PULSEUnderground Intel

LIVE6signals / 24h

FEED

ransomincransom reclama a Louisville Bar Association · US · Professional Servicesransomqilin reclama a Clausing · DE · Manufacturingransomqilin reclama a CLLS Co Ltd · SG · Not Foundransomstorm reclama a United Group of Companies · US · Otherransomstorm reclama a Sawyer Savings Bank · US · Financial Servicesransombravox reclama a MEDICOS · FR · Healthcareransomspacebears reclama a Hitech Distribuzione Informatica S.r.l. (HTDI) · IT · Technologyransomstorm reclama a Pioneer Bank · US · Financial Servicesransomthegentlemen reclama a Hartfiel Automation · DE · Manufacturingransomqilin reclama a Astro Electroplating · US · Manufacturingransomqilin reclama a Filtronic · GB · Manufacturingransomqilin reclama a EISNER ZT GMBH · AT · Professional Servicesransomqilin reclama a John C Saunders, CPA · US · Professional Servicesransomqilin reclama a Nikan Awasisak Agency · CA · Not Foundransomincransom reclama a Louisville Bar Association · US · Professional Servicesransomqilin reclama a Clausing · DE · Manufacturingransomqilin reclama a CLLS Co Ltd · SG · Not Foundransomstorm reclama a United Group of Companies · US · Otherransomstorm reclama a Sawyer Savings Bank · US · Financial Servicesransombravox reclama a MEDICOS · FR · Healthcareransomspacebears reclama a Hitech Distribuzione Informatica S.r.l. (HTDI) · IT · Technologyransomstorm reclama a Pioneer Bank · US · Financial Servicesransomthegentlemen reclama a Hartfiel Automation · DE · Manufacturingransomqilin reclama a Astro Electroplating · US · Manufacturingransomqilin reclama a Filtronic · GB · Manufacturingransomqilin reclama a EISNER ZT GMBH · AT · Professional Servicesransomqilin reclama a John C Saunders, CPA · US · Professional Servicesransomqilin reclama a Nikan Awasisak Agency · CA · Not Found

CVE Watch356,659 in full archive

Vulnerabilities exploitable today

356,659in current view

Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.

In KEV catalog1,662

New KEV · 24H0

Exploit Today ≥ 701,605

Distribution · last window

Critical
2,532
High
10,669
Medium
6,832
Low
683

Filters

Window

Severity

Flags

Vulnerabilities328,001–328,040 · 356,659

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2025-31202—

——2——CVE-2023-54194—

——2——CVE-2026-64564—

——2In the Linux kernel, the following vulnerability has been resolved: sctp: don't free the ASCONF's own transport in DEL-IP processing sctp_process_asconf() caches the transport the ASCONF chunk is processed against in asconf->transport (== chunk->transport, set once in sctp_rcv()). For an ASCONF located through its Address Parameter by __sctp_rcv_asconf_lookup(), that cached transport corresponds to the Address Parameter, which need not be the packet's source address. sctp_process_asconf_param() rejects a DEL-IP for the packet source address (ADDIP D8, SCTP_ERROR_DEL_SRC_IP), but nothing protects asconf->transport. A single ASCONF can therefore carry, in order: [Address Parameter L] [DEL-IP L] [DEL-IP 0.0.0.0] where L differs from the source. The DEL-IP for L passes the D8 check and calls sctp_assoc_rm_peer() on the transport that asconf->transport still points at, freeing it (RCU-deferred). The following wildcard DEL-IP then reuses the now-dangling asconf->transport in sctp_assoc_set_primary() and sctp_assoc_del_nonprimary_peers(): set_primary() dereferences the freed transport (->ipaddr, ->state) and plants the dangling pointer into asoc->peer.primary_path / active_path, and del_nonprimary_peers(), keeping only the pointer that is no longer on the list, removes every real transport, leaving the association with a transport_count of 0 and primary_path/active_path pointing at freed memory. Reject a DEL-IP that targets the transport the ASCONF is being processed against, mirroring the existing source-address guard, so the wildcard branch can never reuse a freed transport.15h CVE-2024-26859—

——2——CVE-2023-3495—

——2——CVE-2025-10570—

——2——CVE-2025-2545—

——2——CVE-2025-32425—

——2——CVE-2026-40875—

——2——CVE-2026-178456.1 MED

——2Inappropriate implementation in CSS in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Medium)5d CVE-2024-27817—

——2——CVE-2025-66085—

——2——CVE-2021-34391—

——2——CVE-2025-69237—

——2——CVE-2024-41811—

——2——CVE-2023-53787—

——2——CVE-2025-12056—

——2——CVE-2025-2180—

——2——CVE-2022-28768—

——2——CVE-2026-8563—

——2——CVE-2026-112594.3 MED

——2Insufficient validation of untrusted input in Cast in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Low)16d CVE-2026-33588—

——2——CVE-2024-57844—

——2——CVE-2026-48493—

——2——CVE-2026-156129.1 CRI

——2Logto bypasses OIDC nonce validation when the nonce claim is absent from the id_token, enabling replay of authentication tokens and weakening session-binding.12d CVE-2018-25377—

——2——CVE-2024-51534—

——2——CVE-2023-52771—

——2——CVE-2024-47006—

——2——CVE-2025-14347—

——2——CVE-2024-35557—

——2——CVE-2025-46285—

——2——CVE-2025-30040—

——2——CVE-2026-0662—

——2——CVE-2026-615024.3 MED

——2Rejetto HFS 3.0.0 through 3.2.0 accepts state-changing API requests via the GET method and exempts GET requests from its anti-CSRF header check. A remote attacker can perform administrative actions including account creation and configuration changes leading to code execution - by causing a logged-in administrator's browser to navigate to a crafted URL, or without any credentials against default installations when the attack originates from the server's own machine.25d CVE-2025-6681—

——2——CVE-2022-31643—

——2——CVE-2025-6692—

——2——CVE-2026-48488—

——2phpMyFAQ is an open source FAQ web application. Prior to version 4.1.4, attachment passwords are hashed using SHA-1, a cryptographically broken algorithm. SHA-1 has been vulnerable to collision attacks since 2017 (SHAttered). Version 4.1.4 fixes the issue.16d CVE-2024-42492—