Vulnerabilities exploitable today
358,955in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,665
New KEV · 24H0
Exploit Today ≥ 701,607
Distribution · last window
- Critical2,699
- High11,582
- Medium7,301
- Low679
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2025-398498.8 HIG10.4%
——3In the Linux kernel, the following vulnerability has been resolved:
wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result()
If the ssid->datalen is more than IEEE80211_MAX_SSID_LEN (32) it would
lead to memory corruption so add some bounds checking.14dCVE-2025-5540—10.4%
——3——CVE-2023-52673—10.4%
——3——CVE-2024-13954—10.4%
——3——CVE-2022-41183—10.4%
——3——CVE-2025-55112—10.4%
——3——CVE-2024-1440—10.4%
——3——CVE-2026-3889—10.4%
——3——CVE-2026-195886.5 MED10.4%
——3Integer Overflow to Buffer Overflow vulnerability in Samsung Open Source rlottie allows Overflow Buffers.23hCVE-2025-52889—10.4%
——3——CVE-2024-29093—10.4%
——3——CVE-2025-59825—10.4%
——3——CVE-2025-6140—10.4%
——3——CVE-2025-62027—10.4%
——3——CVE-2018-16261—10.4%
——3——CVE-2025-714007.1 HIG10.4%
——3better-auth passkey versions before 1.4.0 contain an insecure direct object reference vulnerability in the passkey deletion endpoint that allows authenticated users to delete arbitrary passkeys by ID. Attackers with valid sessions can submit crafted requests to the delete-passkey endpoint with enumerated passkey IDs to remove other users' passkeys.10dCVE-2022-50111—10.4%
——3——CVE-2022-32618—10.4%
——3——CVE-2025-48112—10.4%
——3——CVE-2026-42776—10.4%
——3——CVE-2025-1473—10.4%
——3——CVE-2026-503035.5 MED10.4%
——3Use of a cryptographic primitive with a risky implementation in Windows Key Guard allows an authorized attacker to bypass a security feature locally.22dCVE-2026-28822—10.4%
——3——CVE-2023-49132—10.4%
——3——CVE-2024-31303—10.4%
——3——CVE-2024-45753—10.3%
——3——CVE-2026-48759—10.4%
——3——CVE-2022-507197.8 HIG10.4%
——3In the Linux kernel, the following vulnerability has been resolved:
ALSA: line6: fix stack overflow in line6_midi_transmit
Correctly calculate available space including the size of the chunk
buffer. This fixes a buffer overflow when multiple MIDI sysex
messages are sent to a PODxt device.9dCVE-2024-51457—10.4%
——3——CVE-2024-358987.0 HIG10.4%
——3In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get()
nft_unregister_flowtable_type() within nf_flow_inet_module_exit() can
concurrent with __nft_flowtable_type_get() within nf_tables_newflowtable().
And thhere is not any protection when iterate over nf_tables_flowtables
list in __nft_flowtable_type_get(). Therefore, there is pertential
data-race of nf_tables_flowtables list entry.
Use list_for_each_entry_rcu() to iterate over nf_tables_flowtables list
in __nft_flowtable_type_get(), and use rcu_read_lock() in the caller
nft_flowtable_type_get() to protect the entire type query process.9dCVE-2024-467307.8 HIG10.4%
——3In the Linux kernel, the following vulnerability has been resolved:
drm/amd/display: Ensure array index tg_inst won't be -1
[WHY & HOW]
tg_inst will be a negative if timing_generator_count equals 0, which
should be checked before used.
This fixes 2 OVERRUN issues reported by Coverity.9dCVE-2024-3076—10.4%
——3——CVE-2022-48854—10.4%
——3——CVE-2025-12216—10.4%
——3——CVE-2026-180159.6 CRI10.4%
——3Inappropriate implementation in Tint in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)9dCVE-2026-111336.5 MED10.4%
——3Insufficient policy enforcement in Paint in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)21dCVE-2025-54800—10.4%
——3——CVE-2023-53799—10.4%
——3——CVE-2025-42913—10.4%
——3——CVE-2023-32432—10.4%
——3——