVE-2022-48732—14.3%
——4——CVE-2026-20149—14.3%
——4——CVE-2026-4279—14.3%
——4——CVE-2024-51596—14.3%
——4——CVE-2020-37236—14.3%
——4——CVE-2024-21945—14.3%
——4——CVE-2026-34950—14.3%
——4——CVE-2025-49352—14.3%
——4——CVE-2021-47860—14.3%
——4——CVE-2023-50952—14.3%
——4——CVE-2025-68564—14.3%
——4——CVE-2025-31072—14.3%
——4——CVE-2025-68050—14.3%
——4——CVE-2026-8868—14.3%
——4——