Vulnerabilities exploitable today
359,428in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,665
New KEV · 24H0
Exploit Today ≥ 701,608
Distribution · last window
- Critical2,495
- High11,159
- Medium7,083
- Low650
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-30876—10.7%
——3——CVE-2022-48897—10.7%
——3——CVE-2022-48886—10.7%
——3——CVE-2025-12193—10.7%
——3——CVE-2025-67555—10.7%
——3——CVE-2026-57636—10.7%
——3——CVE-2024-53287—10.7%
——3——CVE-2021-47019—10.7%
——3——CVE-2022-48884—10.7%
——3——CVE-2025-7224—10.7%
——3——CVE-2025-54627—10.7%
——3——CVE-2023-52908—10.7%
——3——CVE-2021-47030—10.7%
——3——CVE-2025-21904—10.7%
——3——CVE-2026-664895.3 MED10.7%
——3Joomla Extension - balbooa.com - Various unauthenticated file system disclosure in Gridbox < 2.20.29dCVE-2022-50572—10.7%
——3——CVE-2026-25022—10.7%
——3——CVE-2023-52914—10.7%
——3——CVE-2025-55012—10.7%
——3——CVE-2026-0503—10.7%
——3——CVE-2026-24295—10.7%
——3——CVE-2020-5315—10.7%
——3——CVE-2026-37535—10.7%
——3——CVE-2023-32199—10.7%
——3——CVE-2025-7247—10.7%
——3——CVE-2026-54813—10.7%
——3——CVE-2020-35912—10.7%
——3——CVE-2025-67558—10.7%
——3——CVE-2022-0353—10.7%
——3——CVE-2025-12017—10.7%
——3——CVE-2023-7273—10.7%
——3——CVE-2026-57642—10.7%
——3——CVE-2026-559985.3 MED10.7%
——3The endpoint /v3/import/{token}_{clusterId}.yaml retrieves the cluster object before validating the token. When a valid cluster ID references a cluster that has private registry secrets configured, a nil pointer dereference in pkg/systemtemplate/private_registry.go causes the request to return HTTP 502 Bad Gateway. For cluster IDs that do not exist, the endpoint returns HTTP 200. This observable difference in response codes constitutes a reliable enumeration oracle.9dCVE-2026-330207.1 HIG10.7%
——3libsixel is a SIXEL encoder/decoder implementation derived from kmiya's sixel. Versions 1.8.7 and prior contain an integer overflow which leads to a heap buffer overflow via sixel_frame_convert_to_rgb888() in frame.c, where allocation size and pointer offset computations for palettised images (PAL1, PAL2, PAL4) are performed using int arithmetic before casting to size_t. For images whose pixel count exceeds INT_MAX / 4, the overflow produces an undersized heap allocation for the conversion buffer and a negative pointer offset for the normalization sub-buffer, after which sixel_helper_normalize_pixelformat() writes the full image data starting from the invalid pointer, causing massive heap corruption confirmed by ASAN. An attacker providing a specially crafted large palettised PNG can corrupt the heap of the victim process, resulting in a reliable crash and potential arbitrary code execution.
This issue has been fixed in version 1.8.7-r1.20dCVE-2025-7226—10.7%
——3——CVE-2024-28948—10.7%
——3——CVE-2023-28000—10.7%
——3——CVE-2026-24309—10.7%
——3——CVE-2025-69674—10.7%
——3——CVE-2024-41254—10.7%
——3——