Vulnerabilities exploitable today
356,740in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,662
New KEV · 24H0
Exploit Today ≥ 701,605
Distribution · last window
- Critical2,543
- High10,600
- Medium6,748
- Low666
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2025-21841—8.7%
——3——CVE-2024-450237.8 HIG8.7%
——3In the Linux kernel, the following vulnerability has been resolved:
md/raid1: Fix data corruption for degraded array with slow disk
read_balance() will avoid reading from slow disks as much as possible,
however, if valid data only lands in slow disks, and a new normal disk
is still in recovery, unrecovered data can be read:
raid1_read_request
read_balance
raid1_should_read_first
-> return false
choose_best_rdev
-> normal disk is not recovered, return -1
choose_bb_rdev
-> missing the checking of recovery, return the normal disk
-> read unrecovered data
Root cause is that the checking of recovery is missing in
choose_bb_rdev(). Hence add such checking to fix the problem.
Also fix similar problem in choose_slow_rdev().5dCVE-2025-8002—8.7%
——3——CVE-2025-7997—8.7%
——3——CVE-2026-417008.1 HIG8.7%
——3Spring for GraphQL applications that have enabled the WebSocket transport are vulnerable to Cross-Site WebSocket Hijacking. An attacker can trick an authenticated user into visiting a malicious page, allowing the attacker to execute arbitrary GraphQL operations with the victim's credentials.
Affected versions:
Spring for GraphQL 2.0.0 through 2.0.3; 1.4.0 through 1.4.5; 1.3.0 through 1.3.8; 1.0.0 through 1.0.6.17dCVE-2026-523706.1 MED8.7%
——3A reflected cross-site scripting (XSS) vulnerability in the Forum posting function of O2OA v10 allows attackers to execute arbitrary Javascript in the context of the victim's browser via a crafted URL.4dCVE-2024-27378—8.7%
——3——CVE-2026-21927—8.7%
——3——CVE-2026-21935—8.7%
——3——CVE-2020-11162—8.7%
——3——CVE-2017-6276—8.7%
——3——CVE-2026-44782—8.7%
——3——CVE-2023-538518.4 HIG8.7%
——3In the Linux kernel, the following vulnerability has been resolved:
drm/msm/dp: Drop aux devices together with DP controller
Using devres to depopulate the aux bus made sure that upon a probe
deferral the EDP panel device would be destroyed and recreated upon next
attempt.
But the struct device which the devres is tied to is the DPUs
(drm_dev->dev), which may be happen after the DP controller is torn
down.
Indications of this can be seen in the commonly seen EDID-hexdump full
of zeros in the log, or the occasional/rare KASAN fault where the
panel's attempt to read the EDID information causes a use after free on
DP resources.
It's tempting to move the devres to the DP controller's struct device,
but the resources used by the device(s) on the aux bus are explicitly
torn down in the error path. The KASAN-reported use-after-free also
remains, as the DP aux "module" explicitly frees its devres-allocated
memory in this code path.
As such, explicitly depopulate the aux bus in the error path, and in the
component unbind path, to avoid these issues.
Patchwork: https://patchwork.freedesktop.org/patch/542163/5dCVE-2025-48885—8.7%
——3——CVE-2026-179614.3 MED8.7%
——3Inappropriate implementation in Session in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low)6dCVE-2026-176669.1 CRI8.7%
——3Cryptographic Flaw in Enterprise in Google Chrome prior to 151.0.7922.72 allowed an attacker in a privileged network position to bypass discretionary access control via malicious network traffic. (Chromium security severity: High)6dCVE-2024-36282—8.7%
——3——CVE-2026-182146.8 MED8.7%
——3Keycloak allows users to log in using Google accounts and can be configured to only allow users from specific Google Workspace domains. A flaw was found where the token exchange feature, which allows swapping a Google token for a Keycloak token, does not check these domain restrictions. This means an attacker with a valid Google account from a different domain could bypass the security check and gain access to the Keycloak realm.2dCVE-2025-26398—8.7%
——3——CVE-2025-7986—8.7%
——3——CVE-2025-62750—8.7%
——3——CVE-2026-48186.8 MED8.7%
——3In Search Guard FLX versions from 3.0.0 up to 4.0.1, there exists an issue which allows users without the necessary privileges to execute some management operations against data streams.16dCVE-2025-7989—8.7%
——3——CVE-2026-117812.7 LOW8.7%
——3The Adminify WordPress plugin before 4.2.10 does not perform per-user read-capability checks on the results returned by one of its administration search features, allowing users with a low-privilege role (Contributor) to disclose non-public content that WordPress would not otherwise expose to them, such as other authors' unpublished post titles, pending comment content, the site's Adminify WordPress plugin before 4.2.10 inventory, and user account names.38dCVE-2026-2716—8.7%
——3——CVE-2025-68162—8.7%
——3——CVE-2026-140734.3 MED8.7%
——3Insufficient validation of untrusted input in WebXR in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low)39dCVE-2026-179444.3 MED8.7%
——3Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low)6dCVE-2026-1045—8.7%
——3——CVE-2020-3624—8.7%
——3——CVE-2025-36632—8.7%
——3——CVE-2024-44198—8.7%
——3——CVE-2020-11131—8.7%
——3——CVE-2024-56671—8.7%
——3——CVE-2024-9500—8.7%
——3——CVE-2026-9610—8.7%
——3——CVE-2024-52420—8.7%
——3——CVE-2026-4596—8.7%
——3——CVE-2025-21073—8.7%
——3——CVE-2022-24378—8.7%
——3——