Vulnerabilities exploitable today
359,428in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,665
New KEV · 24H0
Exploit Today ≥ 701,608
Distribution · last window
- Critical2,475
- High11,085
- Medium7,046
- Low645
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-4239—10.9%
——3——CVE-2018-25227—10.9%
——3——CVE-2024-6080—10.9%
——3——CVE-2022-20513—10.9%
——3——CVE-2021-474508.8 HIG10.9%
——3In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: Fix host stage-2 PGD refcount
The KVM page-table library refcounts the pages of concatenated stage-2
PGDs individually. However, when running KVM in protected mode, the
host's stage-2 PGD is currently managed by EL2 as a single high-order
compound page, which can cause the refcount of the tail pages to reach 0
when they shouldn't, hence corrupting the page-table.
Fix this by introducing a new hyp_split_page() helper in the EL2 page
allocator (matching the kernel's split_page() function), and make use of
it from host_s2_zalloc_pages_exact().11dCVE-2024-50069—10.9%
——3——CVE-2024-50081—10.9%
——3——CVE-2026-5050—10.9%
——3——CVE-2026-44967—10.9%
——3——CVE-2025-22844—10.9%
——3——CVE-2026-53701—10.9%
——3——CVE-2023-20924—10.9%
——3——CVE-2022-50649—10.9%
——3——CVE-2026-40213—10.9%
——3——CVE-2024-13933—10.9%
——3——CVE-2026-572046.5 MED10.9%
——3pypdf is a free and open-source pure-python PDF library. Prior to 6.13.3, a maliciously crafted PDF can cause DoS. An attacker who uses this vulnerability can craft a PDF which leads to large memory usage, as MAX_DECLARED_STREAM_LENGTH is sometimes ignored. This requires parsing a content stream without a /Length value. This issue has been fixed in version 6.13.3.39dCVE-2026-32019—10.9%
——3——CVE-2026-23032—10.9%
——3——CVE-2024-46861—10.9%
——3——CVE-2023-47182—10.9%
——3——CVE-2017-17293—10.9%
——3——CVE-2026-142405.3 MED10.9%
——3The tourmaster WordPress plugin before 5.4.9 writes its order/booking export to a fixed, predictable file inside its publicly accessible directory with no access control, allowing unauthenticated users to download the exported customers' personal information once an administrator has run an export.8dCVE-2024-50070—10.9%
——3——CVE-2018-25231—10.9%
——3——CVE-2026-69106.4 MED10.9%
——3The Bookero.pl – system rezerwacji online plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `bookero_products` shortcode's `hide_products` (and `filter_products`) attributes in versions up to and including 2.2. This is due to insufficient input sanitization and output escaping in the `bookero_products()` function — the raw attribute value is concatenated directly into an inline `<script>` block without any escaping. This makes it possible for authenticated attackers with contributor-level access and above to inject arbitrary web scripts into pages that will execute whenever a user accesses the injected page.36dCVE-2026-190735.3 MED10.9%
——3The Order Sync with Zendesk for WooCommerce WordPress plugin before 2.2.3 does not perform any capability check on one of its REST API endpoints, and does not verify that the requester owns the account being queried, allowing unauthenticated attackers to retrieve the order history and purchase totals of any customer whose email address they know or can enumerate.2dCVE-2022-499527.8 HIG10.9%
——3In the Linux kernel, the following vulnerability has been resolved:
misc: fastrpc: fix memory corruption on probe
Add the missing sanity check on the probed-session count to avoid
corrupting memory beyond the fixed-size slab-allocated session array
when there are more than FASTRPC_MAX_SESSIONS sessions defined in the
devicetree.11dCVE-2023-41033—10.9%
——3——CVE-2025-7979—10.9%
——3——CVE-2026-45781—10.9%
——3——CVE-2025-53502—10.9%
——3——CVE-2020-9086—10.9%
——3——CVE-2021-47716—10.9%
——3——CVE-2024-54414—10.9%
——3——CVE-2026-6593—10.9%
——3——CVE-2026-6619—10.9%
——3——CVE-2016-20045—10.9%
——3——CVE-2026-234407.5 HIG10.9%
——3In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e: Fix race condition during IPSec ESN update
In IPSec full offload mode, the device reports an ESN (Extended
Sequence Number) wrap event to the driver. The driver validates this
event by querying the IPSec ASO and checking that the esn_event_arm
field is 0x0, which indicates an event has occurred. After handling
the event, the driver must re-arm the context by setting esn_event_arm
back to 0x1.
A race condition exists in this handling path. After validating the
event, the driver calls mlx5_accel_esp_modify_xfrm() to update the
kernel's xfrm state. This function temporarily releases and
re-acquires the xfrm state lock.
So, need to acknowledge the event first by setting esn_event_arm to
0x1. This prevents the driver from reprocessing the same ESN update if
the hardware sends events for other reason. Since the next ESN update
only occurs after nearly 2^31 packets are received, there's no risk of
missing an update, as it will happen long after this handling has
finished.
Processing the event twice causes the ESN high-order bits (esn_msb) to
be incremented incorrectly. The driver then programs the hardware with
this invalid ESN state, which leads to anti-replay failures and a
complete halt of IPSec traffic.
Fix this by re-arming the ESN event immediately after it is validated,
before calling mlx5_accel_esp_modify_xfrm(). This ensures that any
spurious, duplicate events are correctly ignored, closing the race
window.21dCVE-2024-31463—10.9%
——3——CVE-2024-54427—10.9%
——3——