Vulnerabilities exploitable today
364,238in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,674
New KEV · 24H0
Exploit Today ≥ 701,611
Distribution · last window
- Critical2,592
- High10,528
- Medium5,768
- Low534
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-482455.3 MED13.3%
——4Open ISES Tickets before 3.44.2 embeds a hardcoded Google Maps API key in tables.php that is committed to the public source repository. The key can be extracted by anyone with read access to the source and used to make Google Maps Platform requests billed against the original owner's Google Cloud project.31dCVE-2022-42838—13.3%
——4——CVE-2025-39365—13.3%
——4——CVE-2020-9119—13.3%
——4——CVE-2025-39469—13.3%
——4——CVE-2026-179909.6 CRI13.3%
——4Insufficient validation of untrusted input in WebAuthn in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted PDF file. (Chromium security severity: Low)20dCVE-2025-10906—13.3%
——4——CVE-2021-36317—13.3%
——4——CVE-2025-57929—13.3%
——4——CVE-2025-24609—13.3%
——4——CVE-2024-467507.8 HIG13.3%
——4In the Linux kernel, the following vulnerability has been resolved:
PCI: Add missing bridge lock to pci_bus_lock()
One of the true positives that the cfg_access_lock lockdep effort
identified is this sequence:
WARNING: CPU: 14 PID: 1 at drivers/pci/pci.c:4886 pci_bridge_secondary_bus_reset+0x5d/0x70
RIP: 0010:pci_bridge_secondary_bus_reset+0x5d/0x70
Call Trace:
<TASK>
? __warn+0x8c/0x190
? pci_bridge_secondary_bus_reset+0x5d/0x70
? report_bug+0x1f8/0x200
? handle_bug+0x3c/0x70
? exc_invalid_op+0x18/0x70
? asm_exc_invalid_op+0x1a/0x20
? pci_bridge_secondary_bus_reset+0x5d/0x70
pci_reset_bus+0x1d8/0x270
vmd_probe+0x778/0xa10
pci_device_probe+0x95/0x120
Where pci_reset_bus() users are triggering unlocked secondary bus resets.
Ironically pci_bus_reset(), several calls down from pci_reset_bus(), uses
pci_bus_lock() before issuing the reset which locks everything *but* the
bridge itself.
For the same motivation as adding:
bridge = pci_upstream_bridge(dev);
if (bridge)
pci_dev_lock(bridge);
to pci_reset_function() for the "bus" and "cxl_bus" reset cases, add
pci_dev_lock() for @bus->self to pci_bus_lock().
[bhelgaas: squash in recursive locking deadlock fix from Keith Busch:
https://lore.kernel.org/r/20240711193650.701834-1-kbusch@meta.com]19dCVE-2024-31430—13.3%
——4——CVE-2024-567097.8 HIG13.3%
——4In the Linux kernel, the following vulnerability has been resolved:
io_uring: check if iowq is killed before queuing
task work can be executed after the task has gone through io_uring
termination, whether it's the final task_work run or the fallback path.
In this case, task work will find ->io_wq being already killed and
null'ed, which is a problem if it then tries to forward the request to
io_queue_iowq(). Make io_queue_iowq() fail requests in this case.
Note that it also checks PF_KTHREAD, because the user can first close
a DEFER_TASKRUN ring and shortly after kill the task, in which case
->iowq check would race.19dCVE-2025-31625—13.3%
——4——CVE-2024-36247—13.3%
——4——CVE-2026-22772—13.3%
——4——CVE-2023-39538—13.3%
——4——CVE-2025-4957—13.3%
——4——CVE-2022-41667—13.3%
——4——CVE-2024-38739—13.3%
——4——CVE-2026-179879.6 CRI13.3%
——4Insufficient validation of untrusted input in Notifications in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted PDF file. (Chromium security severity: Low)20dCVE-2025-7979—13.3%
——4——CVE-2025-70368—13.3%
——4——CVE-2023-52566—13.3%
——4——CVE-2025-39409—13.3%
——4——CVE-2026-40775—13.3%
——4——CVE-2026-32308—13.3%
——4——CVE-2025-23979—13.3%
——4——CVE-2021-36170—13.3%
——4——CVE-2025-39372—13.3%
——4——CVE-2026-353966.1 MED13.3%
——4WeGIA is a Web manager for charitable institutions. Prior to 3.6.9, an Open Redirect vulnerability was identified in the /WeGIA/controle/control.php endpoint of the WeGIA application, specifically through the nextPage parameter when combined with metodo=listarId and nomeClasse=IsaidaControle. The application fails to validate or restrict the nextPage parameter, allowing attackers to redirect users to arbitrary external websites. This can be abused for phishing attacks, credential theft, malware distribution, and social engineering using the trusted WeGIA domain. This vulnerability is fixed in 3.6.9.30dCVE-2025-39594—13.3%
——4——CVE-2025-31900—13.3%
——4——CVE-2026-738455.3 MED13.3%
——4CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, the ckan_get_mqa_quality and ckan_get_mqa_quality_details tools in src/tools/quality.ts use isValidMqaServer to validate the server_url parameter with a prefix-only regular expression for dati.gov.it, allowing suffix-host and URL-userinfo values to target an attacker-controlled host and return a spoofed response. This issue is fixed in version 0.4.112.9dCVE-2024-36261—13.3%
——4——CVE-2025-60160—13.3%
——4——CVE-2026-730909.3 CRI13.3%
——4PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.2.2, processUpdateActivity and processUpdateVideo accept an ActivityPub Update containing a Video object without verifying that byActor.url is authorized for the host in videoObject.id, allowing a malicious federated server to rewrite another server's video metadata, visibility, media file, and HLS URLs. This issue is fixed in version 8.2.2.10dCVE-2026-4927—13.3%
——4——CVE-2026-113068.8 HIG13.3%
——4Use after free in PDFium in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file. (Chromium security severity: Low)31dCVE-2025-22513—13.3%
——4——