Vulnerabilities exploitable today
358,955in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,665
New KEV · 24H0
Exploit Today ≥ 701,607
Distribution · last window
- Critical2,697
- High11,575
- Medium7,294
- Low679
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2025-220157.8 HIG10.5%
——3In the Linux kernel, the following vulnerability has been resolved:
mm/migrate: fix shmem xarray update during migration
A shmem folio can be either in page cache or in swap cache, but not at the
same time. Namely, once it is in swap cache, folio->mapping should be
NULL, and the folio is no longer in a shmem mapping.
In __folio_migrate_mapping(), to determine the number of xarray entries to
update, folio_test_swapbacked() is used, but that conflates shmem in page
cache case and shmem in swap cache case. It leads to xarray multi-index
entry corruption, since it turns a sibling entry to a normal entry during
xas_store() (see [1] for a userspace reproduction). Fix it by only using
folio_test_swapcache() to determine whether xarray is storing swap cache
entries or not to choose the right number of xarray entries to update.
[1] https://lore.kernel.org/linux-mm/Z8idPCkaJW1IChjT@casper.infradead.org/
Note:
In __split_huge_page(), folio_test_anon() && folio_test_swapcache() is
used to get swap_cache address space, but that ignores the shmem folio in
swap cache case. It could lead to NULL pointer dereferencing when a
in-swap-cache shmem folio is split at __xa_store(), since
!folio_test_anon() is true and folio->mapping is NULL. But fortunately,
its caller split_huge_page_to_list_to_order() bails out early with EBUSY
when folio->mapping is NULL. So no need to take care of it here.14dCVE-2024-422757.8 HIG10.5%
——3In the Linux kernel, the following vulnerability has been resolved:
drm/client: Fix error code in drm_client_buffer_vmap_local()
This function accidentally returns zero/success on the failure path.
It leads to locking issues and an uninitialized *map_copy in the
caller.9dCVE-2025-98204.0 MED10.5%
——3A flaw was found in the GnuTLS library, specifically in the gnutls_pkcs11_token_init() function that handles PKCS#11 token initialization. When a token label longer than expected is processed, the function writes past the end of a fixed-size stack buffer. This programming error can cause the application using GnuTLS to crash or, in certain conditions, be exploited for code execution. As a result, systems or applications relying on GnuTLS may be vulnerable to a denial of service or local privilege escalation attacks.44dCVE-2025-218967.8 HIG10.5%
——3In the Linux kernel, the following vulnerability has been resolved:
fuse: revert back to __readahead_folio() for readahead
In commit 3eab9d7bc2f4 ("fuse: convert readahead to use folios"), the
logic was converted to using the new folio readahead code, which drops
the reference on the folio once it is locked, using an inferred
reference on the folio. Previously we held a reference on the folio for
the entire duration of the readpages call.
This is fine, however for the case for splice pipe responses where we
will remove the old folio and splice in the new folio (see
fuse_try_move_page()), we assume that there is a reference held on the
folio for ap->folios, which is no longer the case.
To fix this, revert back to __readahead_folio() which allows us to hold
the reference on the folio for the duration of readpages until either we
drop the reference ourselves in fuse_readpages_end() or the reference is
dropped after it's replaced in the page cache in the splice case.
This will fix the UAF bug that was reported.14dCVE-2026-127235.3 MED10.5%
——3The Kirki WordPress plugin before 6.0.12 does not perform any authorisation check on one of its REST routes, allowing unauthenticated users to overwrite the content of arbitrary existing comments and to create pre-approved comments under a spoofed identity, bypassing comment moderation.24dCVE-2025-6856—10.5%
——3——CVE-2020-37054—10.5%
——3——CVE-2026-5170—10.5%
——3——CVE-2025-24716—10.5%
——3——CVE-2022-39083—10.5%
——3——CVE-2025-2870—10.5%
——3——CVE-2025-43367—10.5%
——3——CVE-2025-64259—10.5%
——3——CVE-2025-15201—10.5%
——3——CVE-2022-25334—10.5%
——3——CVE-2026-349335.5 MED10.5%
——3Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. Prior to version 0.9-rc4, any unprivileged local user can crash avahi-daemon by sending a single D-Bus method call with conflicting publish flags. This issue has been patched in version 0.9-rc4.20dCVE-2023-35192—10.5%
——3——CVE-2022-39085—10.5%
——3——CVE-2022-39082—10.5%
——3——CVE-2026-0563—10.5%
——3——CVE-2025-64296—10.5%
——3——CVE-2022-39086—10.5%
——3——CVE-2026-1055—10.5%
——3——CVE-2025-24712—10.5%
——3——CVE-2023-6625—10.5%
——3——CVE-2023-0196—10.5%
——3——CVE-2023-24439—10.5%
——3——CVE-2022-39088—10.5%
——3——CVE-2023-27966—10.5%
——3——CVE-2025-64199—10.5%
——3——CVE-2025-2868—10.5%
——3——CVE-2019-2228—10.5%
——3——CVE-2022-36348—10.5%
——3——CVE-2026-24634—10.5%
——3——CVE-2025-7982—10.5%
——3——CVE-2026-122134.3 MED10.5%
——3A vulnerability was found in hcengineering Huly Platform up to 0.7.0. Affected by this vulnerability is the function getAccountInfo of the file server/account/src/operations.ts of the component User Information Handler. The manipulation results in improper authorization. The attack may be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.20dCVE-2026-664046.5 MED10.5%
——3DEEBOT PRO M1 and DEEBOT PRO K1VAC do not validate server certificates in MQTT communications. Operation logs and activity logs stored on the affected products may be retrieved.3dCVE-2022-36985—10.5%
——3——CVE-2022-39084—10.5%
——3——CVE-2016-3876—10.5%
——3——