Vulnerabilities exploitable today
358,897in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,665
New KEV · 24H0
Exploit Today ≥ 701,607
Distribution · last window
- Critical2,704
- High11,656
- Medium7,416
- Low682
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2025-217097.8 HIG9.8%
——3In the Linux kernel, the following vulnerability has been resolved:
kernel: be more careful about dup_mmap() failures and uprobe registering
If a memory allocation fails during dup_mmap(), the maple tree can be left
in an unsafe state for other iterators besides the exit path. All the
locks are dropped before the exit_mmap() call (in mm/mmap.c), but the
incomplete mm_struct can be reached through (at least) the rmap finding
the vmas which have a pointer back to the mm_struct.
Up to this point, there have been no issues with being able to find an
mm_struct that was only partially initialised. Syzbot was able to make
the incomplete mm_struct fail with recent forking changes, so it has been
proven unsafe to use the mm_struct that hasn't been initialised, as
referenced in the link below.
Although 8ac662f5da19f ("fork: avoid inappropriate uprobe access to
invalid mm") fixed the uprobe access, it does not completely remove the
race.
This patch sets the MMF_OOM_SKIP to avoid the iteration of the vmas on the
oom side (even though this is extremely unlikely to be selected as an oom
victim in the race window), and sets MMF_UNSTABLE to avoid other potential
users from using a partially initialised mm_struct.
When registering vmas for uprobe, skip the vmas in an mm that is marked
unstable. Modifying a vma in an unstable mm may cause issues if the mm
isn't fully initialised.14dCVE-2026-488657.1 HIG9.8%
——3Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThimPress LearnPress allows Reflected XSS.
This issue affects LearnPress: from n/a through 4.3.6.22dCVE-2026-177995.4 MED9.8%
——3Insufficient validation of untrusted input in Safe Browsing in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass discretionary access control via a malicious file. (Chromium security severity: Medium)9dCVE-2025-31218—9.8%
——3——CVE-2022-22557—9.8%
——3——CVE-2022-37341—9.8%
——3——CVE-2025-9512—9.8%
——3——CVE-2026-40335—9.8%
——3——CVE-2026-8842—9.8%
——3——CVE-2026-40339—9.8%
——3——CVE-2025-32477—9.8%
——3——CVE-2019-5258—9.8%
——3——CVE-2025-36239—9.8%
——3——CVE-2025-43771—9.8%
——3——CVE-2026-40338—9.8%
——3——CVE-2025-7027—9.8%
——3——CVE-2026-22169—9.8%
——3——CVE-2025-43812—9.8%
——3——CVE-2025-43366—9.8%
——3——CVE-2025-31026—9.8%
——3——CVE-2026-49865.3 MED9.8%
——3The WPForms WordPress plugin before 1.10.0.5 does not verify the authenticity of incoming PayPal webhook events before processing them, allowing unauthenticated attackers to forge webhook payloads and manipulate the payment state of arbitrary transactions.21dCVE-2025-32476—9.8%
——3——CVE-2025-36467.3 HIG9.8%
——3Petlibro Smart Pet Feeder Platform versions up to 1.7.31 contains an authorization bypass vulnerability that allows unauthorized users to add users as shared owners to any device by exploiting missing permission checks. Attackers can send requests to the device share API to gain unauthorized access to devices and view owner information without proper authorization validation.23dCVE-2024-47305—9.8%
——3——CVE-2025-36248—9.8%
——3——CVE-2025-32113—9.8%
——3——CVE-2025-20356—9.8%
——3——CVE-2026-24122—9.8%
——3——CVE-2025-31391—9.8%
——3——CVE-2026-21984—9.8%
——3——CVE-2026-8847—9.8%
——3——CVE-2025-31385—9.8%
——3——CVE-2025-31402—9.8%
——3——CVE-2025-31388—9.8%
——3——CVE-2025-31399—9.8%
——3——CVE-2025-62011—9.8%
——3——CVE-2026-664146.1 MED9.8%
——3Leantime 3.6.2 contains an open redirect vulnerability in the Login controller that allows unauthenticated attackers to redirect authenticated users to arbitrary external sites by manipulating the redirectUrl POST parameter. Attackers can craft a malicious login URL with a tampered redirectUrl value that bypasses FILTER_SANITIZE_URL validation to redirect victims to attacker-controlled sites for phishing or credential theft.13dCVE-2025-32480—9.8%
——3——CVE-2016-3875—9.8%
——3——CVE-2025-7026—9.8%
——3——