Vulnerabilities exploitable today
363,254in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,671
New KEV · 24H0
Exploit Today ≥ 701,610
Distribution · last window
- Critical2,896
- High12,359
- Medium7,619
- Low720
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2025-69188—12.7%
——4——CVE-2022-48319—12.7%
——4——CVE-2025-22671—12.7%
——4——CVE-2025-31611—12.7%
——4——CVE-2023-40383—12.7%
——4——CVE-2024-35840—12.7%
——4——CVE-2022-3114—12.7%
——4——CVE-2025-10135—12.7%
——4——CVE-2026-341615.4 MED12.7%
——4Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, a Stored Cross-Site Scripting (XSS) vulnerability exists in the social post attachment upload functionality, where an authenticated user can upload a malicious HTML file containing JavaScript via the /api/social_post_attachments endpoint. The uploaded file is served back from the application at the generated contentUrl without sanitization, content type restrictions, or a Content-Disposition: attachment header, causing the JavaScript to execute in the browser within the application's origin. Because the payload is stored server-side and runs in the trusted origin, an attacker can perform session hijacking, account takeover, privilege escalation (if an admin views the link), and arbitrary actions on behalf of the victim. This issue has been fixed in version 2.0.0-RC.3.27dCVE-2025-11873—12.7%
——4——CVE-2026-42478—12.7%
——4——CVE-2023-28140—12.7%
——4——CVE-2025-69184—12.7%
——4——CVE-2026-644527.1 HIG12.7%
——4In the Linux kernel, the following vulnerability has been resolved:
6lowpan: fix NHC entry use-after-free on error path
lowpan_nhc_do_uncompression() looks up an NHC descriptor while holding
lowpan_nhc_lock. If the descriptor has no uncompress callback, the error
path drops the lock before printing nhc->name.
lowpan_nhc_del() removes descriptors under the same lock and then relies
on synchronize_net() before the owning module can be unloaded. That only
waits for net RX RCU readers. lowpan_header_decompress() is also exported
and can be reached from callers that are not necessarily covered by the net
core RX critical section, for example the Bluetooth 6LoWPAN L2CAP receive
path.
This leaves a race where one task drops lowpan_nhc_lock in the error path,
another task unregisters and frees the matching descriptor after
synchronize_net() returns, and the first task then dereferences nhc->name
for the warning.
With the post-unlock window widened, KASAN reports:
BUG: KASAN: slab-use-after-free in lowpan_nhc_do_uncompression+0x1f4/0x220
Read of size 8
lowpan_nhc_do_uncompression
lowpan_header_decompress
Fix this by printing the warning before dropping lowpan_nhc_lock, so the
descriptor name is read while unregister is still excluded. The malformed
packet is still rejected with -ENOTSUPP.3dCVE-2024-6079—12.7%
——4——CVE-2023-40992—12.7%
——4——CVE-2025-69192—12.7%
——4——CVE-2026-27396—12.7%
——4——CVE-2025-22650—12.7%
——4——CVE-2026-4586—12.7%
——4——CVE-2024-5249—12.7%
——4——CVE-2024-449787.8 HIG12.7%
——4In the Linux kernel, the following vulnerability has been resolved:
drm/xe: Free job before xe_exec_queue_put
Free job depends on job->vm being valid, the last xe_exec_queue_put can
destroy the VM. Prevent UAF by freeing job before xe_exec_queue_put.
(cherry picked from commit 32a42c93b74c8ca6d0915ea3eba21bceff53042f)16dCVE-2025-21742—12.7%
——4——CVE-2025-10138—12.7%
——4——CVE-2024-499567.8 HIG12.7%
——4In the Linux kernel, the following vulnerability has been resolved:
gfs2: fix double destroy_workqueue error
When gfs2_fill_super() fails, destroy_workqueue() is called within
gfs2_gl_hash_clear(), and the subsequent code path calls
destroy_workqueue() on the same work queue again.
This issue can be fixed by setting the work queue pointer to NULL after
the first destroy_workqueue() call and checking for a NULL pointer
before attempting to destroy the work queue again.16dCVE-2025-69185—12.7%
——4——CVE-2024-57978—12.7%
——4——CVE-2025-10132—12.7%
——4——CVE-2025-52712—12.7%
——4——CVE-2026-21975—12.7%
——4——CVE-2026-8516—12.7%
——4——CVE-2025-40015—12.7%
——4——CVE-2025-10133—12.7%
——4——CVE-2025-21797—12.7%
——4——CVE-2023-6529—12.7%
——4——CVE-2025-21790—12.7%
——4——CVE-2025-65233—12.7%
——4——CVE-2026-95685.0 MED12.7%
——4A weakness has been identified in ThingsBoard up to 4.3.1.1. Affected by this vulnerability is the function getGatewayDockerComposeFile of the file /api/v1/provision of the component YAML Handler. This manipulation causes code injection. It is possible to initiate the attack remotely. The attack's complexity is rated as high. The exploitation appears to be difficult. The project was informed of the problem early through a pull request but has not reacted yet.28dCVE-2026-655417.3 HIG12.7%
——4Unauthenticated Broken Access Control in Staff Training <= 1.0.7 versions.8dCVE-2026-281887.3 HIG12.7%
——4Unauthenticated Broken Access Control in Hydra Booking <= 1.2.2 versions.6d