Vulnerabilities exploitable today
359,665in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,665
New KEV · 24H0
Exploit Today ≥ 701,608
Distribution · last window
- Critical2,517
- High11,192
- Medium7,126
- Low650
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2025-55696—10.9%
——3——CVE-2025-14632—11.0%
——3——CVE-2026-302848.6 HIG11.0%
——3An arbitrary file overwrite vulnerability in UXGROUP LLC Voice Recorder v10.0 allows attackers to overwrite critical internal files via the file import process, leading to arbitrary code execution or information exposure.21dCVE-2022-48906—11.0%
——3——CVE-2024-38604—11.0%
——3——CVE-2025-43821—11.0%
——3——CVE-2023-53788—11.0%
——3——CVE-2025-68220—11.0%
——3——CVE-2022-39953—11.0%
——3——CVE-2023-42569—11.0%
——3——CVE-2026-1148—11.0%
——3——CVE-2022-49890—11.0%
——3——CVE-2025-52036—11.0%
——3——CVE-2022-48922—11.0%
——3——CVE-2023-53051—11.0%
——3——CVE-2024-47673—11.0%
——3——CVE-2025-21636—11.0%
——3——CVE-2025-52035—11.0%
——3——CVE-2020-35911—11.0%
——3——CVE-2025-60266—11.0%
——3——CVE-2025-40050—11.0%
——3——CVE-2026-1015—11.0%
——3——CVE-2025-40179—11.0%
——3——CVE-2023-52919—11.0%
——3——CVE-2021-38379—11.0%
——3——CVE-2023-7083—11.0%
——3——CVE-2025-40120—11.0%
——3——CVE-2025-43829—11.0%
——3——CVE-2023-52728—11.0%
——3——CVE-2023-26590—11.0%
——3——CVE-2026-439848.9 HIG11.0%
——3Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Versions prior to 2.17.1 expose `log_js_errors` to any authenticated user, including guest users when guest access is enabled. The endpoint writes attacker-controlled strings directly into the main application log. The administrator-only `logFile` view then reads that log file and embeds it into an HTML response without escaping. This creates a stored cross-site scripting condition where a low-privilege guest can inject HTML or JavaScript into the log file and have it execute in an administrator's browser when the log viewer is opened. Version 2.17.1 patches the issue.23dCVE-2026-106475.3 MED11.0%
——3The USB CDC-NCM device class (subsys/usb/device_next/class/usbd_cdc_ncm.c) ignores the return value of usbd_ep_enqueue() in its ethernet transmit callback cdc_ncm_send(). When the enqueue fails, the function still calls k_sem_take(&data->sync_sem, K_FOREVER), blocking on a completion semaphore that is only ever signaled from the bulk-IN transfer-completion callback. Because nothing was enqueued, that callback never fires and the calling thread — a shared network traffic-class TX thread — deadlocks permanently while holding the interface TX lock, halting transmission until reboot (and leaking the transmit buffer).
The enqueue fails under conditions controlled by the attached USB host: usbd_ep_enqueue() returns -EPERM whenever the bus is suspended (a standard, persistent host operation), and the underlying udc_ep_enqueue() returns -EPERM/-ENODEV on disconnect, bus reset, or endpoint disable. The cdc_ncm_send() guard only checks the DATA_IFACE_ENABLED and IFACE_UP flags, not the suspended state, so a packet transmitted while the host holds the bus suspended reaches the failing enqueue and deadlocks the TX path.
The realistic trigger is a bus suspend that occurs while the exported network interface is active and has traffic to send — host sleep, USB selective/auto-suspend, or hub power management — after which any device-originated packet deadlocks the path, recoverable only by reboot. The impact is a persistent loss of the virtual network connection between the host's NCM interface and the Zephyr device; because the deadlocked thread is a shared traffic-class TX thread, egress on other network interfaces can stall as well. There is no memory corruption or information disclosure.
The defect was introduced with the CDC-NCM driver and shipped in releases through v4.4.0; it is fixed by checking the usbd_ep_enqueue() return value and freeing the buffer before the blocking wait.8dCVE-2020-4369—11.0%
——3——CVE-2025-40060—11.0%
——3——CVE-2024-23802—11.0%
——3——CVE-2019-6670—11.0%
——3——CVE-2025-55910—11.0%
——3——CVE-2016-0843—11.0%
——3——CVE-2026-0725—11.0%
——3——CVE-2025-53095—11.0%
——3——