Vulnerabilities exploitable today
364,588in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,675
New KEV · 24H0
Exploit Today ≥ 701,620
Distribution · last window
- Critical2,405
- High10,145
- Medium5,058
- Low466
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2025-32277—13.9%
——4——CVE-2026-40178—13.9%
——4——CVE-2025-8682—13.9%
——4——CVE-2021-470498.4 HIG13.9%
——4In the Linux kernel, the following vulnerability has been resolved:
Drivers: hv: vmbus: Use after free in __vmbus_open()
The "open_info" variable is added to the &vmbus_connection.chn_msg_list,
but the error handling frees "open_info" without removing it from the
list. This will result in a use after free. First remove it from the
list, and then free it.22dCVE-2021-28819—13.9%
——4——CVE-2024-35819—13.9%
——4——CVE-2024-35944—13.9%
——4——CVE-2023-0623—13.9%
——4——CVE-2025-64125—13.9%
——4——CVE-2025-57984—13.9%
——4——CVE-2020-1807—13.9%
——4——CVE-2026-324695.3 MED13.9%
——4Unauthenticated Bypass Vulnerability in CAPTCHA 4WP <= 7.6.0 versions.13dCVE-2025-31408—13.9%
——4——CVE-2021-3788—13.9%
——4——CVE-2023-0622—13.9%
——4——CVE-2019-25242—13.9%
——4——CVE-2017-8161—13.9%
——4——CVE-2026-655025.3 MED13.9%
——4Unauthenticated Bypass Vulnerability in Element Pack Elementor Addons <= 8.7.13 versions.13dCVE-2025-50690—13.9%
——4——CVE-2026-6626—13.9%
——4——CVE-2025-3518—13.9%
——4——CVE-2025-31877—13.9%
——4——CVE-2024-4278—13.9%
——4——CVE-2026-770145.3 MED13.9%
——4A flaw was found in libsoup's SoupServer HTTP Range header processing. The sort_ranges() comparator in soup-message-headers.c truncates a 64-bit subtraction result to 32-bit int, flipping the sign for range offsets differing by more than INT_MAX. This causes silent omission of requested byte ranges from HTTP 206 Partial Content responses on resources larger than approximately 2 GB.15hCVE-2025-39412—13.9%
——4——CVE-2021-47068—13.9%
——4——CVE-2022-2952—13.9%
——4——CVE-2015-6414—13.9%
——4——CVE-2024-57097—13.9%
——4——CVE-2023-42233—13.9%
——4——CVE-2024-27875—13.9%
——4——CVE-2022-42834—13.9%
——4——CVE-2023-42245—13.9%
——4——CVE-2023-52597—13.9%
——4——CVE-2024-53213—13.9%
——4——CVE-2026-149353.7 LOW13.9%
——4A logic vulnerability was found in GStreamer's webrtcbin component. The _check_sdp_crypto() function contains an inverted boolean condition that causes it to accept remote SDP offers or answers that lack the required a=fingerprint attribute, while incorrectly rejecting those that include it. An attacker with the ability to intercept and modify WebRTC signaling messages could exploit this to bypass the SDP-level DTLS certificate fingerprint binding, weakening defenses against man-in-the-middle attacks on media streams.49dCVE-2019-25370—13.9%
——4——CVE-2024-269517.8 HIG13.9%
——4In the Linux kernel, the following vulnerability has been resolved:
wireguard: netlink: check for dangling peer via is_dead instead of empty list
If all peers are removed via wg_peer_remove_all(), rather than setting
peer_list to empty, the peer is added to a temporary list with a head on
the stack of wg_peer_remove_all(). If a netlink dump is resumed and the
cursored peer is one that has been removed via wg_peer_remove_all(), it
will iterate from that peer and then attempt to dump freed peers.
Fix this by instead checking peer->is_dead, which was explictly created
for this purpose. Also move up the device_update_lock lockdep assertion,
since reading is_dead relies on that.
It can be reproduced by a small script like:
echo "Setting config..."
ip link add dev wg0 type wireguard
wg setconf wg0 /big-config
(
while true; do
echo "Showing config..."
wg showconf wg0 > /dev/null
done
) &
sleep 4
wg setconf wg0 <(printf "[Peer]\nPublicKey=$(wg genkey)\n")
Resulting in:
BUG: KASAN: slab-use-after-free in __lock_acquire+0x182a/0x1b20
Read of size 8 at addr ffff88811956ec70 by task wg/59
CPU: 2 PID: 59 Comm: wg Not tainted 6.8.0-rc2-debug+ #5
Call Trace:
<TASK>
dump_stack_lvl+0x47/0x70
print_address_description.constprop.0+0x2c/0x380
print_report+0xab/0x250
kasan_report+0xba/0xf0
__lock_acquire+0x182a/0x1b20
lock_acquire+0x191/0x4b0
down_read+0x80/0x440
get_peer+0x140/0xcb0
wg_get_device_dump+0x471/0x113022dCVE-2022-47111—13.9%
——4——CVE-2023-38424—13.9%
——4——