PULSEUnderground Intel

LIVE9signals / 24h

FEED

ransomkrybit reclama a studiotibaldi.it · IT · Professional Servicesransompanzer reclama a Siam Oil Product · TH · Energy & Utilitiesransompanzer reclama a Daily Trust · NG · Otherransomqilin reclama a Impact Centre Chrétien · HT · Otherransomincransom reclama a Louisville Bar Association · US · Professional Servicesransomqilin reclama a Clausing · DE · Manufacturingransomqilin reclama a CLLS Co Ltd · SG · Not Foundransomstorm reclama a United Group of Companies · US · Otherransomstorm reclama a Sawyer Savings Bank · US · Financial Servicesransombravox reclama a MEDICOS · FR · Healthcareransomspacebears reclama a Hitech Distribuzione Informatica S.r.l. (HTDI) · IT · Technologyransomstorm reclama a Pioneer Bank · US · Financial Servicesransomthegentlemen reclama a Hartfiel Automation · DE · Manufacturingransomqilin reclama a Astro Electroplating · US · Manufacturingransomkrybit reclama a studiotibaldi.it · IT · Professional Servicesransompanzer reclama a Siam Oil Product · TH · Energy & Utilitiesransompanzer reclama a Daily Trust · NG · Otherransomqilin reclama a Impact Centre Chrétien · HT · Otherransomincransom reclama a Louisville Bar Association · US · Professional Servicesransomqilin reclama a Clausing · DE · Manufacturingransomqilin reclama a CLLS Co Ltd · SG · Not Foundransomstorm reclama a United Group of Companies · US · Otherransomstorm reclama a Sawyer Savings Bank · US · Financial Servicesransombravox reclama a MEDICOS · FR · Healthcareransomspacebears reclama a Hitech Distribuzione Informatica S.r.l. (HTDI) · IT · Technologyransomstorm reclama a Pioneer Bank · US · Financial Servicesransomthegentlemen reclama a Hartfiel Automation · DE · Manufacturingransomqilin reclama a Astro Electroplating · US · Manufacturing

CVE Watch356,684 in full archive

Vulnerabilities exploitable today

356,684in current view

Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.

In KEV catalog1,662

New KEV · 24H0

Exploit Today ≥ 701,605

Distribution · last window

Critical
2,535
High
10,616
Medium
6,741
Low
667

Filters

Window

Severity

Flags

Vulnerabilities326,481–326,520 · 356,684

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2024-378164.2 MED

——3Quectel EC25-EUX EC25EUXGAR08A05M1G was discovered to contain a stack overflow.35d CVE-2026-12469—

——3——CVE-2021-3551—

——3——CVE-2022-501567.8 HIG

——3In the Linux kernel, the following vulnerability has been resolved: HID: cp2112: prevent a buffer overflow in cp2112_xfer() Smatch warnings: drivers/hid/hid-cp2112.c:793 cp2112_xfer() error: __memcpy() 'data->block[1]' too small (33 vs 255) drivers/hid/hid-cp2112.c:793 cp2112_xfer() error: __memcpy() 'buf' too small (64 vs 255) The 'read_length' variable is provided by 'data->block[0]' which comes from user and it(read_length) can take a value between 0-255. Add an upper bound to 'read_length' variable to prevent a buffer overflow in memcpy().5d CVE-2024-56639—

——3——CVE-2023-38368—

——3——CVE-2025-31267—

——3——CVE-2023-528477.8 HIG

——3In the Linux kernel, the following vulnerability has been resolved: media: bttv: fix use after free error due to btv->timeout timer There may be some a race condition between timer function bttv_irq_timeout and bttv_remove. The timer is setup in probe and there is no timer_delete operation in remove function. When it hit kfree btv, the function might still be invoked, which will cause use after free bug. This bug is found by static analysis, it may be false positive. Fix it by adding del_timer_sync invoking to the remove function. cpu0 cpu1 bttv_probe ->timer_setup ->bttv_set_dma ->mod_timer; bttv_remove ->kfree(btv); ->bttv_irq_timeout ->USE btv5d CVE-2025-26396—

——3——CVE-2025-6944—

——3——CVE-2026-1900—

——3——CVE-2026-37597—

——3——CVE-2026-285114.3 MED

——3eLabFTW is an open source electronic lab notebook. Prior to version 5.4.2, in certain cases, an authenticated user performing a numeric reference/search can return results that include resources the requesting user is not authorized to view. The exposed information is limited (only the title). Attempts to access the underlying protected resource content remain blocked by authorization checks. Version 5.4.2 fixes the issue. # Affected Scope Cross-scope visibility of titles. No confirmed bypass of content-level access controls # Preconditions An authenticated user account No special privileges required beyond standard access # Impact This may enable unauthorized disclosure of sensitive information if confidential data is included in resource titles. Examples could include project names, patient identifiers, or other regulated information embedded in titles.17d CVE-2026-1667—

——3——CVE-2025-5535—

——3——CVE-2026-8536—

——3——CVE-2025-11463—

——3——CVE-2019-14038—

——3——CVE-2024-40620—

——3——CVE-2023-23910—

——3——CVE-2025-9906—

——3——CVE-2024-36343—

——3——CVE-2022-32498—

——3——CVE-2025-55104—

——3——CVE-2025-67551—

——3——CVE-2026-1927—

——3——CVE-2024-39779—

——3——CVE-2024-26671—

——3——CVE-2026-92482.6 LOW

——3Authorization bypass in the entry duplication feature in Devolutions Server allows an authenticated user with write access to any vault to copy documentation and attachments from an entry in a vault they cannot access via a crafted save request. This issue affects : * Devolutions Server 2026.1.6.0 through 2026.1.16.0 * Devolutions Server 2025.3.20.0 and earlier17d CVE-2025-68516—

——3——CVE-2026-598824.2 MED

——3guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Prior to 2.12.3, Uri::assertValidHost() does not reject URI host components containing authority delimiters, embedded ports, or malformed IPv6 brackets, allowing Uri::getHost() to disagree with the URI authority used for security or routing decisions. This issue is fixed in version 2.12.3.23d CVE-2026-37591—

——3——CVE-2020-11132—

——3——CVE-2025-6378—

——3——CVE-2025-4775—

——3——CVE-2024-22167—

——3——CVE-2025-0941—

——3——CVE-2025-67544—

——3——CVE-2025-21975—

——3——CVE-2025-67552—