Vulnerabilities exploitable today
361,121in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,670
New KEV · 24H0
Exploit Today ≥ 701,607
Distribution · last window
- Critical2,674
- High11,554
- Medium7,180
- Low661
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2025-30991—12.1%
——4——CVE-2025-49244—12.1%
——4——CVE-2025-32955—12.1%
——4——CVE-2025-30950—12.1%
——4——CVE-2024-13883—12.1%
——4——CVE-2026-39333—12.1%
——4——CVE-2025-49235—12.1%
——4——CVE-2024-476697.3 HIG12.1%
——4In the Linux kernel, the following vulnerability has been resolved:
nilfs2: fix state management in error path of log writing function
After commit a694291a6211 ("nilfs2: separate wait function from
nilfs_segctor_write") was applied, the log writing function
nilfs_segctor_do_construct() was able to issue I/O requests continuously
even if user data blocks were split into multiple logs across segments,
but two potential flaws were introduced in its error handling.
First, if nilfs_segctor_begin_construction() fails while creating the
second or subsequent logs, the log writing function returns without
calling nilfs_segctor_abort_construction(), so the writeback flag set on
pages/folios will remain uncleared. This causes page cache operations to
hang waiting for the writeback flag. For example,
truncate_inode_pages_final(), which is called via nilfs_evict_inode() when
an inode is evicted from memory, will hang.
Second, the NILFS_I_COLLECTED flag set on normal inodes remain uncleared.
As a result, if the next log write involves checkpoint creation, that's
fine, but if a partial log write is performed that does not, inodes with
NILFS_I_COLLECTED set are erroneously removed from the "sc_dirty_files"
list, and their data and b-tree blocks may not be written to the device,
corrupting the block mapping.
Fix these issues by uniformly calling nilfs_segctor_abort_construction()
on failure of each step in the loop in nilfs_segctor_do_construct(),
having it clean up logs and segment usages according to progress, and
correcting the conditions for calling nilfs_redirty_inodes() to ensure
that the NILFS_I_COLLECTED flag is cleared.15dCVE-2026-27792—12.1%
——4——CVE-2024-531477.8 HIG12.1%
——4In the Linux kernel, the following vulnerability has been resolved:
exfat: fix out-of-bounds access of directory entries
In the case of the directory size is greater than or equal to
the cluster size, if start_clu becomes an EOF cluster(an invalid
cluster) due to file system corruption, then the directory entry
where ei->hint_femp.eidx hint is outside the directory, resulting
in an out-of-bounds access, which may cause further file system
corruption.
This commit adds a check for start_clu, if it is an invalid cluster,
the file or directory will be treated as empty.15dCVE-2024-44958—12.1%
——4——CVE-2024-52579—12.1%
——4——CVE-2022-21172—12.1%
——4——CVE-2025-49309—12.1%
——4——CVE-2025-27334—12.1%
——4——CVE-2024-467987.8 HIG12.1%
——4In the Linux kernel, the following vulnerability has been resolved:
ASoC: dapm: Fix UAF for snd_soc_pcm_runtime object
When using kernel with the following extra config,
- CONFIG_KASAN=y
- CONFIG_KASAN_GENERIC=y
- CONFIG_KASAN_INLINE=y
- CONFIG_KASAN_VMALLOC=y
- CONFIG_FRAME_WARN=4096
kernel detects that snd_pcm_suspend_all() access a freed
'snd_soc_pcm_runtime' object when the system is suspended, which
leads to a use-after-free bug:
[ 52.047746] BUG: KASAN: use-after-free in snd_pcm_suspend_all+0x1a8/0x270
[ 52.047765] Read of size 1 at addr ffff0000b9434d50 by task systemd-sleep/2330
[ 52.047785] Call trace:
[ 52.047787] dump_backtrace+0x0/0x3c0
[ 52.047794] show_stack+0x34/0x50
[ 52.047797] dump_stack_lvl+0x68/0x8c
[ 52.047802] print_address_description.constprop.0+0x74/0x2c0
[ 52.047809] kasan_report+0x210/0x230
[ 52.047815] __asan_report_load1_noabort+0x3c/0x50
[ 52.047820] snd_pcm_suspend_all+0x1a8/0x270
[ 52.047824] snd_soc_suspend+0x19c/0x4e0
The snd_pcm_sync_stop() has a NULL check on 'substream->runtime' before
making any access. So we need to always set 'substream->runtime' to NULL
everytime we kfree() it.15dCVE-2024-28776—12.1%
——4——CVE-2025-47664—12.1%
——4——CVE-2026-129457.1 HIG12.1%
——4IBM Langflow OSS 1.0.0 through 1.10.1 allows authenticated users to access and manipulate other users' build jobs through improper access control on log retrieval and unauthenticated build endpoints.15dCVE-2026-40588—12.1%
——4——CVE-2025-12351—12.1%
——4——CVE-2024-48873—12.1%
——4——CVE-2026-712428.3 HIG12.1%
——4Crater's NotePolicy checks only a blanket Bouncer ability (manage-all-notes / view-all-notes) with no company-ownership comparison, unlike InvoicePolicy and other sibling policies which additionally verify ->hasCompany(->company_id). Any authenticated user of one company can read, edit, or delete another company's notes by ID.9dCVE-2025-7782—12.1%
——4——CVE-2026-44582—12.1%
——4——CVE-2025-49310—12.1%
——4——CVE-2025-44039—12.1%
——4——CVE-2026-7013—12.1%
——4——CVE-2025-49298—12.1%
——4——CVE-2026-86513.7 LOW12.1%
——4Limited authentication bypass by spoofing vulnerability in Progress MOVEit Transfer (HTTPS module).
This issue affects MOVEit Transfer: before 2025.0.7, from 2025.1.0 before 2025.1.3.41dCVE-2024-4103—12.1%
——4——CVE-2026-8081—12.1%
——4——CVE-2025-49304—12.1%
——4——CVE-2025-9541—12.1%
——4——CVE-2017-2375—12.1%
——4——CVE-2026-527527.8 HIG12.1%
——4Ghidra before 12.0.2 contains a path traversal vulnerability in the extension installer that fails to validate ZIP entry names during extraction. Attackers can craft malicious extensions with traversal sequences like ../ in filenames to write arbitrary files outside the intended directory, enabling code execution.36dCVE-2023-42831—12.1%
——4——CVE-2025-49311—12.1%
——4——CVE-2025-49299—12.1%
——4——CVE-2026-49277—12.1%
——4——