Vulnerabilities exploitable today
356,780in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,662
New KEV · 24H0
Exploit Today ≥ 701,605
Distribution · last window
- Critical2,532
- High10,545
- Medium6,712
- Low670
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2022-32493—9.1%
——3——CVE-2024-34454—9.1%
——3——CVE-2026-40080—9.1%
——3——CVE-2025-5645—9.1%
——3——CVE-2025-15249—9.0%
——3——CVE-2024-36534—9.1%
——3——CVE-2024-44636—9.1%
——3——CVE-2022-489327.8 HIG9.1%
——3In the Linux kernel, the following vulnerability has been resolved:
net/mlx5: DR, Fix slab-out-of-bounds in mlx5_cmd_dr_create_fte
When adding a rule with 32 destinations, we hit the following out-of-band
access issue:
BUG: KASAN: slab-out-of-bounds in mlx5_cmd_dr_create_fte+0x18ee/0x1e70
This patch fixes the issue by both increasing the allocated buffers to
accommodate for the needed actions and by checking the number of actions
to prevent this issue when a rule with too many actions is provided.6dCVE-2023-23782—9.1%
——3——CVE-2025-22104—9.1%
——3——CVE-2025-37109—9.1%
——3——CVE-2024-422337.8 HIG9.1%
——3In the Linux kernel, the following vulnerability has been resolved:
filemap: replace pte_offset_map() with pte_offset_map_nolock()
The vmf->ptl in filemap_fault_recheck_pte_none() is still set from
handle_pte_fault(). But at the same time, we did a pte_unmap(vmf->pte).
After a pte_unmap(vmf->pte) unmap and rcu_read_unlock(), the page table
may be racily changed and vmf->ptl maybe fails to protect the actual page
table. Fix this by replacing pte_offset_map() with
pte_offset_map_nolock().
As David said, the PTL pointer might be stale so if we continue to use
it infilemap_fault_recheck_pte_none(), it might trigger UAF. Also, if
the PTL fails, the issue fixed by commit 58f327f2ce80 ("filemap: avoid
unnecessary major faults in filemap_fault()") might reappear.6dCVE-2024-27825—9.1%
——3——CVE-2019-10512—9.1%
——3——CVE-2023-49144—9.1%
——3——CVE-2025-40279—9.1%
——3——CVE-2024-47193—9.1%
——3——CVE-2024-0078—9.1%
——3——CVE-2026-288985.3 MED9.1%
——3swift-nio-http2's HTTP/2-to-HTTP/1.1 codec did not validate pseudo-header values for control characters before placing them into the translated HTTP/1.1 message. swift-nio-http2 1.44.1 adds validation of all pseudo-header values (:path, :authority, :scheme, :method, and :status) at both the HPACK header validation layer and the HTTP/2-to-HTTP/1.1 translation layer. Requests or responses containing CR, LF, or NUL bytes in any pseudo-header value are now rejected with a connection error. This issue is fixed in swift-nio-http2 1.44.1.41dCVE-2023-45763—9.1%
——3——CVE-2025-21833—9.1%
——3——CVE-2024-0082—9.1%
——3——CVE-2026-29953—9.1%
——3——CVE-2018-9438—9.1%
——3——CVE-2023-32460—9.1%
——3——CVE-2025-22168—9.1%
——3——CVE-2019-10507—9.1%
——3——CVE-2024-422497.8 HIG9.0%
——3In the Linux kernel, the following vulnerability has been resolved:
spi: don't unoptimize message in spi_async()
Calling spi_maybe_unoptimize_message() in spi_async() is wrong because
the message is likely to be in the queue and not transferred yet. This
can corrupt the message while it is being used by the controller driver.
spi_maybe_unoptimize_message() is already called in the correct place
in spi_finalize_current_message() to balance the call to
spi_maybe_optimize_message() in spi_async().6dCVE-2026-48434.3 MED9.1%
——3The GSheet For Woo Importer plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the process_ajax_restore_action() function in all versions up to, and including, 2.3.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete the plugin's Google Sheets API token and configuration options.18dCVE-2025-8453—9.1%
——3——CVE-2025-61872—9.1%
——3——CVE-2024-36557—9.1%
——3——CVE-2026-87066.5 MED9.1%
——3Firefox for iOS hosted Reader mode on an unauthenticated local web server, allowing another application on the same device to request arbitrary URLs and receive the response rendered with the signed-in user's cookies. This vulnerability was fixed in Firefox for iOS 151.0.17dCVE-2026-619712.7 LOW9.1%
——3Authorization Bypass Through User-Controlled Key vulnerability in Cozmoslabs User Profile Picture metronet-profile-picture allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Profile Picture: from n/a through <= 2.6.3.28dCVE-2026-161064.9 MED9.1%
——3A flaw was found in the admin REST API of Keycloak, a solution for identity and access management. The issue occurs when a delegated administrator attempts to remove a child role from a composite role. Due to missing authorization checks, an attacker with limited administrative permissions can remove privileged roles they are not authorized to manage, leading to a loss of access for other users and administrators.4dCVE-2026-554755.7 MED9.1%
——3Snipe-IT is an IT asset/license management system. Prior to 8.6.1, the Importer API endpoint allows a user with CSV import capabilities and a valid API key to overwrite the created_by value of an import file, allowing unauthorized modification of import ownership metadata. This issue is fixed in version 8.6.1.27dCVE-2023-25602—9.1%
——3——CVE-2024-1375—9.1%
——3——CVE-2025-43310—9.1%
——3——CVE-2025-52564—9.1%
——3——