Vulnerabilities exploitable today
356,679in current view
Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.
In KEV catalog1,662
New KEV · 24H0
Exploit Today ≥ 701,605
Distribution · last window
- Critical2,536
- High10,664
- Medium6,766
- Low673
Window
Severity
Flags
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2025-23715—8.0%
——2——CVE-2024-28519—8.0%
——2——CVE-2025-62755—8.0%
——2——CVE-2021-47280—8.0%
——2——CVE-2025-9968—8.0%
——2——CVE-2025-40286—8.0%
——2——CVE-2024-44307—8.0%
——2——CVE-2026-112854.3 MED8.0%
——2Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)17dCVE-2023-54001—8.0%
——2——CVE-2022-49746—8.0%
——2——CVE-2022-49751—8.0%
——2——CVE-2025-20185—8.0%
——2——CVE-2024-39546—8.0%
——2——CVE-2026-6408—8.0%
——2——CVE-2017-14887—8.0%
——2——CVE-2025-38696—8.0%
——2——CVE-2026-141264.3 MED8.0%
——2Incorrect security UI in UI in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to perform domain spoofing via a crafted HTML page. (Chromium security severity: Low)33dCVE-2025-62147—8.0%
——2——CVE-2022-34399—8.0%
——2——CVE-2026-47236—8.0%
——2——CVE-2024-42255—8.0%
——2——CVE-2025-62092—8.0%
——2——CVE-2018-25216—8.0%
——2——CVE-2026-55517—8.0%
——2——CVE-2025-380657.8 HIG8.0%
——2In the Linux kernel, the following vulnerability has been resolved:
orangefs: Do not truncate file size
'len' is used to store the result of i_size_read(), so making 'len'
a size_t results in truncation to 4GiB on 32-bit systems.10dCVE-2026-28536—8.0%
——2——CVE-2025-63031—8.0%
——2——CVE-2024-43269—8.0%
——2——CVE-2017-15823—8.0%
——2——CVE-2023-53357—8.0%
——2——CVE-2017-15830—8.0%
——2——CVE-2023-0036—8.0%
——2——CVE-2023-0035—8.0%
——2——CVE-2026-108908.8 HIG8.0%
——2Use after free in Cast in Google Chrome prior to 149.0.7827.53 allowed an attacker on the local network segment to potentially exploit heap corruption via malicious network traffic. (Chromium security severity: Critical)17dCVE-2024-580947.8 HIG8.0%
——2In the Linux kernel, the following vulnerability has been resolved:
jfs: add check read-only before truncation in jfs_truncate_nolock()
Added a check for "read-only" mode in the `jfs_truncate_nolock`
function to avoid errors related to writing to a read-only
filesystem.
Call stack:
block_write_begin() {
jfs_write_failed() {
jfs_truncate() {
jfs_truncate_nolock() {
txEnd() {
...
log = JFS_SBI(tblk->sb)->log;
// (log == NULL)
If the `isReadOnly(ip)` condition is triggered in
`jfs_truncate_nolock`, the function execution will stop, and no
further data modification will occur. Instead, the `xtTruncate`
function will be called with the "COMMIT_WMAP" flag, preventing
modifications in "read-only" mode.4dCVE-2025-15557—8.0%
——2——CVE-2025-62138—8.0%
——2——CVE-2024-36002—8.0%
——2——CVE-2022-30628—8.0%
——2——CVE-2023-536467.8 HIG8.0%
——2In the Linux kernel, the following vulnerability has been resolved:
drm/i915/perf: add sentinel to xehp_oa_b_counters
Arrays passed to reg_in_range_table should end with empty record.
The patch solves KASAN detected bug with signature:
BUG: KASAN: global-out-of-bounds in xehp_is_valid_b_counter_addr+0x2c7/0x350 [i915]
Read of size 4 at addr ffffffffa1555d90 by task perf/1518
CPU: 4 PID: 1518 Comm: perf Tainted: G U 6.4.0-kasan_438-g3303d06107f3+ #1
Hardware name: Intel Corporation Meteor Lake Client Platform/MTL-P DDR5 SODIMM SBS RVP, BIOS MTLPFWI1.R00.3223.D80.2305311348 05/31/2023
Call Trace:
<TASK>
...
xehp_is_valid_b_counter_addr+0x2c7/0x350 [i915]
(cherry picked from commit 2f42c5afb34b5696cf5fe79e744f99be9b218798)4d